2026 06 13 shadow it custom tooling governance transition

What benefits, risks, and lifecycle costs of shadow Information Technology (IT) and custom local tooling are documented, and which governance approaches successfully transition covert local solutions into sanctioned business-managed platforms without destroying useful innovation?

Research Question

What benefits, risks, and lifecycle costs of shadow Information Technology (IT) and custom local tooling are documented, and which governance approaches successfully transition covert local solutions into sanctioned business-managed platforms without destroying useful innovation?

Scope

In scope:

Documented benefits, risks, and hidden costs of shadow Information Technology (IT), business-managed Information Technology (IT), custom spreadsheets, scripts, local agents, and similar local tooling.
How those trade-offs change with organisational size, maturity, regulation, and resilience requirements.
Governance approaches that move useful local solutions from covert or fragile use into sanctioned, shared, and supportable operating models.
The role of knowledge silos, tacit knowledge, and staff departure risk in local-tool resilience.

Out of scope:

Deliberate malicious insider behaviour.
Full vendor comparisons for discovery, monitoring, or Data Loss Prevention (DLP) products.
Consumer-only use of Artificial Intelligence (AI) tools outside organisational settings.

Constraints: Prefer systematic reviews, empirical surveys, and governance case studies; distinguish clearly between shadow Information Technology (IT) generally and newer local-agent or shadow-AI variants.

Context

This item informs whether governance should suppress local tooling outright, tolerate it, or channel it into sanctioned business-managed platforms so organisations keep the innovation benefit without absorbing unmanaged security, resilience, and knowledge-loss risk.

Approach

Establish the documented benefit, risk, and cost categories associated with shadow Information Technology (IT) and custom local tooling.
Compare how those categories evolve as organisations become larger, more regulated, or more operationally interdependent.
Evaluate governance approaches that convert covert local solutions into sanctioned shared services or business-managed platforms.
Analyse how tacit knowledge concentration in personal tools affects organisational resilience when key staff leave.

Sources

Research Skill Output

(Full output from running the research skill, retained verbatim in the completed item. §§0-5 are the investigation; §6 seeds the Findings section below.)

§0 Initialise

Question: What benefits, risks, and lifecycle costs of shadow Information Technology (IT) and custom local tooling are documented, and which governance approaches successfully transition covert local solutions into sanctioned business-managed platforms without destroying useful innovation? Scope: documented benefit, risk, and hidden-cost categories for shadow IT, business-managed IT (IT activity a business unit (BU) runs itself, overtly, with or without central Information Technology (IT) department alignment), and custom local tooling (spreadsheets, scripts, local agents); how those trade-offs shift with organisational size, regulation, and operational interdependence; governance approaches that move useful local solutions into sanctioned, supportable operating models; the role of tacit knowledge concentration and staff-departure risk in local-tool resilience. Out of scope: malicious insider behaviour, full Data Loss Prevention (DLP) vendor comparisons, consumer-only Artificial Intelligence (AI) use outside organisational settings. Constraints: prioritise systematic reviews, empirical surveys, and governance case studies; distinguish shadow IT generally from newer local-agent and shadow-AI variants. Output format: knowledge item with executive summary, key findings, evidence map, assumptions, analysis, risks and gaps, open questions.

Prior-work scan: five repository items are cited as direct inputs. Mitchell (2026) Shadow AI behavioural drivers and governance effectiveness establishes that sanctioned AI rollout does not reliably displace unsanctioned use and that agentic AI raises the containment bar beyond classic shadow IT controls. [fact; source: https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html] Mitchell (2026) Systems capability debt and citizen development establishes that citizen-development sprawl is usually a symptom of unmet systems demand and documents a tiered operating model with sanctioned promotion paths as its governance pattern rather than flat allow/deny. [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Mitchell (2026) Adam Smith, organisational design, and desire paths establishes a behavioural-legitimacy argument for why prohibition of local workarounds fails once informal use has accumulated social acceptance. [fact; source: https://davidamitchell.github.io/Research/research/2026-03-15-adam-smith-org-design-desire-paths-ai.html] Mitchell (2026) Local tooling fragmentation threshold measurement documents telemetry-based proxy metrics for aggregate local-tooling cost, the closest available quantification for this item's lifecycle-cost sub-question. [fact; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html] Mitchell (2026) Platform engineering and InnerSource hybrid standardization documents the golden path pattern as a front-end alternative for preventing new shadow-IT formation. [fact; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html] This item narrows to the classic shadow-IT literature's own benefit/risk/lifecycle-cost taxonomy and to instance-level transition mechanics (categorise, decommission-or-continue, allocate governance) that the five cited items reference but do not detail themselves. [assumption; source: https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html]

§1 Question Decomposition

Benefit, risk, and cost categories 1.1 What benefit categories does the systematic literature document for shadow IT and business-managed IT? 1.2 What risk/shortcoming categories does the systematic literature document? 1.3 What lifecycle costs specifically arise from continuity failure, undocumented tacit knowledge, and staff departure?
Evolution with organisational context 2.1 How does the benefit/risk balance shift as organisations grow larger or more operationally interdependent? 2.2 How does the balance shift under stronger regulation or compliance exposure?
Governance transition mechanics 3.1 What decision points and governance allocations move a covert instance to a sanctioned, supportable state? 3.2 What concrete phased processes have been proposed or observed for that transition? 3.3 What governance responses fail to reduce shadow IT and why?
Tacit-knowledge and resilience 4.1 What does the literature identify as the specific mechanism of continuity risk from local tooling? 4.2 What organisational resilience literature outside the shadow-IT field corroborates or extends this mechanism?

