The Hidden Resilience Risk Between Departments

Executive opening

In a serious incident, an organisation rarely fails because every department is incapable. More often, the failure occurs between capable departments.

Cyber security sees a technical signal, but legal lacks the operational impact. Operations has a recovery option, but waits for authority. Communications prepares a holding statement while executives debate materiality. Risk sees the pattern, but its assessment does not reach the next decision-maker.

This is the hidden resilience risk between departments: information exists, but does not become shared understanding and action.

For leaders, the question is whether the organisation can move intelligence across boundaries, make sense of uncertainty, exercise decision rights and coordinate action without losing trust.

Longitudinal tabletop analytics turn repeated exercises into evidence about authority, trust, handoffs, communication, adaptation and recovery. An Organisational Exercise Intelligence (OEX) framework and Organisational Confidence Index (OCI) can support that evidence, but they are not the point: understanding how the organisation works under pressure is.

Intelligence flow is more than information sharing

“More communication” sounds like a sensible answer to organisational silos. It is not always the answer.

Research on information sharing in a large networked military exercise found that increased email output was associated with lower individual situation awareness for some participants. The network was also imbalanced: a small number of people became highly connected while many had few connections. The researchers cautioned that information volume can overwhelm the people expected to turn data into decisions.¹

Resilience does not depend on every person receiving every message. It depends on the right information reaching the right decision-maker, with enough context, at the right time, through a trusted route.

In this article, intelligence flow means the movement and interpretation of relevant signals across the organisation. It includes:

• Detection: who notices a meaningful signal?
• Interpretation: who establishes what the signal may mean?
• Validation: who tests the information, assumptions and alternatives?
• Escalation: who knows when and how to raise it?
• Authority: who can decide, and within what tolerance?
• Coordination: which departments must act together?
• Feedback: how does the organisation know whether the action worked?

This is closely related to shared situational awareness: a common enough understanding of what is happening, what it means and what may happen next. It does not require identical views; healthy challenge can improve a decision. It does require people who must coordinate to understand the critical facts, uncertainties, dependencies and decision points.

Why departmental silos become a resilience risk

Departments build expertise, accountability and control. The problem starts when organisational boundaries are treated as if the threat will respect them.

A ransomware event may begin as a cyber matter, become an operational outage, create privacy and regulatory questions, affect customers and employees, and become a reputational issue within hours. A supply-chain disruption, safety incident or disinformation campaign can create the same cascade.

The handoff between functions is therefore part of the control environment. A handoff can fail when:

1. The trigger is unclear. People disagree about what threshold requires escalation.
2. The receiving function lacks context. A technical alert is passed on without business impact, confidence level or time horizon.
3. Decision rights are ambiguous. Several leaders believe another person has authority.
4. Information is trapped in a familiar network. Teams communicate within their own discipline but not across it.
5. Activity is mistaken for progress. A full meeting or long situation report is treated as evidence of coordination, while feedback is missing.

These are system conditions, not evidence that an individual is careless. A mature review asks what the structure, incentives, tools and leadership signals made easy or difficult.

What a tabletop exercise can reveal

A tabletop exercise creates a controlled environment in which leaders can observe coordination before a real incident makes the cost of delay unavoidable. It cannot perfectly predict reality, but a well-designed scenario makes assumptions, dependencies and decision pathways visible.

The Australian Institute for Disaster Resilience describes exercise evaluation and lessons management as important parts of exercise practice. The discipline is to convert observations into corrective actions and then follow up, rather than treating the after-action report as the end of the process.²

During an exercise, observers can record evidence such as:

• how long it takes a signal to reach the crisis management team;
• whether cyber, legal, operations, communications and risk form a shared picture;
• which facts are repeatedly requested because they are not available;
• whether a concern is challenged, dismissed or escalated;
• where approval is sought unnecessarily or a decision is delayed;
• how often a decision is reversed as new information arrives;
• whether actions account for dependencies outside the room; and
• whether external providers, regulators, customers or partners are included at the right point.

The most useful evidence is not a league table of people. It is a pattern across scenarios and runs. If the same legal-to-operations handoff stalls in different exercises, that may indicate a process or authority problem. If the delay reduces after a decision-rights change, that is evidence of improvement in the exercise context, not proof of a future incident outcome.

