Which of the following BEST reflects the risk of a ‘shadow IT" function?

Shadow IT refers to technology systems and services used within an organization without explicit approval from the IT department. The primary risk associated with this practice is the circumvention of established governance, risk, and compliance (GRC) processes. When employees use unvetted third-party services, the organization loses visibility and control. This means that critical information security controls, data privacy regulations (like GDPR or CCPA), and internal policies are not applied, creating significant security vulnerabilities, data breach risks, and potential legal or regulatory non-compliance. The organization cannot perform due diligence or manage the risks associated with these unknown third parties.

A. Increased innovation and agility are often cited as benefits or drivers of shadow IT, not risks.

C. While shadow IT can lead to redundant spending, the lack of security and compliance oversight represents a far more significant and fundamental business risk.

D. Improved user productivity is a perceived benefit that encourages the use of shadow IT, not the risk itself.

1. Shared Assessments Program. (2023). Certified Third Party Risk Professional (CTPRP) Body of Knowledge. Domain 2: Third Party Risk Identification and Scoping, Section 2.2: Identifying Third Party Relationships.

2. Gartner. (n.d.). IT Glossary: Shadow IT. "Shadow IT devices and applications are not necessarily bad, but they can create serious security risks... It also creates issues of compliance..."