Resistant departments build and run their own unapproved tools and systems to work around central controls, keeping their autonomy while appearing to use the approved stack.
An example
Nine software subscriptions charged to the merchandising team turned up on corporate card statements at a specialty apparel retailer, a year after every team had moved onto a central planning platform. The chief information officer found them while preparing for a security audit. The largest was a forecasting tool at $3,800 a month. Merchandising's weekly buy plans, submitted through the approved platform, matched the tool's outputs to the decimal. The team had been building forecasts in its own system and pasting summaries into the official one, which kept its methods and its customer data outside central review. The merchandising vice president said the approved platform took six weeks to change a model and the season did not wait. The tool also held two years of customer purchase data with no access controls. The chief information officer had a policy and no way of seeing what ran on the team's laptops.
Why it works
Going around the official path strips away its approval lead times, security reviews, mandated vendors, and the cost of justifying needs upward, which makes the unit's preferred way easy. The official path becomes costlier by comparison, paid in stalled deadlines and the indignity of asking permission for tools the team considers basic. Technically capable units, software cheap enough to buy on a card, weak network and device monitoring, and an organization that measures results without auditing means all feed it. The gap between the governance the center imposes and the enforcement it can actually run sets how much shadow IT appears.
The thinking behind it
Ronald H. Coase Ronald Coase's The Nature of the Firm (1937) argues that firms exist because directing activity by authority is sometimes cheaper than using the market, and that the boundary falls where the two costs meet. Shadow IT is that calculation made by a department: when the official path costs six weeks and a security review, a corporate card and an outside tool are cheaper. Shortening the official path for routine changes moves the boundary back.
Jeffrey Pfeffer The External Control of Organizations: A Resource Dependence Perspective (1978), by Pfeffer and Salancik, describes how organizations act to reduce their dependence on others who control resources they need. A unit that depends on central IT for every model change has a reason to remove that dependence, and a parallel tool does it. Enforcement alone leaves the dependence in place, which is why the center also has to become a supplier the unit can live with.
Warning signs
Unit deliverables reference tools that are absent from the approved stack and the asset register. Small software subscriptions show up on corporate cards. Data submitted through the official system arrives as polished summaries with no working detail behind it. The unit rarely files change requests with central IT, though its needs change every season.
How to defend yourself
Pair IT's mandate with real monitoring of networks and devices, and have finance enforce purchase controls on cards and expense reports. Then decide case by case whether to shut a parallel tool down or bring it into governance; some exist because the official path is too slow, and fixing that removes the reason. Where a tool holds sensitive data, move first and negotiate second, since a security incident will bring investigators regardless. Talk to the unit's leader about what the approved stack fails to do, and set a date by which the parallel system is either approved or retired.
How a leader shuts it down
Fund enforcement in proportion to the governance you impose, because policy without monitoring produces shadow systems. Shorten the official path for routine changes so units have less to gain by going around it. Offer an amnesty-and-review route for existing tools before cracking down.