The Root Cause and Primary Enabler of the Dreaded Shadow IT

Shadow IT₁ has long been a thorn in the side of organizations, creating inefficiencies, security risks, and management challenges. At its core, the root cause of Shadow IT lies in the pervasive and outdated mindset among executives that view IT as a cost center rather than a strategic asset. This mindset, coupled with the undue purchasing power granted to leaders outside of the IT department, creates a fertile ground for the growth of Shadow IT.

In many organizations, the decision-making power regarding technology purchases and implementations has been decentralized. Leaders from various departments, often lacking a comprehensive understanding of the organization's IT infrastructure and strategic goals, are empowered to make independent decisions. This decentralization leads to the procurement of disparate, unapproved technology solutions that do not align with the broader IT strategy. The tolerance for and sometimes favoritism towards these non-IT leaders in making significant technology decisions bypasses the IT department's oversight, undermining its role and strategic importance.

Executives, viewing IT as merely a cost center, fail to recognize the strategic value that a well-integrated IT department can bring to the organization. This laggard mindset is a significant contributor to the emergence of Shadow IT. When IT is perceived solely as a source of expenses rather than a critical driver of innovation and efficiency, it is sidelined in strategic discussions. This marginalization leads to inadequate investment in IT capabilities and resources, pushing other departments to seek out their own solutions to meet their needs, thus fostering the growth of Shadow IT.

Perhaps another driver in the proliferation of Shadow IT is inexperienced and politically compromised IT managers emitting a culture of 'NO', in other words they typically lack the experience and intestinal fortitude to take on technical challenges and therefore immediately strike down enhancements and become an obstacle instead of being a steward of innovation. These such leaders typically were promoted for reasons other than their technical achievements and thus have resorted to only supporting initiatives they can get credit for or represent quick wins with minimal risk of failure.

The primary enabler of Shadow IT, however, is the advent of tools like Microsoft's Power Platform. These tools are designed to empower so-called citizen developers—employees without formal IT training—to create and deploy applications. While these platforms democratize application development and can lead to rapid delivery, they also pave the way for reckless development practices. Citizen developers, without the necessary governance and oversight, often build applications that lack the robustness, security, and scalability required for enterprise use.

When these hastily developed applications inevitably fail, the responsibility unfairly falls back on the IT department. IT is then tasked with the challenge of troubleshooting, securing, and integrating these rogue applications into the broader organizational infrastructure. This reactive approach not only strains IT resources but also perpetuates the cycle of Shadow IT by implicitly endorsing the initial bypassing of IT oversight.

Challenges of Low-Code/No-Code Tools in Highly Regulated Environments

Low-code and no-code tools like Microsoft's Power Platform face significant challenges, particularly in highly regulated environments such as publicly traded organizations that must adhere to stringent Sarbanes-Oxley (SOX) controls. These organizations are required to maintain highly visible and transparent transactions, often necessitating multiple levels of sign-off before changes are applied to production systems. This rigorous process ensures accountability and integrity of financial and operational data.

Citizen developers, however, are typically not well-versed in these compliance requirements. They often lack the awareness and training needed to implement controls that meet SOX standards, leading to a "rules for thee, but not for me" situation. While IT professionals are subjected to strict governance and are entrusted with access to sensitive data under tight regulatory scrutiny, citizen developers are often free to create and deploy solutions without the same level of oversight. This discrepancy raises significant concerns about the integrity of transactions from an auditor's perspective.

Even Microsoft and their touting of their Power Platform has no comprehensive solution to address these regulatory challenges fully. The fundamental issue is the potential for unauthorized or improperly governed changes that can compromise data integrity and compliance. IT departments, which are held to high standards of accountability and transparency, are well-equipped to manage these constraints. However, when similar governance is not enforced on citizen developers, the organization risks creating vulnerabilities that can lead to regulatory non-compliance and audit failures.

It is common sense that members of IT, who are typically trusted with access to highly private and sensitive data, operate under strict governance frameworks. These frameworks ensure that all transactions are subject to rigorous checks and balances, maintaining the organization's compliance with regulatory requirements. In contrast, allowing those outside of IT to develop and deploy solutions without equivalent oversight undermines these safeguards. It introduces a significant risk of inconsistent and potentially non-compliant transactions, which can have severe repercussions for the organization.

To address the root cause and mitigate the primary enablers of Shadow IT, organizations must shift their perception of IT from a cost center to a strategic asset. This shift requires executive leadership to recognize the value that a well-funded and strategically integrated IT department can bring to the organization. By centralizing technology purchasing decisions and ensuring that IT has a seat at the strategic table, organizations can prevent the unchecked proliferation of Shadow IT.

Addressing the regulatory challenges posed by low-code/no-code tools requires a concerted effort to apply consistent governance standards across all development activities within the organization. By doing so, organizations can maintain compliance, ensure data integrity, and fully leverage the strategic potential of their IT departments, ultimately curbing the rise of Shadow IT and fostering a more secure and efficient technological environment.

Preventing Shadow IT with a Mature Project Intake Justification Framework

Preventing Shadow IT from taking root requires a mature project intake justification framework. This framework mandates that customers seeking IT solutions undergo a thorough vetting process that ensures proposed changes align with strategic goals and deliver tangible benefits. The process involves asking a series of critical questions and demanding evidence-based responses:

• Does this change increase the likelihood of an increase in revenue?
• Does this change present the likelihood of decreased costs?
• Will the customization lead to cost savings in operational processes or resource utilization?
• Does the customization help the organization comply with specific industry regulations or legal requirements?
• Will the customization enhance workplace safety and/or reduce potential risks to employees?
• Will the customization differentiate the organization from competitors in the market?
• How does the customization support the company's vision and strategic direction?
• Have we thoroughly researched existing ERP modules or third-party solutions that may fulfill our requirements?
• Can we see tangible, undisputed financial benefits over time associated with this change compared to the initial investment?
• Are there multiple users that will see an enhanced user experience from making this change?
• How complex or invasive of a customization is this change in terms of not being susceptible to a conflict in a future mandatory upgrade?

By requiring answers to these questions, organizations can ensure that proposed changes are justified and aligned with strategic goals. The responses to these questions can be ranked using a weighted average formula, assigning different weights to each question based on its importance to the organization's objectives. This ranking system allows IT to prioritize projects that offer the most significant benefits and align closely with the organization's strategic direction.

For example, a proposed change that significantly increases revenue and helps the organization comply with regulatory requirements would score higher than a change that offers minimal cost savings and no strategic alignment. By using this weighted average approach, organizations can objectively evaluate the value and impact of proposed changes.

Implementing this mature project intake justification framework helps solve the problem of Shadow IT by ensuring that all requests are ranked accordingly and transparently. Users within the organization will have their voices heard, knowing that their solutions and needs are considered and prioritized based on a clear, objective framework. This process not only curbs the proliferation of Shadow IT but also fosters a culture of collaboration and strategic alignment, ultimately leading to more effective and efficient IT governance.

Addressing the root cause and mitigating the primary enablers of Shadow IT requires a shift in how IT is perceived and integrated into organizational strategy. By enforcing a robust project intake justification framework, organizations can ensure that all technology decisions are made strategically, with full oversight and alignment with broader goals. This approach not only prevents Shadow IT but also leverages the full potential of IT as a strategic asset, driving innovation and efficiency across the organization.

1. Shadow IT: refers to the use of information technology systems, devices, software, applications, and services without explicit organizational approval. These unauthorized solutions are typically implemented by rogue "know-it-all" and anarchist employees or departments outside the IT department, often to meet immediate needs or enhance productivity, thereby introducing security risks, compliance issues, and integration challenges.