A Multiple Case Study on the Nature and Management of Shadow Information Technology

Abstract

In several organizations, business workgroups autonomously implement information technology (IT) outside the purview of the IT department. Shadow IT, evolving as a type of workaround from nontransparent and unapproved end-user computing (EUC), is a term used to refer to this phenomenon, which challenges norms relative to IT controllability. This report describes shadow IT based on case studies of three companies and investigates its management. In 62 percent of cases, companies decided to reengineer detected instances or reallocate related subtasks to their IT department. Considerations of risks and transaction cost economics with regard to specificity, uncertainty, and scope explain these actions and the resulting coordination of IT responsibilities between the business workgroups and IT departments. This turns shadow IT into controlled business-managed IT activities and enhances EUC management. The results contribute to the governance of IT task responsibilities and provide a way to formalize the role of workarounds in business workgroups.

Shadow IT and Business-Managed IT

“…The responsibility for Business-managed IT tasks goes along with the question of how far the responsibility reaches and refers to the research discussion on application and IT service governance. This affects the allocation of responsibilities between BUs and IT departments on a single IS level (Chua et al, 2014;Winkler and Brown, 2014b;Zimmermann et al, 2017). While in the commerce case (C) and in the electronics case (A) BUs are entirely responsible to operate IT tasks, the engineering (B) and the banking (D) case examples describe a differentiated way of task allocation.…”

“…Studies describe organizational behavior to deal with Shadow IT by retaining related tasks in the BU or by transferring responsibilities for the system to the IT department (Beimborn and Palitza, 2013;Chua et al, 2014;Zimmermann et al, 2017). Product-related IT, shop-floor IT, or small, non-critical solutions illustrate typical examples with responsibilities given to the BU (Fuerstenau and Rothe, 2014;Kopper, 2017).…”

“…) Zimmermann et al (2017). (describing cases A and B) focused on four case studies with 40 interviewees from BUs and IT departments to analyze the nature and management of Shadow IT in companies.…”

Leaving the Shadow: A Configurational Approach to Explain Post-identification Outcomes of Shadow IT Systems

“…Moreover, we regard our paper as a contribution to future efforts for increasing the controllability over a shadow IT system's lifecycle. As the identification of a shadow IT system can be followed by strong interventions such as discontinuing a system, knowledge about mechanisms and contextual factors may help to increase the manageability of shadow IT systems as well as their transfer from a ''covert'' to an ''overt'' mode in which they are managed openly with oversight of the IT unit (Zimmermann et al 2016(Zimmermann et al , 2017Haag and Eckhardt 2017;Kopper et al 2018).…”

“…This is important because shadow IT systems present veritable sources of organizational innovation that should be better exploited than in the past (Behrens 2009;Köffer et al 2015). In addition, knowledge of possible and frequent outcomes is a prerequisite for establishing processes for controlling them (Zimmermann et al 2014(Zimmermann et al , 2017. The management and control of shadow IT systems is hardly possible without a grounded understanding of the forces that make some outcomes more likely.…”