§2 Investigation

1.1 Benefit categories. Klotz et al. (2019) code five recurring benefit themes across 107 literature items: productivity gain (documented in 33% of items), innovation increase (25%), agility enhancement and flexibility increase (16%), user/customer satisfaction improvement (11%), and collaboration enhancement (9%). [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Productivity gains are attributed mainly to individual performance improvements because self-built tools fit the exact task at hand better than centrally issued alternatives. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Innovation increase reflects the same mechanism found by Raković et al. (2020): local tools are typically low-cost, user-driven attempts to fill a gap left by the mandated Enterprise Resource Planning (ERP) system or other official system, and some of these tools later acquire official status once their value is recognised. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Both reviews caution against a purely negative framing: Klotz et al. explicitly state that innovative potential should not be ignored, and Raković et al. conclude that shadow IT solutions can become genuine organisational resources over time. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]

1.2 Risk/shortcoming categories. Klotz et al. code five risk themes: security risks and lacking data privacy (33% of items, with one cited study finding 88% of interviewees naming security as a downside), integration lack, data inconsistencies, and architecture insufficiency (28%), synergy loss and inefficiency creation (26%), control loss (22%), and continuity lack (15%). [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Security risk is elevated because covert Shadow IT cannot undergo the risk assessment and prevention measures applied to sanctioned systems, which can create compliance and regulatory exposure, particularly for software as a service (SaaS) and cloud-hosted local tools. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Control loss covers a further mechanism specific to lifecycle cost: central operations can come to depend on shadow instances, so that an instance originally built as a convenience workaround becomes a single point of organisational failure if it breaks or is withdrawn. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

1.3 Lifecycle costs: continuity, tacit knowledge, and departure risk. Klotz et al. name this risk theme R5 Continuity lack directly: an instance of shadow IT is often implemented by one or a few employees, creating high dependence on those individuals for continued operation, and this dependence is reinforced by lacking documentation and low or non-existent support, producing a risk of system outages and operational downtime. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] This is the literature's most direct evidence for the research question's tacit-knowledge and staff-departure sub-question: the cost is not merely the labour of eventually replacing the tool but an unplanned discontinuity because the knowledge of how the tool works exists only in one person's head. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Raković et al. corroborate the same mechanism from the evaluation-criteria side: their summarised evaluation framework treats "size" (resources needed to use the shadow IT and the professionalism of use) and system quality as explicit criteria precisely because uncontrolled personal tools accumulate undocumented complexity that only the original builder can safely operate. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Neither systematic review reports a quantified lifecycle-cost figure (for example, a dollar cost per abandoned instance or hours of rework); both describe the mechanism qualitatively rather than measuring it. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Access note: a targeted search for a primary empirical paper quantifying the cost of shadow-IT continuity failure (search terms: "shadow IT" cost quantification abandonment key-person departure) returned only secondary commentary and no accessible primary measurement study; this gap is carried into Risks/Gaps rather than treated as resolved. [assumption]

2.1 Evolution with organisational size and interdependence. Klotz et al.'s longitudinal analysis shows that instance governance for overt business-managed IT rose from 33% coverage in literature published until 2015 to 68% in literature published since 2016, alongside a rise in coverage of control-loss risk (up to 15 percentage points), which the authors read as evidence that as organisations scale their local-tooling footprint, the operational stakes of ungoverned instances become large enough to draw sustained research and governance attention. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] The prior repository synthesis on systems capability debt adds that in regulated enterprises, the same category of local-tooling sprawl is linked to operational-risk incidents in the multi-million-to-billion-dollar range once local workarounds sit inside audited financial or compliance processes, which indicates the benefit/risk balance shifts adversely as regulatory exposure rises. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] This is consistent with Klotz et al.'s own finding that for critical processes or highly regulated businesses, a stricter prohibition policy (GG1 Policy setup) may be the more reasonable governance choice, in contrast with the general recommendation against blanket prohibition. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

2.2 Evolution with regulation. Beyond the capability-debt cross-reference above, Klotz et al. observe that overt business-managed IT allows more governance options than covert shadow IT precisely because transparency is a precondition for applying compliance controls; an organisation operating under strict regulatory obligations therefore has a structural incentive to convert shadow instances to overt, governed ones as early as possible rather than to tolerate covert use indefinitely. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

3.1 Governance decision points and allocation. Klotz et al. model instance governance as two sequential decision points once a shadow instance becomes known (overt): first, decommission or continue the instance; second, if continued, allocate governance responsibility somewhere on a spectrum between full IT-organisation control (IG3), co-governance split by task (IG4, with four sub-roles: the IT organisation providing the platform, the IT organisation managing risk, the IT organisation supporting implementation, and the BU defining requirements or designing the application), and full BU control (IG5). [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Instance categorisation (by criticality, quality, functional scope, or strategic importance) precedes both decisions and determines which allocation is appropriate: IT-organisation governance is favoured for high-criticality or high-security instances, while BU governance is favoured for limited-scope instances requiring business-specific skills to run. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

3.2 Concrete phased transition process. Raković et al. propose a three-phase "illuminating shadow IT" project as the concrete operational sequence for the transition this research question asks about. Phase one identifies shadow IT instances, using methods such as scanning end-user devices for unsupported applications, interviewing end users with the support of their management, and building a map of individually identified instances. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Phase two evaluates each identified instance against criteria adapted from Rentrop and Zimmermann's evaluation framework (relevance, quality, size, innovative potential, and parallelism with the official system), reviewed and revised together with department managers and end users, before proposing whether to ban, integrate into official IT, or simply monitor each group of instances. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Phase three implements the decisions from phase two; the paper notes that most shadow IT is likely to remain in the monitored group rather than be banned or fully integrated, and recommends deploying collaboration platforms (the paper names Yammer, Microsoft Teams, and SharePoint) plus an internal sorted portal of existing shadow-IT solutions so that end users search for an existing solution before building a new one, which lets the IT department both monitor and assist self-built tools without eliminating them. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] The Microsoft Power Platform adoption-maturity and governance guidance documents an operational analogue of this sequence for low-code business-managed tooling: organisations are guided through an initial-to-efficient maturity model with an explicit governance-framework assessment, environment strategy, and monitoring step, which mirrors Raković et al.'s identify-evaluate-implement sequence applied to a specific vendor platform rather than to shadow IT in general. [inference; source: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale] The prior repository synthesis on systems capability debt independently converges on the same tiered structure (low-friction personal environments, formal promotion paths, shared and enterprise production lanes, central telemetry) as the best-supported public governance pattern for citizen-development sprawl, which strengthens confidence that phased, tiered transition (rather than binary allow/deny) generalises beyond the two primary shadow-IT reviews consulted directly for this item. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]

