Incident Response Plan
Briefing for the Kraken Transformation Director
"Good morning. I'm Chloe, CDL for Commercials. Late Thursday afternoon, United Energy's Domain Owner for Commercials calls me in a panic — 20,000 customers allegedly on the wrong product. Here's how I'd handle it."
A panicked phone call from a Domain Owner is a claim, not a confirmed incident. The worst thing I can do is trigger a chain of escalation across three companies based on unvalidated information.
"I hear you, this is serious and I'm taking it seriously."
"Give me 90 minutes. I'll come back to you with what I know by 7pm."
I don't say "that doesn't sound right" or "it might be the SI's fault." I just commit to finding out.
"On that call, I do three things. I acknowledge their concern genuinely — 'I hear you, this is serious and I'm taking it seriously.' I commit to a specific timeline — 'Give me 90 minutes, I'll come back to you with what I know by 7pm.' And I don't speculate or defend — I don't say 'that doesn't sound right' or 'it might be the SI's fault.' I just commit to finding out.
I'd also ask the Domain Owner to hold off escalating to their own leadership until I come back at 7pm. There's no point in them triggering a panic up their chain based on something we haven't validated yet. That protects them from looking reactive to their own bosses, and it protects us from fighting a political fire alongside the technical one.
Then I investigate. Because a panicked domain owner calling on a Thursday afternoon, pointing the finger at us — that's a claim, not a confirmed incident. Before I mobilise Kraken, I need to know: is this actually real? Is it 20,000 or is it 200? Have any of these customers been billed on the wrong tariff — which in a regulated energy market isn't just a commercial problem, it's potentially an Ofgem compliance issue.
I'm not dismissing the client. But I have a responsibility to Kraken not to trigger an expensive fire drill based on unvalidated information."
Legacy-to-Kraken product comparison matrix
Have any of these customers actually been billed?
Is this one cohort, multiple cohorts, or a systemic pattern?
Spot-check actual rates vs agreed tariffs
AI accelerates the mechanical work, I feed it the mapping table, it flags anomalies across 20,000 accounts instantly.
View Live Dashboard →Full escalation necessary
If the data showed the issue was not confirmed or overstated, I'd share the evidence transparently and ask the Domain Owner to verify against their own records.
"Within 90 minutes, I'd run these four checks. AI accelerates the mechanical work — I'd feed it the legacy-to-Kraken product mapping table to generate the comparison matrix, have it flag anomalies across 20,000 accounts in seconds rather than hours, and build this dashboard from the query results. But I make the judgment calls.
Let me show you what that looks like —
[Click the 'View Live Dashboard' button to open the dashboard in a new browser tab. Scroll through summary stats and sample data.]
You can see the 20,000 flagged versus 12,847 actually affected. The pattern is systematic — one mapping rule. And in the sample data, the contrast between correctly mapped and incorrectly mapped accounts tells the story.
[Switch back to the presentation.]
'Wrong product' in a migration often just means 'differently named in the new system.' I need to see actual rates. Are customers on a tariff that charges them differently from what they agreed to? Overpaying is direct financial harm. Underpaying is revenue exposure for United Energy. The shape of the problem determines the response.
And I'm checking our side too — was the product configured correctly in Kraken? Should the API have caught this? The brief says Kraken validates format but not commercial logic — that could be a gap we need to own. I need to know the answer before the client conversation, not find out during it.
If my investigation confirms it's real and significant — that's the rest of this presentation. If it's overstated, I share my evidence transparently and invite the client to verify. Protect the relationship while protecting Kraken."
| # | Hypothesis | How to Verify | Owner |
|---|---|---|---|
| 1 | Legacy source data was already wrong | Compare legacy product records against expected products | United Energy Systems Integrator |
| 2 | Systems Integrator mapping table maps legacy codes to wrong Kraken products | Request Systems Integrator mapping table, cross-reference with United Energy product catalogue | Systems Integrator United Energy |
| 3 | Systems Integrator pipeline bug — mapping table correct but applied wrongly | Compare raw payloads against what mapping table specifies | Systems Integrator |
| 4 | Product misconfigured in Kraken | Audit Kraken product catalogue against United Energy's intended tariff structure | United Energy Kraken |
| 5 | API processing anomaly at Kraken | Compare API request logs against customer accounts | Kraken Eng |
"My investigation confirmed the issue is real — 12,847 accounts, not 20,000. Now I need to find where it went wrong. There are five points in the data flow where this could have broken.
