Shadow IT and Business-Managed IT

Abstract

Research on Shadow IT is facing a conceptual dilemma in cases where previously “covert” systems developed by business entities are integrated in the organizational IT management. These systems become visible, are thus not “in the shadows” anymore, and subsequently do not fit to existing definitions of Shadow IT. Practice shows that some information systems share characteristics of Shadow IT but are created openly in alignment with the IT organization. This paper proposes the term “Business-managed IT” to describe “overt” information systems developed or managed by business entities and distinguishes it from Shadow IT by illustrating case vignettes. Accordingly, our contribution is to suggest a concept and its delineation against other concepts. In this way, IS researchers interested in IT originated from or maintained by business entities can construct theories with a wider scope of application that are at the same time more specific to practical problems. In addition, the terminology allows to value potentially innovative developments by business entities more adequately.

From Shadow IT to Business-managed IT: a qualitative comparative analysis to determine configurations for successful management of IT by business entities

“…While the three identified themes describe aspects of both ("hidden") SIT and IT activities managed by BUs ("outside the shadow"), they do not sufficiently describe the differences and the transition between them. Kopper et al (2018b), therefore, introduced the term "Business-managed IT" in addition to "Shadow IT" by outlining and demonstrating a corresponding conceptual framework (Fig. 1).…”

“…This similarly applies to "User-driven IT/innovation" (Fürstenau and Rothe 2014) but with a focus on users rather than BUs. Kopper et al (2018b), therefore, settle on the term BMIT to accentuate the task responsibility aspect from a governance and managerial perspective.…”

“…Many businesses today use information technology (IT) systems that are "in the shadows" for the IT department which is expected to be aware of them. Kopper et al (2018b), for example, report on an event management system sourced by marketing staff because of an upcoming exhibition and the need to manage participants. Because the marketing department knew the IT department would not be able to provide a suitable system as quickly as needed, marketing simply sourced a software as service (SaaS) solution, adapted it, and used spreadsheets for data transfer.…”

“…Only later, IT managers became aware of the system. They only had moderate levels of concerns about the system's covert usage but still planned to address the situation to mitigate potential risks (Kopper et al 2018b;Zimmermann et al 2017). The mentioned event management system which was hidden from IT is an example for the phenomenon called Shadow IT.…”

“…BMIT is therefore similarly defined as all software (incl. SaaS, PaaS, IaaS), hardware, or IT service processes that are overtly created/procured or managed by business entities (individual users, business workgroups, or BUs) either in alignment with the IT department or in a split responsibility model (Kopper et al 2018b).…”