3.3 Governance approaches that fail. Both primary reviews converge on the same negative finding: complete prohibition is not considered a reasonable general policy, because it would negatively affect employee motivation and innovation behaviour, and Haag et al. (as summarised by Klotz et al.) found no measurable difference in perceived usefulness of the mandatory system between employees who used shadow systems and those who did not, meaning that fixing or fine-tuning the mandatory system alone is unlikely to succeed as a suppression strategy. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Awareness training on existing policy is similarly reported as an incomplete fix: Klotz et al. report that increased awareness of shadow-IT risk does not reliably lead to a reduction in shadow-IT use. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Restriction-lack findings show that many organisations in the reviewed studies had no IT policy addressing shadow IT at all (four of nine organisations in one cited case study), and that even where a policy exists, a large share of violators are unaware they are violating it (one cited study found 80% of policy violators did not know they were breaking the rule), which indicates that policy existence alone, without active communication and monitoring, does little to change behaviour. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] This converges with the prior repository synthesis on shadow AI behavioural drivers, which independently found that sanctioned rollout of an official tool does not, by itself, materially suppress unsanctioned use of AI tools, extending the same governance-failure pattern from classic shadow IT into the newer shadow-AI variant named in scope. [inference; source: https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html]

4.1 Continuity-risk mechanism in the primary literature. As established in 1.3, R5 Continuity lack is the literature's own name for the tacit-knowledge and departure-risk mechanism: concentration of operational knowledge in one or a few employees, compounded by absent documentation and support, converts an ordinary staff departure into an operational-continuity event. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

4.2 Corroboration from outside the shadow-IT field. Everest Group's analyst commentary, published on the firm's own site and authored by its Chief Executive Officer (CEO), estimates that shadow IT spend, meaning technology spend that does not pass through the sanctioned enterprise IT shared-services function, comprises 50% or more of total enterprise technology spend in the organisations it studied, a materially larger estimate than the 30 to 40% range the same source attributes to Gartner's studies. [fact; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/] Both figures are undated point estimates from analyst commentary rather than from a citable peer-reviewed measurement study, so they are treated here as directional evidence of scale rather than as a precise, current measurement. [assumption; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/] IBM's enterprise framing of shadow Artificial Intelligence (AI), the newer local-agent variant named in scope, states that employees use unsanctioned generative-AI tools to enhance productivity, accelerate innovation, and streamline ad hoc solutions, restating the same benefit categories (productivity, innovation, responsiveness) that Klotz et al. document for classic shadow IT, which indicates the benefit taxonomy is stable across the shadow-IT-to-shadow-AI transition even though the specific tooling has changed. [inference; source: https://www.ibm.com/think/topics/shadow-ai; https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Access note: a search for a direct empirical study measuring post-departure business disruption specifically attributable to undocumented personal spreadsheets or scripts (search terms: spreadsheet key-person departure disruption empirical study) returned only advisory and audit-practice commentary rather than an accessible primary measurement paper; this gap is carried into Risks/Gaps. [assumption]

§3 Reasoning

The systematic-review evidence supports five load-bearing claims stripped of narrative glue. First, shadow IT and business-managed IT produce five recurring, separately documented benefit categories (productivity, innovation, agility, satisfaction, collaboration), all traceable to the same root cause: local tools fit the specific task better than centrally issued alternatives. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Second, five recurring risk categories exist (security, integration, synergy loss, control loss, continuity lack), and continuity lack is the literature's direct answer to the lifecycle-cost and tacit-knowledge sub-question in scope. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] Third, neither primary review quantifies lifecycle cost numerically; the mechanism is established qualitatively and corroborated by analyst-level spend estimates rather than a peer-reviewed cost study, which bounds the confidence achievable on quantified cost claims to medium at most. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/] Fourth, both reviews converge on the same two governance failures (prohibition, awareness-only training) and the same successful pattern (identify, evaluate, and allocate governance on a spectrum rather than ban outright), which is independently corroborated by a companion repository item on citizen-development governance. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Fifth, the benefit/risk/governance taxonomy generalises from classic shadow IT to shadow AI, but the two other cited repository items establish that agentic tool-calling systems raise the containment difficulty beyond what identify-evaluate-govern sequencing designed for static local tools can fully address. [inference; source: https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html]

§4 Consistency Check

contradiction_scan: resolved
finding: klotz_2019_and_rakovic_2020_agree_on_benefit_risk_taxonomy_and_anti-prohibition_conclusion
finding: neither_primary_review_provides_a_quantified_lifecycle_cost_figure
confidence_adjustment: lifecycle_cost_scale_claims_kept_at_medium_due_to_absence_of_peer-reviewed_measurement
confidence_adjustment: tacit_knowledge_continuity_mechanism_kept_at_high_due_to_convergent_primary_sourcing
scope_guardrail: maintained_distinction_between_classic_shadow_it_and_agentic_shadow_ai
unresolved_gap: no_accessible_primary_source_quantifying_cost_of_a_single_continuity_failure_event

§5 Depth and Breadth Expansion

Economic lens. The anticipated low initial cost of local tooling (Klotz et al.'s M5 Beneficial cost structure anticipation) is a perceived, up-front cost comparison, not a total-cost-of-ownership comparison that includes continuity risk, security remediation, or eventual integration effort; the literature does not report a study that reconciles the perceived low-cost motivator with the actual lifecycle cost once R3 Synergy loss and R5 Continuity lack are priced in. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] The Everest Group and Gartner-attributed spend estimates (30 to 50%+ of enterprise technology spend) indicate the aggregate economic footprint is large enough that even a modest per-instance lifecycle cost would be organisationally material, but this remains an inference from scale rather than a measured aggregate cost. [inference; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/] A companion repository item's Faros AI telemetry across 22,000 developers is the closest available quantification of this dynamic in adjacent literature, showing individual task completion rising 33.7% alongside pull request review time rising 441% as local productivity gains flood shared constraint infrastructure, though the companion item measures fragmentation cost broadly rather than isolating a single continuity-failure event. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]

