Editing Risk (section)

==Incident Response for At-Risk Accounts==

Most CS orgs let an at-risk account drift in "I'll check on that" limbo for weeks until it either recovers or churns and surprises everyone in the renewal forecast. Declare an account incident when a health score crosses into the critical band, or when a running play's own escalation trigger fires without resolution in its window.

'''Severity levels:'''
* '''Sev1''' — imminent churn, or the customer has already escalated to an executive. Daily standup, exec sponsor pulled in immediately.
* '''Sev2''' — clearly at-risk but not yet in free-fall. Twice-weekly check-in, CS leadership visibility.
* '''Sev3''' — watch status. The triggering play is running; escalate only if it misses its own success criteria.

'''Roles:''' an incident owner (usually the account's CSM or TAM) runs the response and owns the timeline; CS leadership gets visibility on Sev2+ and direct involvement on Sev1; product, support, sales, or the exec sponsor get pulled in depending on whether the gap is technical, commercial, or relational.

An incident closes in one of two states, both logged: '''resolved''' (health score recovers, or the renewal/expansion completes) or '''lost''' (the account churns or downsizes despite the response). Both states feed [[The Postmortem (Churn and Save Retros)|the postmortem]] — a save is just as worth reviewing as a loss.