Severity Reclassification and Unmasked Participant Data at Vantage

Severity is a risk classification, not a presentation choice. A reproducible underpayment of employer contributions affecting 3,100 participants is a high-severity financial and fiduciary issue regardless of how the ticket is labeled. Downgrading it to make the audit committee's view more comfortable is misrepresentation, and removing reproduction steps obstructs remediation.

Actions:

• Do not delete the reproduction steps. Preserve the original ticket history; most platforms retain field-change history, and that history is itself evidence.
• Re-state the severity in writing with the basis: affected population, dollar impact per pay period, reproducibility, and the fact that it is a rounding rule, which suggests a contained fix. Include the cumulative exposure if uncorrected for a quarter.
• Open a separate ticket or comment documenting the reclassification request, who made it, and when. Do not editorialize; record facts.
• Escalate to your engagement partner and to the client's CIO, CFO, or compliance officer, not only to the program director. The program director may not have authority to accept fiduciary risk.
• Provide a remediation path and estimate: correct the rounding rule, backfill affected participants, and add regression tests for mid-period status changes. A contained fix may be achievable before go-live, which changes the decision entirely.
• If the client proceeds to go-live with the defect, require written risk acceptance from an authorized executive, with a named owner, a remediation date, and a participant-remediation plan. Note that under ERISA-style fiduciary obligations, "document in release notes" is unlikely to be an adequate response to understated employer contributions.
• If instructed to remove reproduction steps or falsify severity, decline, state why, and escalate. Concealing a known defect from an audit committee can expose both the client and your firm.

Treat this as an active data-protection incident, not a test-environment inconvenience. Production SSNs and bank account numbers in a test system without masking are exposed to broader access, weaker controls, backups, and vendor support sessions.

Immediate steps:

• Stop using the unmasked data set for new test cycles and restrict access to the environment to the minimum named individuals.
• Determine exposure: who accessed the environment, whether it was copied to laptops or shared, whether it was included in backups or sent to the platform vendor, and how long it has been there.
• Notify your firm's legal and security leadership the same day. The contract lacking a data-handling exhibit does not remove statutory obligations; state breach-notification laws and the client's own policies may apply, and notification deadlines are short.
• Ask the client's security officer and legal counsel to assess notification obligations. Your role is to surface facts and support remediation, not to make the legal call.
• Remediate: purge the unmasked copy, re-provision a masked data set, fix the masking script, add a verification step that fails the refresh if unmasked fields are detected, and document the control.
• Do not accept "after go-live" as a disposition for an active exposure. Masking can be completed in parallel with go-live preparation; the data set can be replaced without delaying the release if scheduled now.

Record all of this in writing, including the date you raised it and the response. If the program director continues to defer, escalate to the client's CIO and legal counsel and to your engagement partner.

Respond calmly and in writing. Acknowledge the pressure, restate that you are trying to protect the client's go-live and its audit position, and separate the two issues because they have different remedies.

On the defect: it is a financial accuracy issue with a known population and dollar impact. Offer the fix, the backfill plan, and a decision deadline. If the client chooses to proceed, the condition is an informed, documented risk acceptance by an executive with authority, plus a remediation plan. That is a commercial decision the client is entitled to make, provided it is informed and recorded accurately.

On the data: this is not a commercial trade-off. Continued processing of unmasked SSNs and bank details without action is a compliance exposure with statutory notification implications. You cannot agree to defer it, and you should say so plainly rather than implying flexibility you do not have.

Escalation path:

1. Engagement partner and your firm's risk or legal function, same day, with a written summary of facts and the client's instructions.
2. Client-side CIO, CFO, compliance officer, and legal counsel, copied to the program director so no one is bypassed.
3. Formal notice under the contract's change-control and escalation clauses if instructions to conceal or defer persist.
4. If the client insists on concealment or continued unlawful data handling, your firm considers suspension of the affected work and, ultimately, withdrawal, with a documented handover.

Keep every communication factual and non-accusatory. The goal is a corrected defect, a remediated data set, and a defensible record, not a confrontation. If you are removed from the engagement, the record should show that you raised both issues promptly and proposed workable remedies.