Starting at the source: was the legacy data itself incorrect? If customers were on the wrong product in the old system, the Systems Integrator faithfully extracted bad data. We check this by sampling legacy records.
Second: the Systems Integrator's mapping table. This translates legacy product codes into Kraken product IDs. If this table is wrong, every customer in the cohort gets the wrong product. We verify by requesting the mapping table and cross-referencing with United Energy's product catalogue.
Third: even if the mapping table is correct, there could be a bug in the Systems Integrator's transformation logic that applied it incorrectly. We check by comparing actual API payloads against what the mapping table says they should contain.
Fourth: the products themselves in Kraken. Were they configured correctly? If Product A and Product B were set up with swapped details, the mapping could be right but the target is wrong. United Energy's Commercials team needs to audit the product catalogue.
Fifth — and least likely — an API processing anomaly at Kraken's end. We check by comparing our API request logs against what's on the customer accounts now.
My investigation plan works through each of these systematically. I'm not here to assign blame — I'm here to find the failure point with data, so we can fix it with confidence."
"This isn't just a Commercials problem — it radiates across the programme. My investigation confirmed 12,847 affected accounts, not the 20,000 initially reported. Critically, 3,214 of those have already been billed — that means we're dealing with real financial harm to customers. That splits into overpayments — direct customer harm — and underpayments — revenue exposure for United Energy. I've briefed the Billing and Comms Client Delivery Leads and they're on standby. No one is going to be blindsided."
"My plan has three phases. First, contain — we've already paused migrations and I've confirmed the billing impact: 3,214 customers billed incorrectly with £847K exposure. Second, correct — once we have the right mapping confirmed by United Energy and validated by the Systems Integrator, we use Kraken's bulk correction capability. Crucially, United Energy's Commercials team confirms what 'correct' looks like for each mapping — this is their domain, their first real test of the ownership model. I'd coach them through it rather than doing it for them. We validate before running — we don't fix 12,847 accounts wrong a second time. Then batch corrections starting small — 500, validate, scale up. For the 3,214 already billed, we reverse and re-issue. Third, prevent — I'm proposing a validation gate so this can never happen again. No migration batch goes to billing without a product reconciliation sign-off."
Communication determines whether this incident damages the relationship or strengthens it. Click each audience to see the email I'd send them — same facts, different tone.
Hi [Name],
Thank you for flagging this so quickly. I want you to know I’m taking this seriously and I’m already on it.
I’ve started an immediate investigation and have pulled the product mapping data for the affected cohort. I’ve also paused any further migrations through this pipeline until we have clarity.
I’ll come back to you by 7pm tonight with what I’ve found — confirmed numbers, whether any customers have been billed, and my recommended next steps.
In the meantime, I’d suggest holding off on escalating to your leadership until we have the facts. That way you can go to them with the problem and the plan, not just the problem.
I’ll keep you updated. You won’t be chasing me for information on this.
Chloe
Hi [Name],
Situation: We’ve confirmed that 12,847 customer accounts (not the initially reported 20,000) were migrated to an incorrect product. Of these, 3,214 have already been billed, representing approximately £847K in exposure.
Likely cause: A mapping error in the Systems Integrator’s product translation table. One legacy product code was mapped to the wrong Kraken product ID, affecting an entire migration cohort.
Immediate actions taken:
Remediation plan: Correct mapping confirmed by your Commercials team → bulk correction validated on 100-account sample → full execution → billing reversal for affected customers. Target: resolved within 5 business days.
I’d like to schedule a 30-minute alignment call with you, the Domain Owner, and the Systems Integrator PM for tomorrow morning. I’ll send an invite shortly.
Chloe Ward
Client Delivery Lead — Commercials
Hi [Name],
We’ve identified a potential product mapping issue affecting ~12,800 customer accounts in the latest migration cohort. I want to investigate this together before drawing any conclusions.
What I need from you:
I’ve paused migrations through this pipeline as a precaution. No blame here — I just want to find the failure point with data so we can fix it with confidence.
Can you get the mapping table to me by end of day? Happy to jump on a call if that’s easier.
Thanks,
Chloe
Dear [Customer Name],
We’re writing to let you know that due to a technical error during a system upgrade, your recent bill may not have been calculated using the correct tariff for your account.