Technical lens. The technical driver behind both benefits and risks is the same: local tools are built outside architectural, security, and data-governance controls, so the same low-friction accessibility that produces productivity and innovation benefits (Klotz et al.'s E1 Technical accessibility and E2 IT user competence enablers) is also what removes integration, standardisation, and risk-assessment safeguards (R2 Integration lack, R1 Security risks). [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] This means a governance design that tries to eliminate the risk without touching the accessibility that created the benefit is targeting the wrong variable. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] A companion repository item on platform engineering documents the golden path pattern as a technical mitigation that preserves accessibility while reducing risk, by making the sanctioned option as easy to discover and use as building locally, rather than by restricting accessibility after the fact. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html]

Regulatory lens. Regulatory exposure changes the correct governance answer, not just its intensity: Klotz et al. explicitly carve out an exception to the general anti-prohibition finding for critical processes or highly regulated businesses, where strict forbidding is presented as the more reasonable choice. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] This means the transition governance question in scope (how to move covert tooling into sanctioned platforms without destroying innovation) has a different correct answer depending on regulatory context, and a single governance template cannot be applied uniformly across an enterprise with mixed regulatory exposure. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

Historical lens. Raković et al.'s bibliometric analysis shows the terms shadow IT and feral system predate IT workaround in the literature and that the volume of shadow-IT research has grown since the early 2000s, tracking the spread of end-user computing, cloud, and mobile technology that lowered the technical barrier to self-built tools. [fact; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Klotz et al.'s longitudinal split (research until 2015 versus since 2016) shows the field's own research attention shifted from understanding causes to designing governance once the causes were well understood, which is the same maturation arc this item's governance question sits at the end of. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf]

Behavioural lens. The awareness-training failure (GG2) and the finding that 80% of policy violators in one study did not know they were violating policy indicate that shadow-IT use is often not a deliberate risk-taking choice but an unreflective continuation of the path of least resistance, which is the same desire-path mechanism the prior repository item on Adam Smith and organisational design derives independently from a different theoretical starting point. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-03-15-adam-smith-org-design-desire-paths-ai.html]

§6 Synthesis

Executive summary:

The documented benefit and risk taxonomy for shadow Information Technology (IT) is stable and well-replicated across two independent systematic literature reviews, but the specific lifecycle cost of tacit-knowledge concentration and staff departure is established only qualitatively in that literature, with the nearest available quantification coming from a companion repository item's proxy-metric telemetry rather than from a dedicated shadow-IT cost study. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Five benefit categories (productivity, innovation, agility, satisfaction, collaboration) and five risk categories (security, integration, synergy loss, control loss, continuity lack) recur across the reviewed literature, with continuity lack naming the exact mechanism this research question asks about: a shadow instance built and understood by one or a few employees becomes an operational-continuity risk once documentation and support are absent. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] The governance approaches with the best cross-source support are not prohibition or awareness training, both of which the primary literature finds ineffective, but a staged identify-evaluate-allocate sequence that categorises instances, decides decommission-or-continue, and then allocates governance somewhere between full IT-organisation control and full business-unit control depending on criticality and required business-specific skill. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] That staged sequence addresses instances that already exist; a companion repository item on platform engineering and InnerSource documents a complementary front-end pattern, the golden path, that reduces new shadow-IT formation by making the sanctioned option easier to find and adopt than building locally in the first place, so the two patterns operate at different points in the shadow-IT lifecycle rather than competing for the same governance decision. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html] The main open gap is that no primary shadow-IT source consulted quantifies the cost of a continuity failure in monetary or time terms; a companion repository item's telemetry on fragmented local tooling (individual task completion up 33.7% alongside pull request review time up 441%) offers a proxy signal for the same underlying mechanism, but it measures aggregate fragmentation cost rather than a single continuity-failure event, so any numeric lifecycle-cost claim beyond the qualitative mechanism should still be treated as an estimate rather than a directly measured figure. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]

Key findings:

Two independent systematic literature reviews of shadow IT and business-managed IT converge on the same five benefit categories: productivity gain, innovation increase, agility and flexibility increase, user or customer satisfaction improvement, and collaboration enhancement. ([fact]; high confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
The Klotz et al. review identifies five recurring risk or shortcoming categories: security risk and lacking data privacy, integration lack with data inconsistency, synergy loss and inefficiency, control loss, and continuity lack, with continuity lack directly naming the tacit-knowledge and staff-departure mechanism in scope for this question. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
Continuity lack occurs because an instance of shadow IT is typically implemented and understood by only one or a few employees, and this dependence is reinforced by absent documentation and low or non-existent support, producing outage and downtime risk when that person becomes unavailable; a companion repository item's proposed bus factor metric (the minimum number of engineers whose departure would leave a project unmaintainable due to lost knowledge) operationalises the same mechanism as a trackable portfolio-level indicator by counting locally owned tools with a bus factor of one or two. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html; https://arxiv.org/pdf/2202.01523)
Neither primary systematic review reports a peer-reviewed, quantified lifecycle-cost figure for shadow IT continuity failure, so the mechanism is established qualitatively but not measured in monetary or time terms in the shadow-IT literature itself; a companion repository item's telemetry on fragmented local tooling (individual task completion up 33.7% alongside pull request review time up 441% and production incidents per pull request up 242.7% across 22,000 developers) is the closest available quantification of the same underlying dynamic, though it measures aggregate fragmentation cost rather than an isolated continuity-failure event and a competing explanation (AI-generated code quality degradation) is not fully ruled out for that data. ([inference]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html)
Complete prohibition of shadow IT is not supported as an effective general governance response, because prior empirical work found no measurable difference in perceived usefulness of the mandatory system between employees who used shadow systems and those who did not; awareness training alone is similarly documented as insufficient, with one cited empirical study finding 80% of employees violating IT standards did not know they were violating them, indicating the governance shortfall is as much a communication failure as a compliance failure. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
The staged identify-evaluate-allocate governance sequence, drawn from both primary reviews together, categorises instances by criticality, quality, and strategic relevance and then allocates governance somewhere between full IT-organisation control, shared co-governance, and full business-unit control according to that evaluation. ([inference]; high confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
A three-phase "illuminating shadow IT" project (identify, evaluate, implement) is a concrete published operational transition model that explicitly avoids treating monitoring as a precursor to elimination, since most instances are expected to remain in a monitored rather than banned or fully integrated state. ([inference]; medium confidence; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
Regulatory and criticality context changes the correct governance answer rather than only its intensity, since the same systematic review that argues against blanket prohibition in general also states that strict forbidding may be the more reasonable choice for critical processes or highly regulated businesses. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
A companion repository item on platform engineering and InnerSource documents the golden path pattern, an opinionated supported default with permitted deviation, as a front-end governance layer distinct from the back-end staged transition sequence: it reduces new shadow-IT formation by making the sanctioned path easier to find and use than building locally, rather than by transitioning instances that already exist. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html)
The staged, tiered governance pattern found in the shadow-IT literature is independently corroborated by companion repository syntheses on citizen-development capability debt and platform-engineering standardisation, and by current vendor platform-governance documentation, though this corroboration draws on overlapping source families rather than fully independent primary measurement. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale)
Secondary commentary citing Gartner research estimates shadow IT at 30 to 40 percent of large-enterprise technology spend, a separate analyst account places the figure at 50 percent or more, and neither source discloses a measurement methodology in the accessible text, so the estimates should be read as directionally indicative of a materially large aggregate scale rather than as precise or independently verified current figures. ([inference]; low confidence; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/)
The benefit and risk taxonomy documented for classic shadow IT restates itself in enterprise framing of shadow Artificial Intelligence (AI), but two companion repository items establish that agentic, tool-calling shadow AI raises the containment difficulty beyond what an identify-evaluate-govern sequence designed for static local tools can fully address. ([inference]; medium confidence; source: https://www.ibm.com/think/topics/shadow-ai; https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html)

