By Ann Marie van den Hurk, Mind The Gap Advisory
Every organization has two org charts.
The one on paper. And the one that actually runs things.
Most executives believe they are the same document. They are not. And the gap between them is not theoretical — it shows up in every crisis, every regulatory examination, and every moment when the official structure is tested against the way the organization actually behaves.
How the unofficial map gets built
No one decides to create a shadow authority structure. It builds itself.
Someone is good at their job. Reliable. Responsive. When a question comes in they answer it. When a decision needs to be made they make it. When things are unclear they provide clarity.
Over time people learn this. They route to that person — regardless of title, regardless of what the org chart says, regardless of what the authority matrix documents.
And slowly, quietly, without a single meeting or memo, decision authority migrates.
It does not show up in a report. It accumulates in the daily habits of the organization — in who people call, who they copy on emails, whose approval they seek before moving forward.
And by the time it becomes visible, it is usually because something went wrong.
When the two maps diverge under pressure
In early 2025, a group of senior government officials coordinating a sensitive national security operation used an informal communication channel instead of the approved one. A journalist ended up in the chat.
The official protocols existed. The approved systems existed. The training existed. But the way those officials actually operated diverged from the way they were supposed to operate.
That incident was framed as a technology story. It was a governance story.
In a crisis, people default to the unofficial map. They route to who they always route to. They use what is fastest and most familiar. The official structure does not get consulted — it gets bypassed.
This is not unique to government. It happens inside every organization that has never honestly compared its official authority map to its actual one. The channel they use may not be approved. The person they call may not have the authority to make the call that actually needs to be made. Not legally. Not operationally. Not from a regulatory standpoint.
The two maps diverged and no one caught it until the consequences were public.
Most organizations are carrying the same gap. They just have not found out yet.
What the unofficial decision maker actually costs
The unofficial decision maker did not ask for the role. They filled a vacuum that governance should have filled first.
But good intentions do not create documented authority. And under regulatory scrutiny, undocumented authority is not authority at all.
For organizations under CMMC scrutiny this has real consequences. Assessors will ask who approved what and when. They will compare the documented authority structure to what actually happened. If the unofficial decision maker has been operating outside their documented role — even with everyone’s tacit approval — that is a finding. A significant one.
The wrong person making the right call with no documented authority is still a governance failure. In the first 20 minutes of a serious incident, the org chart on paper is the only one that counts.
How to close the gap between the two maps
The fix is not to punish the unofficial decision maker. They were doing what the organization needed.
The fix is to close the gap between the two maps. To look honestly at where authority actually lives and ask whether that matches where it is supposed to live — and where it needs to live when pressure arrives.
That requires asking questions most organizations have never formally asked. Who do people actually call when something goes wrong? Whose approval do they actually seek before moving forward? Where does the official structure get bypassed — not out of bad intention, but out of habit?
The answers to those questions are the actual authority map. And the distance between those answers and the documented governance structure is the governance gap.
Most organizations are carrying the gap between their two maps. They just have not found out yet. The question is whether they find out on their own terms or under pressure.
If your official authority map and your actual one are not the same document
Governance Gap Map
A 90-minute structured session that surfaces where governance drift has created decision authority gaps — and what that exposure looks like before a mandate, deadline, or incident forces it into view. Written finding delivered within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations across New England, nationally, and globally. mindthegapcyber.com