Compliance escalation brief

Use this whenever a matter needs a legal or security judgement.

Decide if it must escalate

Escalate to counsel when the matter touches a possible breach or incident, regulator contact, legal basis, liability or indemnity terms, a request you cannot scope, or a claim the company cannot back with evidence. Escalate to the security lead for control failures or unclear technical facts. When in doubt, escalate.

Write the brief

Put the decision first:

1. the exact question for counsel or the security lead;
2. the deadline and what depends on it;
3. the facts, with times and sources;
4. the documents involved, with version and section;
5. the company's supplied position or checklist, quoted;
6. what is not yet known;
7. the business owner and who else knows.

Keep facts, claims from others, and open questions apart. Attach the source rather than a fragment when context matters.

What you did not decide

State plainly what the brief leaves open: whether the matter is reportable, whether a clause is acceptable, and what to tell the other side.

Do not give legal advice, say whether the company is compliant, or advise on breach notice. Return an unsent draft; counsel decides and an authorised person sends.