Evidence map:

Claim	Source	Confidence	Notes
[fact] Five recurring benefit categories for shadow IT/business-managed IT	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801	high	Two independent systematic reviews
[fact] Five recurring risk categories including continuity lack	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Single-review coding scheme (Klotz et al. 2019)
[fact] Continuity lack driven by single-employee dependence and absent documentation	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html; https://arxiv.org/pdf/2202.01523	medium	Primary claim (R5) plus companion bus factor metric
[inference] No quantified lifecycle-cost figure in primary reviews; nearest proxy is companion-item telemetry	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html	medium	Gap explicitly checked in both primary texts; proxy is aggregate, not per-instance
[fact] Prohibition and awareness-training-only strategies do not eliminate shadow IT	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Cites Haag et al. and Dittes et al. empirical findings within one review
[inference] Staged identify-categorise-allocate governance sequence	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801	high	Both reviews converge on the same pattern
[inference] Three-phase "illuminating shadow IT" project	https://www.itc.ktu.lt/index.php/ITC/article/view/23801	medium	Concrete operational model from a single review
[fact] Regulatory/criticality context reverses the anti-prohibition default	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Explicit carve-out in single source text
[inference] Golden path as a front-end complement to back-end staged transition governance	https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html	medium	Companion-item synthesis of Spotify and Cloud Native Computing Foundation (CNCF) sources
[inference] Tiered governance pattern corroborated outside shadow-IT literature	https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale	medium	Overlapping vendor/industry source family
[inference] Aggregate shadow IT spend scale (30-50%+)	https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/	low	Undated analyst point estimates, no disclosed methodology
[inference] Benefit/risk taxonomy restated in shadow AI framing; containment harder for agentic variants	https://www.ibm.com/think/topics/shadow-ai; https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html	medium	Cross-item synthesis

Assumptions:

Assumption: The absence of an accessible peer-reviewed cost-quantification study for shadow-IT continuity failure reflects a genuine gap in the published literature rather than a search failure on this item's part. Justification: Two independent, explicit search attempts (see §2 Access notes) using varied search terms against both general web search and the two primary systematic reviews' own reference lists returned no such study; both primary reviews describe the mechanism only qualitatively despite reviewing 77 and 107 items respectively. [assumption; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]
Assumption: Analyst point estimates of shadow IT spend (30-50%+ of enterprise technology spend) are treated as directionally indicative of scale rather than as precise current figures. Justification: The estimates are undated commentary from competing analyst firms without a disclosed measurement methodology in the accessible source text. [assumption; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/]
Assumption: The staged governance pattern found in the two primary shadow-IT reviews generalises to organisations and tool categories not directly studied by Klotz et al. or Raković et al. (for example, current shadow-AI agent use). Justification: The pattern is independently corroborated by companion repository syntheses on citizen-development governance and platform-engineering standardisation, and by current vendor guidance, but none of the corroborating sources are fully independent of the same general industry commentary ecosystem, so the generalisation is not proven at the same evidentiary strength as the primary within-domain findings. [assumption; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale]
Assumption: The fragmentation-telemetry proxy (individual task completion up 33.7%, pull request review time up 441%) is treated as a directional signal for continuity-adjacent lifecycle cost rather than as a direct measurement of a shadow-IT continuity-failure event. Justification: The companion item's own text notes AI-generated code quality degradation as a competing explanation for the same telemetry pattern, and the telemetry measures fragmentation across a developer population rather than an isolated single-instance continuity failure. [assumption; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]

Analysis:

The two primary systematic reviews are strong evidence for the benefit and risk taxonomy in this item because they each independently synthesise dozens of underlying empirical and case studies (107 items in Klotz et al., 77 in Raković et al.) and arrive at materially overlapping categories despite different search databases and time windows. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] The staged identify-evaluate-allocate governance sequence draws on both reviews together and is treated as high confidence on that mechanical basis, while single-review claims such as the risk taxonomy, the three-phase transition model, and the regulatory carve-out are capped at medium confidence because only one systematic review directly makes each of those specific claims. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] The lifecycle-cost sub-question is answered only partially: the mechanism (single-person dependence plus absent documentation) is well evidenced, but no shadow-IT source quantifies the resulting cost, and the companion item's telemetry proxy is the closest available quantification without being a direct measurement of the same event type, which is why Key Finding 4 stays at medium confidence rather than moving to high. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html] A plausible alternative explanation for the absence of a quantified cost figure is that lifecycle costs are organisation-specific and not amenable to a single generalisable coefficient, in the same way the companion repository item on systems capability debt found that public banking-loss evidence was sufficient to show materiality but insufficient to produce a reliable universal cost coefficient; that alternative is consistent with, not contradicted by, the finding here. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] On governance, an alternative hypothesis worth engaging directly is that stricter enforcement, rather than staged identify-evaluate-allocate governance, could still be the right answer if enforcement were resourced adequately; the evidence against this is that the reviewed literature reports awareness-and-policy measures failing even when policy exists, and attributes the failure to communication gaps (80% of violators unaware) rather than to insufficient enforcement resourcing, which suggests that better-resourced enforcement of the same static-policy approach would not by itself close the gap without also addressing the underlying system shortcomings that motivate workaround use. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] A second competing pattern, the golden path documented in a companion platform-engineering item, addresses the same fragmentation problem from the front end rather than the back end: it does not transition existing covert instances, so it is a complementary addition to, not a substitute for, the staged transition sequence this item's sources establish for instances that already exist. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html] The R3 Synergy loss and control loss risk categories in Key Finding 2 are consistent with a companion repository item's finding that local tooling optimisation degrades organisation-level throughput when a shared constraint's capacity is not increased commensurately, because a shadow instance that creates local efficiency without addressing the shared review, approval, or integration bottleneck downstream reproduces the same local-optimum failure mode at the level of a single tool rather than a whole delivery pipeline. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-global-optima-knowledge-work-throughput.html]

