Shadow IT and Business-Built Apps: A Governance Playbook

Govern business-built apps by making the approved route easier than the shadow route. Register every app at intake, tier it by the data and decisions it touches, apply guardrails that scale with the tier, give builders an approved platform with identity and audit built in, and assign every app an owner, a review date and a retirement plan.

Disclosure: The author works at CloudApper, which makes the CloudApper AI platform, which is discussed in this article.

Key takeaways

  • Shadow IT is usually a symptom of unmet demand, not bad intent. Bans push it further out of sight.
  • The serious risks are data exposure, orphaned apps, accounts nobody reviews and decisions with no audit trail.
  • Tier apps by risk so low-risk tools move fast and high-risk ones get real review.
  • An approved platform with single sign-on, shared data and logging does more than a policy document.
  • Every app needs a named owner and a planned end of life from day one.

Why do departments build their own apps?

Business teams build their own tools because the work cannot wait for the IT backlog. A plant manager needs a safety checklist this week. HR needs a way to collect shift preferences before the holidays. Finance needs a vendor intake form. Modern SaaS, no-code tools and AI assistants mean someone on the team can have something running by Friday, with a personal account and a credit card.

That speed is valuable, and governance should keep it. The problem is not that the business builds. It is that nobody knows what was built, who can see the data, or what happens when the builder leaves. This article focuses on the program for governing apps across the business. If your concern is specifically HR teams building AI agents that make decisions about people, see the compliance gap when HR-built AI agents make decisions. If you need to move a specific spreadsheet process, see how to replace spreadsheet workflows with governed enterprise apps.

What are the real risks of shadow IT apps?

RiskWhat it looks likeWhy it matters
Data exposureEmployee or customer data copied into a tool with public links or weak sharing settingsPrivacy obligations, breach notification, loss of trust
Orphaned appsThe builder changes roles or leaves; the app keeps running under their personal accountNo one can fix, secure or shut it down
No access reviewsAccounts created outside single sign-on, never removed at offboardingFormer staff and contractors keep access
Audit gapsApprovals and changes with no log of who did whatCannot answer an auditor, regulator or investigator
Data driftEach app keeps its own copy of employees, locations or vendorsConflicting records and manual reconciliation

Recognized frameworks treat these as basic hygiene. CIS Control 2, Inventory and Control of Software Assets, calls for actively managing all software so that only authorized software is installed and run. NIST SP 800-53 Rev. 5 includes account management (AC-2), system component inventory (CM-8) and audit and accountability controls. You cannot apply any of them to an app you do not know exists. The data drift problem is covered in our article on why a unified data layer matters for siloed app databases.

What does a governance playbook for business-built apps include?

1. Intake that takes five minutes

Ask builders to register an app with a short form: purpose, owner and backup owner, users, data types, integrations, and whether it supports a decision about people or money. Make registration a condition of getting single sign-on, shared data access or budget. Run a one-time amnesty for existing tools so teams can declare them without penalty.

2. Tiering by risk

TierTypical exampleRequired controls
Tier 1: LowTeam task tracker, no personal dataRegistration, owner, approved platform
Tier 2: ModerateInternal request forms with employee names and contact detailsSingle sign-on, role-based access, annual review
Tier 3: HighApps touching pay, health, hiring, customer data or financial approvalsSecurity and privacy review, audit logging, change control, quarterly access review, tested backup

3. Guardrails, not gates

Most controls should be automatic: single sign-on through your identity provider, data connections only through approved connectors, logging switched on by default, and templates with approval steps already built. Reserve human review for Tier 3 and for changes that move an app up a tier. If roles and permissions already follow a design in your HCM, mirror it; our guide to designing role-based access with Workday security groups shows the thinking.

4. An approved platform

The single most effective control is giving builders somewhere better to build. The comparison of options in build, buy or platform for internal enterprise apps applies here. Look for identity integration, a shared governed data layer, logging, environment separation and admin visibility across every app.

5. Lifecycle and retirement

Every registered app gets a review date. At review, the owner confirms it is still used, the users list is right and the tier has not changed. Apps with no owner or no use in a set period are archived, with data exported or deleted under your retention schedule. Retirement is a planned event, not something that happens when a password stops working.

