Shadow Routes and Real Risks: Auditing the Escalation Paths Your Operating Model Does Not Show

Most service operating models describe a tidy route: log the issue, triage, assign, escalate by exception, resolve. In practice, a parallel network often carries the work. A team leader rings a counterpart in another department. A supplier account manager receives a direct message. A long-standing subject expert becomes the de facto approval point for a process they do not own. These routes are not necessarily dysfunctional. They can be fast, pragmatic and relationship-based. The governance problem arises when they are invisible, unmeasured and unmanaged, because the formal model then describes an organisation that does not exist.

Why shadow escalation belongs in the risk register

Informal escalation is a control gap before it is an efficiency problem. It bypasses documented decision rights, weakens the audit trail and makes capacity planning unreliable. It also distorts supplier management: a direct call to a supplier contact may solve today's issue while obscuring the contractual route, response-time obligation and volume of work being absorbed outside the agreement. In regulated or high-dependency services, the same pattern can create single points of failure around one experienced individual and make operational resilience claims harder to substantiate.

The right question is not whether informal routes exist. They almost always do. The question is which ones carry material risk, which ones meet a legitimate need that the formal model fails to serve, and which ones simply perpetuate workarounds.

A four-week audit sequence

A shadow escalation audit should be proportionate. Four weeks is usually enough to produce a defensible map in a mid-sized service operation, provided the work is scoped to a service line or customer journey rather than the whole organisation.

1. Collect artefacts. Pull service desk reassignment logs, call recordings or notes, chat channel exports, meeting invitations, email forwards and incident review actions. Look for phrases such as 'spoke to', 'raised directly with', 'agreed offline' and 'known issue with'. These are markers of routes that may not appear in the workflow.

2. Interview for stories, not opinions. Ask managers and front-line staff to describe the last three occasions when the formal path did not work. Capture the trigger, the person contacted, the channel used, the response received and the outcome. Avoid asking people to list escalation routes in the abstract; they will describe the model they think should exist.

3. Map nodes and edges. For each route, record the role rather than the individual, the trigger condition, the channel, the typical response time, the authority being exercised and any workaround created. A simple spreadsheet is sufficient. The value lies in the discipline of making the route explicit.

4. Validate with case samples. Select ten to twenty recent cases and trace them end to end. Compare the documented route with what actually happened. Note where the formal path was attempted and failed, where it was skipped entirely and where an informal route became the effective decision point.

5. Quantify without false precision. For the sample, record time to first effective action, number of handoffs, rework hours and whether the formal route was attempted first. A bypass rate is often more useful than a speculative annual cost: the proportion of cases where the first effective action came through an informal route. Combine this with median delay and rework estimates to build a range, not a single figure.

From map to decision

The output of the audit should be a decision for each material route, not a longer list of exceptions. Three categories are usually enough.

Formalise where the route is frequent, legitimate and material. This may mean adding a named escalation path to the service model, defining the decision rights attached to it, adjusting the service desk taxonomy and including the route in capacity forecasts.

Contain where the route is rare but high impact. A named exception process, time-bound approval and post-event review may be more appropriate than embedding it in business-as-usual guidance. The risk is accepted consciously, with an owner and a review date.

Retire or repair where the route exists because the formal path is broken or because nobody has challenged it. Some shadow routes disappear once a queue is fixed, an approval threshold is changed or a supplier contact is replaced by a properly managed channel. Others persist because they give certain teams informal power; those need explicit governance attention.

Keeping the map honest

A shadow escalation map ages quickly. Review it quarterly and after any significant organisational, supplier or technology change. Link material routes to the risk register and to incident review actions, so that repeated informal escalation becomes evidence of a design problem rather than a background nuisance. Add a standing question to service reviews: where did the work actually go this month, and does that match the model?

The aim is not to eliminate every informal conversation. Judgement and relationships remain part of service delivery. The aim is to ensure that the routes carrying material risk are visible, owned and tested, and that the formal operating model earns enough trust to be used.