Risks, gaps, uncertainties:

No shadow-IT-specific source consulted for this item quantifies the monetary or time cost of a shadow-IT continuity failure event in isolation; the fragmentation-telemetry proxy in Key Finding 4 is the closest available quantification but measures aggregate fragmentation cost across a developer population rather than a single continuity-failure event, so a source directly measuring the latter was not identified in this investigation. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]
The analyst spend estimates (Key Finding 11) come from two competing commercial sources with no disclosed measurement methodology in the accessible text, so the true current proportion of enterprise technology spend attributable to shadow IT remains uncertain within a wide range; this confidence has been set to low rather than medium given the item's own doubts about source quality. [fact; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/]
The governance corroboration in Key Finding 10 relies on companion repository syntheses and vendor documentation rather than on a third fully independent academic source, so the strength of generalisation beyond the two primary reviews is bounded. [assumption; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html]
Both primary systematic reviews were published in 2019 and 2020 and their underlying literature bases extend only to mid-2018 and 2019 respectively, so neither directly studies the agentic, tool-calling shadow-AI variant explicitly named in this item's scope; the extension to shadow AI in Key Finding 12 is a cross-item inference, not a direct finding of either primary review. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]

Open questions:

What is the measured monetary or time cost of a representative shadow-IT continuity failure event in isolation (as distinct from the aggregate fragmentation-telemetry proxy used here), and does that cost scale predictably with organisation size or regulatory exposure?
Does the staged identify-evaluate-allocate governance sequence documented for classic shadow IT retain the same effectiveness when applied to agentic AI tools that can call other tools or take multi-step actions, or does the sequence need a materially different design for that variant?
How do the five documented risk categories trade off against the five documented benefit categories in quantitative terms for a specific organisation, such that a governance body could set a threshold for when an instance's risk outweighs its benefit?
Does combining the front-end golden path pattern with the back-end staged transition sequence measurably reduce the rate of new continuity-lack incidents, and has any organisation published data comparing the two patterns used together against either used alone?

§7 Recursive Review

review_result: pass
sections_justified: true
threads_synthesised: true
claims_sourced_or_labeled: true
acronym_audit: IT, BU, ERP, SaaS, DLP, AI, CEO checked for first-use expansion
parity_check: findings_mirrors_section_6
open_uncertainties: lifecycle_cost_quantification_gap; agentic_shadow_ai_extension_is_inference_not_direct_finding

Findings

(Populated from §6 Synthesis above.)

Executive Summary

The documented benefit and risk taxonomy for shadow Information Technology (IT) is stable and well-replicated across two independent systematic literature reviews, but the specific lifecycle cost of tacit-knowledge concentration and staff departure is established only qualitatively in that literature, with the nearest available quantification coming from a companion repository item's proxy-metric telemetry rather than from a dedicated shadow-IT cost study. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] Five benefit categories (productivity, innovation, agility, satisfaction, collaboration) and five risk categories (security, integration, synergy loss, control loss, continuity lack) recur across the reviewed literature, with continuity lack naming the exact mechanism this research question asks about: a shadow instance built and understood by one or a few employees becomes an operational-continuity risk once documentation and support are absent. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] The governance approaches with the best cross-source support are not prohibition or awareness training, both of which the primary literature finds ineffective, but a staged identify-evaluate-allocate sequence that categorises instances, decides decommission-or-continue, and then allocates governance somewhere between full IT-organisation control and full business-unit control depending on criticality and required business-specific skill. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] That staged sequence addresses instances that already exist; a companion repository item on platform engineering and InnerSource documents a complementary front-end pattern, the golden path, that reduces new shadow-IT formation by making the sanctioned option easier to find and adopt than building locally in the first place, so the two patterns operate at different points in the shadow-IT lifecycle rather than competing for the same governance decision. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html] The main open gap is that no primary shadow-IT source consulted quantifies the cost of a continuity failure in monetary or time terms; a companion repository item's telemetry on fragmented local tooling (individual task completion up 33.7% alongside pull request review time up 441%) offers a proxy signal for the same underlying mechanism, but it measures aggregate fragmentation cost rather than a single continuity-failure event, so any numeric lifecycle-cost claim beyond the qualitative mechanism should still be treated as an estimate rather than a directly measured figure. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]