What do CISA and NIST say that applies here?

CISA's Secure by Design initiative asks software makers to build customer security into products by default so customers do not have to bolt it on. For internal apps, apply the same expectation to the platforms you approve: secure defaults should be the starting point, not settings builders must remember. The NIST Cybersecurity Framework 2.0 adds a Govern function covering roles, policy and oversight, which is where an app governance program belongs. For apps that involve code, NIST SP 800-218, the Secure Software Development Framework, describes practices for reducing vulnerabilities across the build process.

How to apply this: a worked example

Consider a hypothetical 2,000-employee healthcare services company. A brief survey and a review of single sign-on logs and expense reports turn up more than forty business-built tools, including a shift-swap app built on a personal account by a nurse manager who has since left. IT runs a 30-day amnesty, registers what it finds, and tiers each app. Low-risk trackers stay where they are with named owners. The shift-swap app, which holds employee contact details and schedule data, becomes Tier 2 and is rebuilt on the approved platform with single sign-on. Two apps handling patient-adjacent data become Tier 3 and go through full review. Eleven unused apps are archived.

Common mistakes

  • Announcing a ban, which drives tools further underground.
  • Applying Tier 3 review to every app, which recreates the backlog that caused shadow IT.
  • Registering apps without owners, or with an owner and no backup.
  • Allowing local accounts instead of single sign-on.

Where does the CloudApper AI platform fit?

An approved platform works only if it is a better place to build than the alternatives. The CloudApper AI platform is one option for organizations that want business-requested apps built on governed foundations. According to its site, apps are built from Governed Blueprints, described as auditable, structured logic, and share a Unified Data Layer instead of separate databases per app. The platform lists Unified Governance, Security by Design and consistent data access, and it describes zero maintenance through platform auto-updates and instant deployment with no infrastructure to manage. Named identity integrations include Okta, Ping Identity, OneLogin, Microsoft Active Directory and Azure Active Directory, and business system integrations include Workday, UKG, SAP, ServiceNow, Slack and Microsoft Teams.

No platform replaces the program itself. You still need intake, tiering, owners and retirement dates, whichever platform you pick.

Questions to ask any vendor

  • Can every app use our identity provider for sign-in, with no local accounts?
  • Do apps share one governed data layer, or does each create its own database?
  • What is logged by default, and can we export logs to our security tools?
  • Can admins see every app, its owner, its users and its data connections in one place?
  • How are updates and security patches applied, and who is responsible?
  • How do we archive an app and export or delete its data?

Frequently Asked Questions

What is the difference between shadow IT and citizen development?

Both involve people outside IT building or adopting tools. Shadow IT is unknown to IT and runs outside its controls. Citizen development is the same activity brought inside a governance program, with registration, approved platforms and owners. The goal of governance is to turn the first into the second without losing the speed that made it attractive.

Should we block unapproved SaaS and no-code tools?

Blocking high-risk categories can be appropriate, but blanket bans usually fail because teams find workarounds. A better approach is to offer an approved alternative, require registration for anything that touches company data, and use single sign-on and expense review to find what is still outside the program.

Who should own business-built apps?

A named person in the business should own each app's purpose, users and data, with a backup owner. IT or a platform team should own the platform, identity integration and security controls. Ownership should transfer formally when someone changes roles, and apps without an owner should be archived.

How often should access to business-built apps be reviewed?

Match the frequency to risk: quarterly for high-risk apps and annually for moderate ones is a common pattern. With single sign-on in place, offboarding removes access automatically, so the review mainly confirms that each user's role still fits, that the owner is current and that no local accounts have appeared.

Practical next steps for IT and business leaders

  1. Publish a five-minute intake form and announce a 30-day amnesty.
  2. Pull single sign-on, expense and browser extension data to find unregistered tools.
  3. Tier every registered app and assign an owner and backup.
  4. Choose an approved platform and make it the default for new requests.
  5. Set review dates and archive anything unowned or unused.