What happened: During a planned system migration, some accounts were temporarily assigned to an incorrect product. This may have affected the charges on your most recent bill.
What we’re doing: We’ve already corrected your account to the right product. If your bill was affected, we will automatically issue a corrected bill within [X] days. If you were overcharged, the difference will be credited to your account. If you were undercharged, we will not be charging you the difference.
What you need to do: Nothing. We’re handling this automatically.
We sincerely apologise for this error and any concern it may have caused.
[United Energy Customer Team]
Status update — UE product mapping incident
TL;DR: Confirmed product mapping error. 12,847 accounts affected (not 20K). 3,214 already billed. £847K exposure. Contained — pipeline paused, plan in place.
Root cause: SI mapping table error — one legacy product code mapped to wrong Kraken product ID. Affected one migration cohort.
Actions:
Client relationship: Managed. Domain Owner is calm. TD hasn’t escalated. We’re ahead of this.
Remediation ETA: 5 business days for full correction. Will update daily in this channel.
"Same facts, five audiences, five tones. Click through each one to see how I'd tailor the communication. The Domain Owner gets empathy and reassurance. The Transformation Director gets a structured briefing with numbers and a plan. The Systems Integrator gets a collaborative investigation request — no blame, just data. Customers get a plain-English apology. And Kraken leadership gets a concise Slack update — contained, plan in place, relationship managed.
Every one of these started as an AI draft. I refined the tone, checked the facts, added the human judgment. That's the workflow: AI gets me to 80%, I close the last 20%."
You've already seen AI throughout this presentation. You didn't notice because it just looked like competent delivery. That's the point.
Built with AI in ~20 minutes. SQL generation, data analysis, and visualisation.
AI-drafted, then refined for tone, regulatory compliance, and relationship management.
AI flagged anomalies across 20,000 accounts in seconds. I made the judgement calls.
AI-assisted throughout. Structure, drafts, data visualisation — all refined by me.
When AI drafts arrive, they arrive informed, not cold. I maintain four context files that I build up over time — so outputs are good enough to refine rather than rewrite.
"I don't talk about AI. I just use it. And you've already seen that throughout this presentation — the dashboard I showed you was built with AI in 20 minutes. The client email started as an AI draft that I refined. The investigation was AI-accelerated. Even this presentation. You didn't notice because it just looked like competent delivery. That's the point.
My system: I maintain four context files — incident log, stakeholder profiles, comms history, decision log. AI drafts arrive informed, not cold. That's why the outputs are good enough to refine rather than rewrite.
Beyond this scenario: scenario modelling for financial exposure before leadership calls, and a living risk register that evolves as the situation does. AI is how I work — not something I talk about."
Appendix
Three-party model — United Energy, Kraken & Systems Integrator roles
→Day-by-day action plan with owners
→Ofgem rules & precedent enforcement actions
→"I'm confident this is resolvable within 3–4 weeks, and that we come out of it with a stronger process and a stronger client relationship. Before we go into the client conversation — is there anything you'd want me to adjust? The appendix has supporting materials if you'd like to dig deeper into any area."
Ownership framing: "The root cause likely sits with the Systems Integrator pipeline, but the lesson is about programme-level validation, not individual blame. All three parties share responsibility for closing the validation gap."
Appendix slide — detailed stakeholder map showing the three-party landscape and key individuals in each organisation. This supports the holistic impact analysis in the main presentation.
Appendix slide — detailed day-by-day remediation timeline with clear owners for each action. Supports the three-phase remediation plan in the main presentation.
| Rule | Impact |
|---|---|
| SLC 21B — Accurate Billing | Suppliers must make "all reasonable efforts" for accurate bills. Breached if customers were billed on wrong tariff. |
| Back-billing Rule (12 months) | If undercharged due to supplier error, can only back-bill 12 months. Significant financial exposure. |
| Standards of Conduct | Must treat customers fairly, be transparent. Proactive comms demonstrates compliance. |
500,000+ customers received late/inaccurate bills after SAP migration. Data mapping errors, inadequate testing.
System migration caused persistent billing problems. Hundreds of thousands affected over a year.
Proactive identification and swift remediation are the strongest mitigating factors. Speed of containment is critical.
Appendix slide — regulatory context showing Ofgem rules and precedent fines from similar migration incidents. Demonstrates industry awareness and understanding of the stakes.