Key Findings

Two independent systematic literature reviews of shadow IT and business-managed IT converge on the same five benefit categories: productivity gain, innovation increase, agility and flexibility increase, user or customer satisfaction improvement, and collaboration enhancement. ([fact]; high confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
The Klotz et al. review identifies five recurring risk or shortcoming categories: security risk and lacking data privacy, integration lack with data inconsistency, synergy loss and inefficiency, control loss, and continuity lack, with continuity lack directly naming the tacit-knowledge and staff-departure mechanism in scope for this question. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
Continuity lack occurs because an instance of shadow IT is typically implemented and understood by only one or a few employees, and this dependence is reinforced by absent documentation and low or non-existent support, producing outage and downtime risk when that person becomes unavailable; a companion repository item's proposed bus factor metric (the minimum number of engineers whose departure would leave a project unmaintainable due to lost knowledge) operationalises the same mechanism as a trackable portfolio-level indicator by counting locally owned tools with a bus factor of one or two. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html; https://arxiv.org/pdf/2202.01523)
Neither primary systematic review reports a peer-reviewed, quantified lifecycle-cost figure for shadow IT continuity failure, so the mechanism is established qualitatively but not measured in monetary or time terms in the shadow-IT literature itself; a companion repository item's telemetry on fragmented local tooling (individual task completion up 33.7% alongside pull request review time up 441% and production incidents per pull request up 242.7% across 22,000 developers) is the closest available quantification of the same underlying dynamic, though it measures aggregate fragmentation cost rather than an isolated continuity-failure event and a competing explanation (AI-generated code quality degradation) is not fully ruled out for that data. ([inference]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html)
Complete prohibition of shadow IT is not supported as an effective general governance response, because prior empirical work found no measurable difference in perceived usefulness of the mandatory system between employees who used shadow systems and those who did not; awareness training alone is similarly documented as insufficient, with one cited empirical study finding 80% of employees violating IT standards did not know they were violating them, indicating the governance shortfall is as much a communication failure as a compliance failure. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
The staged identify-evaluate-allocate governance sequence, drawn from both primary reviews together, categorises instances by criticality, quality, and strategic relevance and then allocates governance somewhere between full IT-organisation control, shared co-governance, and full business-unit control according to that evaluation. ([inference]; high confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
A three-phase "illuminating shadow IT" project (identify, evaluate, implement) is a concrete published operational transition model that explicitly avoids treating monitoring as a precursor to elimination, since most instances are expected to remain in a monitored rather than banned or fully integrated state. ([inference]; medium confidence; source: https://www.itc.ktu.lt/index.php/ITC/article/view/23801)
Regulatory and criticality context changes the correct governance answer rather than only its intensity, since the same systematic review that argues against blanket prohibition in general also states that strict forbidding may be the more reasonable choice for critical processes or highly regulated businesses. ([fact]; medium confidence; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf)
A companion repository item on platform engineering and InnerSource documents the golden path pattern, an opinionated supported default with permitted deviation, as a front-end governance layer distinct from the back-end staged transition sequence: it reduces new shadow-IT formation by making the sanctioned path easier to find and use than building locally, rather than by transitioning instances that already exist. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html)
The staged, tiered governance pattern found in the shadow-IT literature is independently corroborated by companion repository syntheses on citizen-development capability debt and platform-engineering standardisation, and by current vendor platform-governance documentation, though this corroboration draws on overlapping source families rather than fully independent primary measurement. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale)
Secondary commentary citing Gartner research estimates shadow IT at 30 to 40 percent of large-enterprise technology spend, a separate analyst account places the figure at 50 percent or more, and neither source discloses a measurement methodology in the accessible text, so the estimates should be read as directionally indicative of a materially large aggregate scale rather than as precise or independently verified current figures. ([inference]; low confidence; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/)
The benefit and risk taxonomy documented for classic shadow IT restates itself in enterprise framing of shadow Artificial Intelligence (AI), but two companion repository items establish that agentic, tool-calling shadow AI raises the containment difficulty beyond what an identify-evaluate-govern sequence designed for static local tools can fully address. ([inference]; medium confidence; source: https://www.ibm.com/think/topics/shadow-ai; https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html)

Evidence Map

Claim	Source	Confidence	Notes
[fact] Five recurring benefit categories for shadow IT/business-managed IT	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801	high	Two independent systematic reviews
[fact] Five recurring risk categories including continuity lack	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Single-review coding scheme (Klotz et al. 2019)
[fact] Continuity lack driven by single-employee dependence and absent documentation	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html; https://arxiv.org/pdf/2202.01523	medium	Primary claim (R5) plus companion bus factor metric
[inference] No quantified lifecycle-cost figure in primary reviews; nearest proxy is companion-item telemetry	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html	medium	Gap explicitly checked in both primary texts; proxy is aggregate, not per-instance
[fact] Prohibition and awareness-training-only strategies do not eliminate shadow IT	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Cites Haag et al. and Dittes et al. empirical findings within one review
[inference] Staged identify-categorise-allocate governance sequence	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801	high	Both reviews converge on the same pattern
[inference] Three-phase "illuminating shadow IT" project	https://www.itc.ktu.lt/index.php/ITC/article/view/23801	medium	Concrete operational model from a single review
[fact] Regulatory/criticality context reverses the anti-prohibition default	https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf	medium	Explicit carve-out in single source text
[inference] Golden path as a front-end complement to back-end staged transition governance	https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html	medium	Companion-item synthesis of Spotify and Cloud Native Computing Foundation (CNCF) sources
[inference] Tiered governance pattern corroborated outside shadow-IT literature	https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale	medium	Overlapping vendor/industry source family
[inference] Aggregate shadow IT spend scale (30-50%+)	https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/	low	Undated analyst point estimates, no disclosed methodology
[inference] Benefit/risk taxonomy restated in shadow AI framing; containment harder for agentic variants	https://www.ibm.com/think/topics/shadow-ai; https://davidamitchell.github.io/Research/research/2026-05-08-shadow-ai-behavioral-drivers-governance-effectiveness.html	medium	Cross-item synthesis

Assumptions

Assumption: The absence of an accessible peer-reviewed cost-quantification study for shadow-IT continuity failure reflects a genuine gap in the published literature rather than a search failure on this item's part. Justification: Two independent, explicit search attempts (see §2 Access notes) using varied search terms against both general web search and the two primary systematic reviews' own reference lists returned no such study; both primary reviews describe the mechanism only qualitatively despite reviewing 77 and 107 items respectively. [assumption; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]
Assumption: Analyst point estimates of shadow IT spend (30-50%+ of enterprise technology spend) are treated as directionally indicative of scale rather than as precise current figures. Justification: The estimates are undated commentary from competing analyst firms without a disclosed measurement methodology in the accessible source text. [assumption; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/]
Assumption: The staged governance pattern found in the two primary shadow-IT reviews generalises to organisations and tool categories not directly studied by Klotz et al. or Raković et al. (for example, current shadow-AI agent use). Justification: The pattern is independently corroborated by companion repository syntheses on citizen-development governance and platform-engineering standardisation, and by current vendor guidance, but none of the corroborating sources are fully independent of the same general industry commentary ecosystem, so the generalisation is not proven at the same evidentiary strength as the primary within-domain findings. [assumption; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html; https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html; https://learn.microsoft.com/en-us/power-platform/guidance/adoption/govern-at-scale]
Assumption: The fragmentation-telemetry proxy (individual task completion up 33.7%, pull request review time up 441%) is treated as a directional signal for continuity-adjacent lifecycle cost rather than as a direct measurement of a shadow-IT continuity-failure event. Justification: The companion item's own text notes AI-generated code quality degradation as a competing explanation for the same telemetry pattern, and the telemetry measures fragmentation across a developer population rather than an isolated single-instance continuity failure. [assumption; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]

