What is the difference between the formal and the informal organization?

The formal organization is the official structure on paper (org chart, reporting lines); the informal organization is the actual web of relationships and influence between people.

• Formal organization — deliberately designed: documented hierarchy, defined roles, official communication channels. This is what the org chart shows.
• Informal organization — emerges naturally: friendships, alliances, trusted go-to people, grapevine communication. Invisible on the chart, but often where decisions are really prepared.

Why a security manager must know both: policies travel through formal channels, but acceptance travels through informal ones. A CISO who wins over respected informal opinion leaders gets awareness measures adopted far faster than one who only sends official memos. Conversely, the informal organization is also where shadow IT and policy workarounds spread.

Tip: Classic illustration — a mafia-style chart (Boss → Underboss → Lieutenants) vs. the tangled real network of who actually talks to whom. The second picture is the one social engineers exploit.

Go deeper:

• Informal organization (Wikipedia) — how the emergent web of relationships contrasts with the formal chart.