From a point-in-time exercise to a learning system

A traditional tabletop often produces a valuable but static artefact: an after-action report listing observations and recommendations. Longitudinal analytics add a second layer. They allow leaders to ask whether a finding was addressed, whether the relevant capability was retested and whether the organisation is learning in a consistent direction.

The distinction matters:

The point-in-time question is whether the team completed the exercise, identified an issue, made a decision, shared information and had a plan. The longitudinal questions are whether the organisation is improving across comparable runs, assigning and retesting issues, clarifying decision rights, reducing information overload and adapting when a scenario departs from the plan.

An analytics dashboard can support this view through run history, maturity trends, dimension deep-dives and improvement questions for the next run. Relevant dimensions may include governance, technical readiness, timeliness, communications, legal readiness and regulatory awareness. OEX-style evidence can organise questions around robustness, exposure, blind spots, trust, adaptability and recovery. OCI-style evidence can express how much confidence is demonstrated by the available evidence.

Keep the claim proportionate. A score is a signal for inquiry, not a substitute for judgement. “Insufficient evidence” is useful when the organisation has not captured enough after-action dimensions. A high score in one exercise is not a guarantee; trend direction, recurring observations, corrective-action closure and qualitative context matter more.

Australian context: resilience must be demonstrated

Australian operational resilience is increasingly linked to accountability and evidence. For APRA-regulated entities, CPS 230 requires operational-risk management, continuity arrangements and critical operations within tolerance during severe disruption. It also assigns responsibilities to boards and senior management for tolerance levels, continuity and service providers.³

The obligation does not mean that a single tabletop proves resilience. Important capabilities need to be understood, tested and supported by credible evidence.

The Australian Government Crisis Management Framework also emphasises coordination mechanisms that bring relevant stakeholders together and align decisions with expert advice.⁴ For a board, this makes intelligence flow a governance question:

• Can the organisation identify a material signal?
• Can it assemble the right expertise without avoidable delay?
• Do leaders know who may decide and who must be consulted?
• Can the organisation explain the basis for a decision?
• Can it maintain a coherent message while the facts change?

How exercise analytics change the conversation

Exercise analytics change the conversation when they move it from “Who performed well?” to “What does our system make likely?”

That change has four effects.

1. From attendance to authority

Instead of reporting that executives attended, ask whether the right person could authorise action at the relevant threshold. Were delegations understood? Did participants escalate because policy required it, because they trusted the route, or because nobody felt safe to decide?

2. From message volume to usable intelligence

Instead of counting updates, examine whether a critical signal was interpreted and acted on. More information can create overload rather than awareness.¹ Look for concise decision briefs, clear confidence levels, dissenting views and explicit next actions.

3. From silo blame to interface design

Instead of asking which function “failed”, examine the interface: the handoff, trigger, shared vocabulary, access, approval rule or missing relationship. This creates a constructive route to improvement and avoids punitive individual scoring.

4. From recommendations to adaptation

Instead of closing an after-action report, retest the changed behaviour. Did the new escalation threshold help? Did legal receive the operational facts earlier? Did communications know which claims were verified? Did recovery planning include the dependencies identified in the previous run?

Practical actions for boards and executives

Make cross-functional interfaces explicit

Select a few high-consequence handoffs: cyber to legal, operations to communications, or risk to executive leadership. Define the trigger, information standard, decision owner, fallback route and feedback loop for each.

Design exercises around decisions, not departments

Build scenario injects that require functions to work together. Test ambiguity, competing priorities, incomplete information and external dependencies. Do not let a confident plan hide absent authority or shared understanding.

Capture information quality

Ask observers whether information was actionable, its source known, uncertainty stated, business consequence understood and arrival early enough to change the decision.

Review patterns over time

Use comparable scenarios where possible, recording changes in participants, threat assumptions and organisational structure. Review recurring gaps, trend direction, actions and evidence coverage. Treat context as part of the finding.

Protect trust in the measurement process

Explain what is being observed and why. Aggregate findings where possible. Do not infer trauma, mental-health status or personal vulnerability from exercise behaviour. A learning system needs candour; punitive scores teach people to manage appearances.