For more on governing technology in HR and across the enterprise, see our AI in HR guides.

Last reviewed: October 2026.

Sources

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
The Onboarding Gap Nobody Talks About Workday's onboarding module is well-designed for its intended audience: office-based, desk workers with reliable computer access, personal email addresses, and the digital literacy to navigate a web-based portal. For this population, Workday onboarding works well, it automates tasks, routes approvals, collects documents, and creates a reasonably smooth first-week experience. But most organizations using Workday have a substantial population of frontline workers: warehouse employees, retail staff, manufacturing workers, healthcare aides, food service workers, drivers. For this population, the standard Workday onboarding experience frequently fails in ways that are predictable, documented, and, crucially, fixable. Understanding why it breaks down and what actually works is increasingly urgent as labor market competition for frontline talent intensifies. How Standard Workday Onboarding Is Designed Workday's new hire onboarding (delivered throu...
Read more

How to Improve the Customer Experience (CX)

Customer experience is the sum of every interaction a customer has with your company, from the first ad they see to the way a return gets handled years after the purchase. Companies that take this seriously outperform those that treat CX as a support function. The ones that struggle tend to confuse customer satisfaction scores with actual improvements, or fix the wrong things. Here's a practical look at what actually moves CX forward. Start with where customers actually struggle Most CX improvement programs begin with surveys. Surveys are useful but limited, they capture what customers are willing to articulate after the fact, which tends to under-report friction in the middle of an experience and over-index on the most recent interaction. The richer data comes from observing behavior directly: where do customers drop off in a purchase flow? Where do support tickets spike? What search queries are people entering on your site that suggest they can't find what they're loo...
Read more

UKG Union Contract and Overtime Rules for Multi-Site Food Plants

Multi-site food manufacturers running UKG often struggle with one thing: each plant has its own union contract, shift pattern and overtime rules, while the timekeeping system is configured centrally. The fix: document every contract rule precisely, map it to UKG pay rules and work rules, test against real timecards, and handle true exceptions with add-ons rather than core customization. Disclosure: The author works at CloudApper, which makes the UKG add-ons discussed in this article. Why are union contracts so hard to configure in UKG? Federal law sets a floor. Under the Fair Labor Standards Act, non-exempt employees must receive at least one and a half times their regular rate for hours worked over 40 in a workweek. Collective bargaining agreements frequently go further, and food plants often have several agreements across locations. Common contract provisions include: Daily overtime after 8 hours, or after 10 on a four-day schedule. Double time on the seventh consecutive day o...
Read more

How Do I Log In and Sign In to Workday HCM

Workday HCM is the system your organization uses to manage everything from your pay stubs and benefits to time off requests and performance reviews. Getting in is usually simple once you know where to go, but first-time login, password resets, and single sign-on setups can trip people up if no one has walked them through it. Here's what you need to know. How to find your Workday login URL Workday doesn't have one universal login page. Each organization has its own tenant, a dedicated instance with a unique URL. Your company's HR department or IT team should have provided the URL when you were onboarded. It usually looks something like your-company.workday.com or wd3.myworkday.com/yourcompany . If you weren't given the URL, check your onboarding email, your company's intranet, or ask HR directly. Some organizations also link to Workday from their internal HR portal. Don't try to guess the URL, there's no central directory, and guessing wrong just takes...
Read more

Infor HCM Software Engineer Jobs: Salary Factors and Skills

An Infor HCM software engineer's salary depends mostly on the type of employer, the depth of Infor platform knowledge, and location. Engineers who combine general software skills with hands-on experience in Infor CloudSuite HCM, Lawson, Infor ION integrations and payroll logic tend to command more than generalist developers, because that combination is scarce in the job market. What does an Infor HCM software engineer actually do? The title covers several different jobs, and pay follows the job more than the title. Broadly, these engineers build, configure, integrate and support the Infor human capital management stack, which includes core HR, payroll, benefits, talent management and workforce management. Many organizations still run the older on-premises Infor Lawson system alongside or instead of the cloud suite, so experience with both is common. Typical responsibilities include: Building and maintaining integrations between Infor HCM and payroll providers, benefits carrie...
Read more

