Risk Intelligence Center

Escalation queue gap: escalations live only in Teams chat; no owned queue; 14-day FLOW R silence is invisible without a scheduled stale-task review

Zero active drivers at school-year start. Full pipeline is live but first activations are still pending; every territory is uncovered if routes are offered now

Pipeline workbook is a single point of failure (single Excel workbook = system of record for the live pipeline)

Column re-tokening across ~90 flow-written columns during Lists cutover. Excel connector keys rows by display name; SharePoint/Lists internal names differ (proven class: DL# → DLx0023). Every item()?['…'] token in every repointed flow — worst case FLOW R's 67-paren filter, which must be re-typed in chunks per SOP-02 (…

CST ongoing obligations unverified (GPS, Medical Card, quarterly MVR, annual background, safety meetings) — blocks renewal-tracker design and correct CC readiness claims

Recruiting funnel thinness/staleness: ~42 leads were already stale at FLOW R enablement; re-engagement capacity is manual; no per-territory sourcing targets

JSON Live Feed is unmonitored and silently truncatable. FLOW 08 - Driver Pipeline Live Feed has List-rows Pagination OFF → hard 256-row cap (75 rows used today; silent truncation as pipeline grows). Flow is absent from the daily gokart-flow-failure-check watchlist, and its SharePoint write uses a second credential ("N…

No ongoing-compliance layer while first routes approach. Expirations (license, insurance, clearances, drug/camera cadences) are not tracked post-activation; school year 2026-27 starts within weeks

FLOW 08 Gates 2–3 never test-driven (broker-split drug test; completion+HandoffLog); flow ON with ≥1 real MI driver mid-vetting

FLOW 11 acceptance auto-detection spec'd but build unconfirmed — contract acceptance likely still manual (GoKart Contract Accepted = Yes)

Single-owner account concentration (tjohnson@ mailbox monitored for acceptance; Automation@ posts; one admin)

Pipeline Health Monitor Office Script #139 exclusions not applied — 3 false positives + A600 + test row in health digest (report-only)

Automate@ consolidation collapses issuer≠executor segregation (DR-107/DR-050). Moving runtime + ownership onto one Automate@ service account means the same identity both issues and executes commands — the audit IssuedBy≠executor control and the "humans decide, only APPROVED enforces" separation weaken. Also two servic…

Single-broker concentration: DE/VA/MD depend entirely on EverDriven, PA/FL on CST — a broker-relationship stall halts whole states

Broker contract currency unknown for SY 2026-27. Only CSTPA on file is 2026-27; CSTDE / CSTFL / CSTMI are 2025-26. If lapsed, FL/MI/DE-CST activation work is moot

driverpipeline.json producer is unattributed. Producer identified: FLOW 08 - Driver Pipeline Live Feed (hourly Recurrence → List rows → Create file; created 07-10, ON, all runs green). Residual exposure moved to R-16