Conclusion

Organisational resilience is not only a property of departments. It is a property of the relationships, decisions and information pathways between them.

The organisation that can detect a signal but cannot interpret it together is exposed. So is the organisation that cannot decide, coordinate implementation or learn afterwards.

Longitudinal tabletop analytics help leaders see those transitions. They make authority, trust, intelligence flow, adaptation and recovery available for disciplined discussion across time. OEX and OCI can support that discussion as evidence frameworks, provided leaders treat them as decision-support signals rather than proof of future performance.

The advantage is not a more impressive dashboard. It is a leadership team that knows where understanding breaks down, which decisions are stuck and what must change.

A leadership question

When the next critical signal crosses from cyber to legal, operations, communications and the executive team, what evidence will show that your organisation can turn it into shared understanding and timely action?

Key takeaways

• Intelligence flow is the movement of signals into shared understanding and action, not simply the volume of communication.
• The most consequential resilience risks often sit at departmental handoffs.
• Tabletop exercises can reveal unclear triggers, decision rights, dependencies, overload and missing feedback loops.
• Longitudinal analytics help distinguish a recurring system pattern from a one-off observation.
• OEX and OCI should support evidence-based inquiry, not replace leadership judgement or become punitive individual scorecards.
• Improvement is stronger when findings are assigned, addressed and retested.

Frequently asked questions

What is intelligence flow in organisational resilience?

Intelligence flow is how relevant signals move across an organisation, become understood in context, reach decision-makers and return as coordinated action and feedback. It includes detection, interpretation, validation, escalation, authority and recovery learning.

How can a tabletop exercise identify information silos?

Observers can trace where a signal originated, who received it, what context was lost, which functions were omitted, and where decisions stalled. Repeated exercises can show whether the same handoffs or dependencies remain unresolved.

Does more communication create better crisis awareness?

Not necessarily. Research from a large networked exercise found that higher message output could be associated with lower individual situation awareness. Leaders should prioritise relevant, contextual and actionable information over message volume.¹

Can OEX or OCI prove that an organisation will perform well in a real crisis?

No. They can organise evidence from exercises and show trends, gaps and evidence coverage. Exercise results are observations in a simulated setting, not causal proof of future incident performance. Leaders should combine them with operational, qualitative and assurance evidence.

Suggested internal links

• Why a tabletop exercise is only the beginning
• Psychological safety as an organisational resilience capability
• Threat-informed leadership for volatile conditions
• Building organisational resilience in the AI era

References

1. Buchler, N., Fitzhugh, S. M., Marusich, L. R., Ungvarsky, D. M., Lebiere, C. and Gonzalez, C. (2016). [Mission Command in the Age of Network-Enabled Operations: Social Network Analysis of Information Sharing and Situation Awareness](https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2016.00937/full). *Frontiers in Psychology*, 7.

2. Australian Institute for Disaster Resilience (2012). [Australian Disaster Resilience Handbook 3: Managing Exercises](https://knowledge.aidr.org.au/media/3547/handbook-3-managing-exercises.pdf), second edition.

3. Australian Prudential Regulation Authority (2023). [Prudential Standard CPS 230: Operational Risk Management](https://www.apra.gov.au/sites/default/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf).

4. Australian Government, Department of the Prime Minister and Cabinet (current). [Australian Government Crisis Management Framework: Decision-making and coordination mechanisms](https://www.pmc.gov.au/resources/australian-government-crisis-management-framework-agcmf/crisis-coordination/decision-making-and-coordination-mechanisms).

5. Rotstein, N. (2007). [Designing, conducting, and evaluating tabletop exercises](https://www.cidrap.umn.edu/business-preparedness/designing-conducting-and-evaluating-tabletop-exercises-primer-optimizing), Center for Infectious Disease Research and Policy, University of Minnesota.

6. Ayoko, O. B. (2021). [Resiliency and Leadership in Organizations](https://www.cambridge.org/core/journals/journal-of-management-and-organization/article/resiliency-and-leadership-in-organizations/F9CCC19A17F41442ACA913FADAB9A41B). *Journal of Management & Organization*, 27(3), 417–421.