Some of an organization’s most important technology may never appear on an IT architecture diagram.

A finance manager maintains a spreadsheet used for a monthly forecast. An operations employee builds a small database to track production issues. A sales team creates an unofficial workflow because the CRM system does not accommodate a particular process. Another department relies on a cloud application purchased independently several years ago.

These tools frequently begin as practical responses to legitimate business needs.

Problems arise when an informal solution gradually becomes essential to ordinary operations without acquiring the controls, documentation, support, and ownership expected of a business-critical system.

For CIOs, shadow systems deserve attention because their importance can be considerably greater than their visibility.

Understand Why Employees Build Their Own Solutions

Shadow technology is frequently described as a governance failure, but that explanation is incomplete.

Employees generally create workarounds because they are trying to accomplish something.

The official application may lack necessary functionality. IT development queues may be lengthy. A process may change faster than enterprise systems can accommodate. Employees may also find a spreadsheet easier to modify than submitting a formal technology request.

CIOs should understand these causes before attempting to eliminate unofficial tools.

Simply prohibiting them can drive activity further from view without resolving the business requirement that produced them.

Find the Systems the Business Cannot Operate Without

Not every employee spreadsheet represents a material technology risk.

The priority should be identifying informal tools upon which important processes depend.

CIOs can ask business leaders which files, databases, scripts, small applications, and departmental platforms would create substantial difficulty if they became unavailable tomorrow.

The answers can be surprising.

A spreadsheet maintained by one employee may determine production schedules for an entire facility. A small database may contain years of customer information. A script written by a former employee may move important data between two enterprise applications every night.

Once a tool becomes operationally important, it deserves an appropriate level of oversight.

Look for Key-Person Dependency

Shadow systems often depend heavily upon their creators.

The employee who built a complicated spreadsheet understands its formulas, macros, data sources, exceptions, and unusual behavior. Another employee may know how to use the output without understanding how it is produced.

If the original creator leaves, the organization can inherit a system nobody fully understands.

CIOs and business leaders should identify important tools with concentrated knowledge and document how they operate.

For particularly important processes, another qualified employee should be able to run and troubleshoot the tool.

Examine Access and Data Protection

Informal systems can contain sensitive information without the protections applied to enterprise applications.

Files may be stored locally, shared through email, copied onto personal devices, or placed in folders with broad permissions.

Small departmental applications may use shared passwords or provide limited logging.

The security requirements should correspond with the information and business process involved.

A simple spreadsheet used for an internal meeting schedule does not require the same controls as a workbook containing payroll information or customer records.

Risk-based governance allows IT to concentrate attention where the consequences are greatest.

Pay Attention to Spreadsheet Logic

Spreadsheets can perform remarkably sophisticated work, which is precisely why some become difficult to govern.

Important workbooks may contain thousands of formulas, external links, macros, hidden worksheets, manual adjustments, and assumptions accumulated over many years.

An incorrect formula can produce a plausible result and remain unnoticed for months.

Critical spreadsheets should have documented owners, inputs, outputs, assumptions, review procedures, and change controls appropriate to their importance.

The organization should also understand which other reports or decisions depend upon them.

Do Not Assume Every Shadow System Should Be Replaced

Discovering an unofficial tool does not automatically justify a large technology project.

Some departmental solutions work reasonably well and present limited risk.

The appropriate response may be to document the tool, improve access controls, establish backups, assign ownership, and introduce periodic review.

Other systems may have become too important or complicated to remain informal.

CIOs should consider business criticality, data sensitivity, number of users, complexity, regulatory requirements, availability requirements, and the consequences of an error when deciding whether replacement is necessary.

Create a Practical Path Into IT Governance

Business departments may hesitate to disclose unofficial technology if they believe IT will immediately shut it down.

CIOs can encourage greater visibility by providing a practical review process.

Employees should have a way to identify business-critical tools, request assistance, improve security, and determine whether a more formal solution is warranted.

This approach turns discovery into a collaborative process.

It also gives IT useful information about where enterprise applications are failing to meet business needs.

A proliferation of workarounds around the same system may indicate that the official platform itself requires improvement.

Include Shadow Systems in Continuity Planning

Business continuity plans usually concentrate on recognized enterprise applications.

Critical departmental tools should be included as well.

Organizations should know how important files are backed up, how quickly they can be restored, what dependencies they have, and who can operate them when their usual owner is unavailable.

A small system can create a large interruption if an important business process cannot continue without it.

Visibility Is the First Control

CIOs do not need to centralize every spreadsheet, database, script, and departmental application.

They do need visibility into the informal systems upon which important business activities depend.

Once those tools are known, management can make proportionate decisions about documentation, security, backup, ownership, support, and eventual replacement.

Shadow systems become particularly risky when an organization depends upon them without realizing that it does. Bringing important tools into ordinary technology governance can reduce that exposure while preserving the flexibility that led employees to create them in the first place.