Governing IT activities in business workgroups—design principles for a method to control identified shadow IT

Abstract

The IT unit is not the only provider of information technology (IT) used in business processes. Aiming for increased work performance, many business workgroups autonomously implement IT resources not covered by their organizational IT service management. This is called shadow IT. Associated risks and inefficiencies challenge organizations. This study proposes design principles for a method to control identified shadow IT following action design research in four organizational settings. The procedure results in an allocation of task responsibilities between the business and the IT units following risk considerations and transaction cost economics. This contributes to governance research regarding business-located IT activities.