Analysis

The two primary systematic reviews are strong evidence for the benefit and risk taxonomy in this item because they each independently synthesise dozens of underlying empirical and case studies (107 items in Klotz et al., 77 in Raković et al.) and arrive at materially overlapping categories despite different search databases and time windows. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] The staged identify-evaluate-allocate governance sequence draws on both reviews together and is treated as high confidence on that mechanical basis, while single-review claims such as the risk taxonomy, the three-phase transition model, and the regulatory carve-out are capped at medium confidence because only one systematic review directly makes each of those specific claims. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801] The lifecycle-cost sub-question is answered only partially: the mechanism (single-person dependence plus absent documentation) is well evidenced, but no shadow-IT source quantifies the resulting cost, and the companion item's telemetry proxy is the closest available quantification without being a direct measurement of the same event type, which is why Key Finding 4 stays at medium confidence rather than moving to high. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html] A plausible alternative explanation for the absence of a quantified cost figure is that lifecycle costs are organisation-specific and not amenable to a single generalisable coefficient, in the same way the companion repository item on systems capability debt found that public banking-loss evidence was sufficient to show materiality but insufficient to produce a reliable universal cost coefficient; that alternative is consistent with, not contradicted by, the finding here. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] On governance, an alternative hypothesis worth engaging directly is that stricter enforcement, rather than staged identify-evaluate-allocate governance, could still be the right answer if enforcement were resourced adequately; the evidence against this is that the reviewed literature reports awareness-and-policy measures failing even when policy exists, and attributes the failure to communication gaps (80% of violators unaware) rather than to insufficient enforcement resourcing, which suggests that better-resourced enforcement of the same static-policy approach would not by itself close the gap without also addressing the underlying system shortcomings that motivate workaround use. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf] A second competing pattern, the golden path documented in a companion platform-engineering item, addresses the same fragmentation problem from the front end rather than the back end: it does not transition existing covert instances, so it is a complementary addition to, not a substitute for, the staged transition sequence this item's sources establish for instances that already exist. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-platform-engineering-innersource-hybrid-standardization.html] The R3 Synergy loss and control loss risk categories in Key Finding 2 are consistent with a companion repository item's finding that local tooling optimisation degrades organisation-level throughput when a shared constraint's capacity is not increased commensurately, because a shadow instance that creates local efficiency without addressing the shared review, approval, or integration bottleneck downstream reproduces the same local-optimum failure mode at the level of a single tool rather than a whole delivery pipeline. [inference; source: https://davidamitchell.github.io/Research/research/2026-06-13-local-global-optima-knowledge-work-throughput.html]

Risks, Gaps, and Uncertainties

No shadow-IT-specific source consulted for this item quantifies the monetary or time cost of a shadow-IT continuity failure event in isolation; the fragmentation-telemetry proxy in Key Finding 4 is the closest available quantification but measures aggregate fragmentation cost across a developer population rather than a single continuity-failure event, so a source directly measuring the latter was not identified in this investigation. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://davidamitchell.github.io/Research/research/2026-06-13-local-tooling-fragmentation-threshold-measurement.html]
The analyst spend estimates (Key Finding 11) come from two competing commercial sources with no disclosed measurement methodology in the accessible text, so the true current proportion of enterprise technology spend attributable to shadow IT remains uncertain within a wide range; this confidence has been set to low rather than medium given the item's own doubts about source quality. [fact; source: https://www.everestgrp.com/eliminate-enterprise-shadow-sherpas-blue-shirts/; https://www.techfinitive.com/features/how-to-keep-shadow-it-costs-under-control/]
The governance corroboration in Key Finding 10 relies on companion repository syntheses and vendor documentation rather than on a third fully independent academic source, so the strength of generalisation beyond the two primary reviews is bounded. [assumption; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html]
Both primary systematic reviews were published in 2019 and 2020 and their underlying literature bases extend only to mid-2018 and 2019 respectively, so neither directly studies the agentic, tool-calling shadow-AI variant explicitly named in this item's scope; the extension to shadow AI in Key Finding 12 is a cross-item inference, not a direct finding of either primary review. [fact; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]

Open Questions

What is the measured monetary or time cost of a representative shadow-IT continuity failure event in isolation (as distinct from the aggregate fragmentation-telemetry proxy used here), and does that cost scale predictably with organisation size or regulatory exposure?
Does the staged identify-evaluate-allocate governance sequence documented for classic shadow IT retain the same effectiveness when applied to agentic AI tools that can call other tools or take multi-step actions, or does the sequence need a materially different design for that variant?
How do the five documented risk categories trade off against the five documented benefit categories in quantitative terms for a specific organisation, such that a governance body could set a threshold for when an instance's risk outweighs its benefit?
Does combining the front-end golden path pattern with the back-end staged transition sequence measurably reduce the rate of new continuity-lack incidents, and has any organisation published data comparing the two patterns used together against either used alone?

Output

(Fill in when completing: what was produced as a result of this research?)

Type: knowledge
Description: A synthesis of the documented benefit, risk, and lifecycle-cost taxonomy for shadow IT and business-managed IT, and the staged identify-evaluate-allocate governance sequence that both primary systematic reviews converge on for transitioning covert local tooling into sanctioned, supportable platforms. [inference; source: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801]
Links: https://www.sciencesphere.org/ijispm/archive/ijispm-070102.pdf; https://www.itc.ktu.lt/index.php/ITC/article/view/23801; https://www.ibm.com/think/topics/shadow-ai