How to Search in Workday: Find Reqs, Reports, People and Tasks

To search in Workday, type into the global search bar at the top of any page, press Enter, then use the category filters on the left of the results to narrow to people, organizations, tasks and reports or other object types. Workday only returns items your security roles allow you to see, so missing results often mean an access issue rather than a typo. How does Workday search work? Workday uses a single global search box rather than separate menus for each module. Everything in the tenant, from a worker's profile to a job requisition to a custom report, is an object that search can find if you have permission to view it. Three points explain most search behavior: Security trimming. Results are filtered by your security groups. A recruiter and a payroll partner typing the same term will see different results. Categories. After you press Enter, results are grouped into categories that appear as filters. Clicking one hides everything else. Related actions. Once you open an...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

What Is an ERP System and Why Does It Matter? An enterprise resource planning (ERP) system is software that integrates the core functions of a business — finance, inventory, procurement, human resources, manufacturing, and customer management — into a single, connected platform. Instead of data living in separate spreadsheets or standalone applications that don't talk to each other, an ERP creates one source of truth for the entire organization. For growing companies, the question is usually not whether they need an ERP but when and which one. Getting this decision right has long-term consequences. A poorly chosen ERP creates more problems than it solves — forcing teams to work around the system, creating data integrity issues, and consuming IT resources in an endless cycle of customization and maintenance. A well-chosen ERP, on the other hand, becomes the operational backbone that lets a company scale without proportionally growing its administrative overhead. Understandin...
Read more

The End of Remote Work: Why Companies Want You Back

Return to Office: The Trend Reshaping the Modern Workplace After years of celebrating the remote work revolution, a powerful counter-movement has taken hold. Amazon, JPMorgan Chase, Goldman Sachs, Disney, and hundreds of other organizations have issued return-to-office (RTO) mandates, some requiring full five-day-a-week presence. The era of near-universal remote work flexibility appears to be giving way to something more complicated, and HR leaders are at the center of navigating it. Why Companies Are Calling Employees Back Collaboration and Innovation: Many executives argue that the serendipitous interactions, the hallway conversation, the spontaneous whiteboard session, that drive breakthrough ideas simply cannot be replicated on Zoom. Studies from Stanford and MIT suggest that in-person collaboration produces measurably higher rates of novel idea generation. Culture and Cohesion: Building and sustaining organizational culture at a distance has proven harder than anticipated. N...
Read more

The Future of Employee Healthcare Key Concerns and Strategies for 2024

In a rapidly evolving professional landscape, employers are grappling with an array of challenges as they plan employee-sponsored healthcare strategies for 2024. A recent survey conducted in the US in August 2023 sheds light on the primary concerns and emerging trends in the realm of employee healthcare. Mental health, healthcare costs, pharmacy expenditures, and transformative technologies are at the forefront of employer considerations, signaling a need for comprehensive and innovative approaches to employee well-being. Rising Mental Health Concerns A staggering seven in 10 employers reported a surge in mental health concerns, marking a significant uptick from the previous year. With 77% of employers experiencing an increase and an additional 16% anticipating future challenges, the mental health landscape is a top priority. The implications of the ongoing pandemic, remote work dynamics, and societal shifts are evident as employers grapple with addressing and supporting the mental ...
Read more

How Digital Marketing Helps Your Business Grow: A Practical Plan

Digital marketing helps a business grow by putting it in front of buyers at the moment they search, compare and decide, then measuring which efforts produce revenue. Search, content, email, paid ads and social channels let even small teams reach targeted audiences, test messages cheaply and shift budget toward what works, something print and broadcast advertising rarely allow. How does digital marketing actually drive business growth? Growth comes from three levers: reaching more of the right people, converting more of them into customers and keeping those customers longer. Digital channels touch all three. Reach. Search engines, professional networks and industry newsletters connect you with people already looking for what you sell. Conversion. Clear landing pages, case examples and easy contact options turn interest into conversations. Retention. Email, customer education content and community channels keep existing customers engaged and open to expansion. The underlying ...
Read more