Module 3 — Incident Response¶
1. Start With a Timeline¶
Record when the signal first appeared, when it was verified, the affected symbol or order, visible impact and the sources used. Keep confirmed facts separate from assumptions.
2. Common Incident Patterns¶
| Pattern | Evidence to review | Escalate when |
|---|---|---|
| Price spike or suspected off-market price | Platform Tick, independent source, Quote Source timestamps, affected orders | Sources diverge materially, client orders are affected or cause remains unclear |
| Stale or stopped quote | Updated time, session state, connection state, other symbols | Updates stop, reconnects repeat or impact widens |
| Spread widening | Market context, multiple sources, pool status, recent spread trend | Change is isolated, persistent or affects execution |
| Execution delay / rejection | Order timeline, server records, queue state, related order results | Multiple orders are affected or delay/rejection persists |
| Exposure concentration | Symbol, direction, account/UID, gross and net position, time window | Concentration grows rapidly or approaches an approved control threshold |
3. Evidence-Based Update¶
Use this short format:
Time: 14:06 server time
Observation: XAUUSD spread widened and one Quote Source stopped contributing.
Scope: One pricing pool; three large orders under review.
Evidence: Symbol Overview, Connection Status and Decision Stream checked.
Current action: Monitoring continues; Shift Leader / Manager notified.
Next update: At the agreed review time or on material change.
4. When Evidence Is Insufficient¶
Do not decide the root cause or assign responsibility independently. Record confirmed facts, preserve available evidence and escalate through the approved process. Do not blame the client or expand the handling scope before receiving clear instruction.
Practical Scenario¶
A client reports an unfair XAUUSD execution during a news window. The chart moved sharply, the spread widened and the order completed later than nearby orders.
Correct handling: build the complete order and quote timeline, compare independent market evidence, identify the affected segment and escalate without promising an adjustment.
Common mistake: treating the complaint, market movement or a single log entry as sufficient proof of root cause.
Completion Criteria¶
- Can build a basic incident timeline.
- Can select relevant evidence for common incident patterns.
- Can write a factual escalation update.
- Can apply the lesson correctly in a supervised scenario.