Skip to content

Lesson 4.4 - Alerts and Escalation

“The Alert Fired. What Now?”

An exposure alert appears on the dashboard. One Dealer ignores it because no one has given a direct instruction yet. Another Dealer immediately takes a control action without approval.

Both responses are wrong.

The correct response is to understand:

  • What type of signal appeared?
  • Is it informational, attention-worthy, decision-level or emergency?
  • What evidence is required?
  • Who owns the next decision?
Level Meaning Typical Action
Informational Trend notice / no action required yet Monitor
Warning Risk moving toward concern Verify and increase monitoring
Needs Review Risk is changing quickly, concentration is high or a major event is near Notify the Shift Leader and risk team
Needs Decision A production setting, client condition or risk action may be required Escalate immediately to the Shift Leader and authorized approver
Emergency Material/systemic risk Incident process and management escalation
Alert Triggered → Identify Threshold Type
Identify → Verify Data / Scope
Verify → Add Market / Client / QuoteSource / Quote Context
Context → Risk Signal Level
Decide → Enhanced Monitoring
Decide → Notify Risk / Shift Lead
Decide → Immediate Escalation
Monitor → Record
Notify → Record
Escalate → Record

A useful alert includes:

  • What triggered.
  • Current value and recent change.
  • Symbol/group/client scope.
  • Trend direction.
  • Time and market context.
  • Shift Leader / follow-up and next required action.

Bad:

“XAUUSD exposure high.”

Good:

“20:28 UTC — XAUUSD net buy exposure increased materially in 10 minutes. Top two client groups represent 64% of the net long. CPI is due in two minutes; quote-source participation is weakening. Current action: enhanced monitoring. Risk review requested.”

Trend Ignored Until Risk Expands

A risk signal appears 20 minutes before a major event. No one checks the trend. Client order flow accelerates at the event release, when execution conditions are already weak.

Lesson: early risk signals create time for better decisions.

Alerts only protect the business when they are understood, verified, reported to the Shift Leader, escalated and acted on according to defined authority.

If the company does not use fixed exposure thresholds, Dealers should focus on trend, concentration, event timing and decision leadship. The table below standardizes the review language.

Risk Condition What to Watch Responsible Role Allowed Action Evidence Required
Symbol net exposure Fast increase, one-sided build-up Risk lead Enhanced monitoring / escalation / approved action Exposure snapshot, timestamp, top groups
Gross exposure Material increase in overall size Risk lead Review concentration and correlation Net/gross breakdown
Client/group concentration Risk dominated by a few groups Shift Leader + Risk / Compliance as needed Evidence review / approved action Group trading result, behavior, order IDs
Event-window risk Major news, open, close or rollover approaching Shift lead + Risk Event mode / monitoring / approved actions Calendar, exposure, pending orders
Execution quality deterioration Persistent platform rejects, latency or slippage Desk + Technology Route / quote-source investigation Rejects, latency, slippage, fill quality
Data freshness failure Dashboard stale or inconsistent Technology lead Stop relying on stale dashboard; use fallback Last update time, affected metrics

Rule: a Dealer may escalate risk and request a decision, but abnormal trading patterns should be reported to the Shift Leader, and material trading-condition changes require the approved approver.

Structured Risk Escalation Update

When risk moves from monitoring to decision support, use a structured update. The purpose is to show the company risk, the evidence behind it and what decision is required.

Time:
Subject:

Observation:

Scope / Impact:
- Symbol:
- Client group / account scope:
- Net exposure:
- Gross exposure:
- Direction:
- Concentration:
- Correlated products:
- Pending orders:

risk impact:
- Client realized trading result:
- Client floating trading result:
- Broker realized trading result:
- Broker floating trading result:
- Change since last update:

Behavior / flow:
- Holding-time pattern:
- Short-term price movement after execution:
- Slippage / execution outcome:
- Account or strategy correlation:
- Abnormal-flow flag / reason:

Execution condition:
- Internal matching available:
- Quote-source status / approved control options:
- Depth:
- Latency:
- Bridge queue:
- Fill / reject trend:

Market context:
- Session:
- Event timing:
- Volatility / spread condition:

Current action:
- Enhanced monitoring:
- Verification in progress:
- Approved action taken:
- Client-impact review:

Decision / support needed:
- Requested action:
- Expected risk reduction:
- Approver:
- Deadline / next decision point:

Shift Leader / follow-up:
Next update:

Good escalation is not simply "risk is high." It states the exposure, trend, impact, context, current action and decision needed.

Completion Criteria

  • Can explain the key risk or operational objective of this lesson
  • Can identify the required systems, data, or evidence to review
  • Can describe the correct escalation or handling process
  • Has completed Shift Leader / follow-up review or practical confirmation