Episode 23 - Operational Resilience, Risk Management and Crisis Decision-Making with Bruce McIndoe

In this episode of RiskMasters, I speak with Bruce McIndoe, founder of iJET and WorldAware, and a global expert in operational resilience, crisis management, and risk management in complex environments.

With decades of experience across intelligence systems, NASA programmes, and Global 2000 advisory, Bruce brings a practical perspective on how operational risk, organisational fragmentation, and leadership decision-making interact under pressure.

This conversation focuses on a critical but often misunderstood reality: operational resilience is not a reporting outcome. It is a capability that determines whether organisations can detect early signals, coordinate effectively, and act before disruption escalates into crisis.

🎯 What You Will Learn

• How operational resilience differs from traditional risk management frameworks

• Why operational risk builds through fragmentation, not isolated failures

• How crisis management fails when coordination breaks down under pressure

• Why early warning signals are often visible but not acted upon

• How human judgement remains critical in interpreting ambiguous risk signals

• Practical ways to strengthen coordination across functions and improve resilience

🕒 Episode Highlights

02:30 — Risk reporting vs operational resilienceWhy risk registers and heat maps create governance clarity but fail to indicate whether the organisation can continue to operate under disruption.

07:15 — How disruption actually emerges in operational risk environmentsWhy crises do not appear as clear, linear events, but develop through fragmented and ambiguous signals across functions.

10:55 — Intelligence fusion and missed early warning signalsHow operational risk signals exist across silos, but are rarely connected early enough to inform decision-making.

14:40 — Crisis management and behavioural breakdownsWhy organisations do not follow plans under pressure and instead fall back on coordination, relationships, and decision habits.

25:15 — Governance structures and operational resilience limitsHow governance frameworks provide oversight but struggle to operate effectively in fast-moving, uncertain conditions.

47:20 — The hardest truth about resilience and risk managementWhy resilience cannot be delegated and depends on real organisational capability, not documentation.

💡 Key Insight

“Resilience cannot be delegated, and it cannot be faked. It shows up in how organisations coordinate and make decisions when conditions change.”

🎧 Listen now on:

• Apple Podcasts: https://podcasts.apple.com/gb/podcast/riskmasters-trailblazing-risk-leadership/id1709495792?i=1000768085382

• Spotify: https://open.spotify.com/episode/4gyunz28GDbw2BMXph1VvD?si=718d971f098d405e

• Other platforms available

👤 About Bruce McIndoe

Bruce McIndoe is the founder of iJET, later WorldAware, and a recognised expert in operational resilience, crisis management, and global risk intelligence.

He has spent decades helping organisations strengthen their approach to operational risk and crisis management by improving early warning capabilities, cross-functional coordination, and decision-making under pressure.

📚 Related Resources

• Psychological Safety in Risk Leadership 

• From Approval to Impact: Repositioning Risk Appetite 

• Strategic Risk Identification as a Capability 

• Strategic Uncertainty Governance 

• Risk Capacity and Operational Decision-Making 

🎓 Download your CPD certificate:

The CPD Group – Accreditation #TBC

---

🧭 RECAP BLOG: Operational Resilience Is Not Built Through Reporting

“Most failures start from information and coordination breakdowns before they become operational or crisis failures.” – Bruce McIndoe

Risk Management Does Not Deliver Operational Resilience

Most organisations invest heavily in risk management frameworks. They build risk registers, dashboards, and governance reporting structures that create visibility and support oversight.

Yet operational resilience is not a reporting outcome. It is the organisation’s ability to continue delivering its objectives when conditions change. That requires capabilities that go beyond traditional risk management and focus on how decisions are made under pressure.

Operational Risk Builds Before Crisis Management Begins

Crisis management is often triggered too late. By the time a situation is formally recognised, the underlying conditions have already been in place for some time.

Operational risk develops earlier through weak signals, fragmented information, and disconnected events across functions. These signals rarely appear as clear warnings. They remain ambiguous and distributed, which makes early interpretation difficult and delays action.

Operational resilience depends on recognising these signals early and acting before escalation occurs.

Organisations Fail Between Functions, Not Within Them

Operational resilience rarely breaks down within a single function. It fails between them, where coordination is required but not fully established.

Weak handoffs, inconsistent data, and unclear ownership create gaps where risk accumulates. Each team may operate effectively in isolation, yet the organisation as a whole struggles to respond coherently when disruption emerges.

This is why resilience is not a functional capability. It is a system-level capability that depends on integration across the organisation.

Crisis Management Depends on Behaviour, Not Plans

Most organisations have well-documented crisis management frameworks. These provide structure and define roles, escalation paths, and response procedures.

Under pressure, however, behaviour diverges from documentation. Teams rely on relationships, trust, and decision-making habits rather than formal plans. Coordination becomes the determining factor.

Organisations do not rise to the quality of their plans. They fall back to the quality of their coordination. This is where operational resilience is truly tested.

Fragmentation Is the Core Constraint on Resilience

Fragmentation remains one of the most significant drivers of operational risk. It exists across organisational structures, data environments, and decision-making processes.

When fragmentation persists, organisations struggle to form a shared understanding of emerging risk. Signals remain isolated, responses are delayed, and crisis management becomes reactive rather than proactive.

Reducing fragmentation requires deliberate effort to improve cross-functional coordination, integrate data, and accelerate decision-making cycles.

AI Supports Risk Management but Cannot Replace Judgement

AI is increasingly embedded in risk management and operational processes, improving data analysis, anomaly detection, and monitoring capabilities.

However, early warning signals in operational risk are often ambiguous and context-dependent. They require interpretation, judgement, and accountability.

AI can support detection. It cannot replace the human capacity to interpret uncertainty and make decisions in complex situations. Operational resilience depends on combining both effectively.

Culture Determines Whether Risk Is Acted Upon

Culture plays a defining role in operational resilience. In many organisations, leadership confidence coexists with frontline hesitation, creating a gap between what is known and what is communicated.

When individuals are uncertain whether raising concerns will be supported, signals remain unspoken. This delays escalation and increases exposure.

In resilient organisations, concerns are raised early, ambiguity is discussed openly, and challenge is encouraged. Culture determines whether risk is surfaced in time to act.

Final Reflection

Operational resilience is often framed as preparedness. In practice, it is a capability built through coordination, judgement, and decision-making under pressure.

It is not defined by what organisations report. It is defined by what they recognise early and act upon before conditions deteriorate.