A few months ago, watching a television drama, I noticed something that had nothing to do with healthcare — and everything to do with it.
Two characters are in a life-or-death situation. One sends a clear signal. The other, operating under threat, processes the words but misses the meaning entirely. Not because the message was absent. Because stress had narrowed the receiver’s attention to a point where only the most explicit, unambiguous signals could get through. Everything else — tone, implication, subtext — was filtered out.
It was a minor scene. But it nagged at me, because I had spent the previous year studying how risk warnings travel through governance systems in safety-critical organisations. And the pattern was identical. Anyone who has watched a deteriorating patient being “talked around” rather than escalated will recognise the same cognitive failure.
The Pattern That Follows Me
I have worked in cybersecurity and enterprise architecture across banking, energy, mining, and telecommunications in eight countries. In every sector, in every geography, I have watched the same sequence unfold. A specialist identifies a serious risk. They communicate it through the institutional channels available to them. The message passes through layers of governance. By the time it reaches a decision-maker, its urgency has been polished away.
This is not incompetence. It is architecture. It catches out competent, diligent boards precisely because it was designed to reward balance and composure. Institutional communication is designed for stability, not alarm. Reports are structured for balance. Language defaults to the conditional. The sharper the original concern, the more institutional processing it requires before it is considered appropriate for a board paper.
The result is that the people closest to the risk speak one language, and the people who must act on it hear another. The gap is not random. It is systematic, and it widens precisely when cognitive load on decision-makers is highest — when agendas are full and time is shortest.
What Clinicians Already Know — and Forget
This is where healthcare leadership offers both the clearest illustration and the deepest irony.
Clinicians understand signal degradation intuitively. The entire architecture of clinical communication has been redesigned around it. SBAR exists because someone recognised that in emergencies, unstructured handoffs lose critical information. ABCDE protocols exist because, under pressure, the brain needs an explicit sequence, not inference. The “crash call” exists because when a patient is deteriorating, the system does not rely on diplomatic suggestion — it triggers a response that bypasses normal hierarchies.
These protocols share a single design principle: assume the receiver is cognitively loaded, and design the signal accordingly.
Yet the moment those same clinicians move from the ward to the boardroom, the design principle inverts. Risk papers are written in measured prose. Severity is implied through careful hedging rather than stated directly. The most dangerous items on the agenda often receive the most diplomatic treatment, because institutional culture rewards composure and penalises alarm.
The shift is not cognitive — it is institutional. The people who would never dream of communicating a deteriorating patient through understatement will sit in a board meeting and accept a risk paper that communicates organisational danger in exactly that way. The science of how people process information under load has not changed between the corridor and the committee room. The communication architecture has.
Diplomatic Dilution as a Design Flaw
In my research, I have come to call this pattern diplomatic dilution — the quiet erosion of urgency as information moves through institutional layers. It is not unique to any one sector. I have seen it in Central Asian energy and mining operations, in Kazakhstan banking, in British telecommunications. The specific vocabulary changes; the mechanism does not.
What makes healthcare distinctive is not that the problem exists, but that the solution already exists in the same building. The discipline of structured, explicit, load-aware communication has been refined over decades in clinical practice. It has simply never been applied to governance communication with the same rigour.
Consider what would happen if a board adopted crash call logic for risk escalation. Not as a metaphor, but as an experiment. A defined threshold at which diplomatic framing is explicitly suspended. A format that requires the risk owner to state, in active voice: what is failing, what happens if nothing changes, and what specific action is required by when. A channel separate from routine reporting, so that critical signals cannot be diluted by adjacency to lower-priority items.
None of this is technically difficult. SBAR already does it for clinical handoffs. The question is whether healthcare organisations are willing to apply the same design discipline to their own governance.
A Test You Can Run on Monday
There is a simple way to find out whether this matters in your organisation. Take the last three risk papers presented to the board — on any topic, not just cyber. Remove the cover sheets and agenda context. Hand them to a Non-Executive Director who was not in the meeting, and ask them to rank the items by urgency based solely on the text.
If the ranking does not match what later events revealed to be critical, the communication architecture is doing what it was designed to do: producing calm, balanced, institutionally appropriate documents. It is also doing what it was not designed to do: making it systematically difficult for an overloaded decision-maker to distinguish between a routine concern and an approaching crisis.
Healthcare solved this problem for patients decades ago. It is past time to solve it for organisations.
Author
Vsevolod Shabad
Vsevolod is a Fellow of the BCS and a researcher affiliated with the University of Liverpool. He specialises in the behavioural dynamics of security governance and decision-making under uncertainty in safety-critical sectors.
Declaration of Interests
The author declares no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Personal Capacity
The views expressed are those of the author in a personal capacity and do not represent the positions of any organisations.
Generative AI and AI-Assisted Technologies in the Writing Process
During the preparation of this work, the author used Claude (Anthropic) to improve readability and language quality as a non-native English speaker. After using this tool, the author reviewed and edited the content as needed and takes full responsibility for the publication’s content.