Shadow IT: the Spreadsheet Secretly Running the Company
We found it during the migration audit — the one I’ve written about, the weekend that became a quarter, the census of everything secretly drinking from the old system.
Most of the shadow dependencies were scripts and dashboards.
One of them was Maureen.
More precisely: one of them was Maureen’s spreadsheet — eleven years old, forty-three tabs, macros of genuine sophistication, a VLOOKUP empire of such scope and such centrality that the audit’s final report contained a sentence I had to read twice: “Carrier allocation and pricing exceptions are not, in practice, functions of the ERP.”
Translation: the enterprise system of record — the one with the seven-figure license, the steering committee, the vendor summits — does not actually run our logistics exceptions. It never has.
The ERP is a figurehead monarch.
It waves from the balcony, appears on the official documents, and reconciles, quietly, weekly, to the true seat of government: a spreadsheet on the laptop of a woman in operations who built it in 2015 because — her words, in the audit interview, delivered without a flicker of apology:
How a monarchy hollows
The biography of Maureen’s spreadsheet is the biography of all shadow IT, and it’s worth walking, because at no point does anyone do anything wrong — that’s the uncomfortable engine of the whole genre.
2015: the ERP can’t represent a
2015: the ERP can’t represent a certain class of carrier exception — real gap, ticketed, prioritized appropriately against everything else, which is to say: never. Maureen, who has actual freight leaving actual docks, builds a sheet to track the exceptions. Perfectly sensible.
The sheet works.
2017: the sheet has formulas now, then a macro. Colleagues ask for access. The sheet stops being Maureen’s workaround and becomes how exceptions are done — new hires are trained on it, informally, the way all real process transmits.
2019: somebody in finance discovers the ERP’s exception data is unreliable and starts reconciling from the sheet. Read that again: the official system now syncs from the shadow one. The coup is complete and bloodless and nobody, including the participants, has noticed it happened.
2026: the audit finds a business-critical system with no backups beyond one laptop and a prayer, no access control beyond seating proximity, a formula in column AQ that Maureen herself describes as “best not to touch” — she has fences too; every system of sufficient age does — and a bus factor of exactly one, and I’ve written about what that number costs the one.
Maureen hasn’t had an uninterrupted holiday since the second Obama administration either.
Why the spreadsheet always wins
Before the response, the diagnosis, because IT departments keep misdiagnosing this as user misbehavior when it’s actually a controlled experiment in software delivery — and the shadow system keeps winning the experiment:
The spreadsheet ships faster than our sprint cycle because its product owner, engineer, and user share one chair.
No ticket queue, no refinement, no release train: Maureen meets a new exception at 9:15 and the system handles it by 9:40, because the distance between “the problem” and “the person who can change the software” is zero.
Shadow IT
Meanwhile our gap-fix ticket from 2015 sat in a backlog — correctly prioritized! that’s the sting — for eleven years.
Shadow IT isn’t rebellion.
Get Jiteshkumawatjpr’s stories in your inbox
Join Medium for free to get updates from this writer.
It’s arbitrage — the business routing around a delivery mechanism slower than its needs, using the only end-user-programmable tool civilization has ever successfully deployed at scale.
The spreadsheet is the most successful software platform in history precisely because nobody has to ask permission to build on it, and every shadow empire is a measurement, accurate to the decimal, of the gap between what the official systems do and what the business actually is.
The wrong response, and ours
IT’s reflex, on discovery, is confiscation — kill the rogue sheet, mandate the ERP, restore order.
I’ve watched this movie at other companies: kill the spreadsheet and the company stops, because the spreadsheet was the system of record wearing a disguise, and the mandate converts a shadow system into a secret one — same sheet, now hidden, now with even fewer backups. Prohibition doesn’t kill shadow IT.
It just revokes your visibility into it.
We did the opposite, and it’s the only version I’ve seen work: we adopted it. Formally. The audit reclassified Maureen’s spreadsheet from “risk item” to what it had actually been for a decade — the best requirements document in the building.
Eleven years of user research, self-funded
Eleven years of user research, self-funded, iterated daily against reality, every tab a documented gap in the official system, every macro a feature request written in the only language that couldn’t be deprioritized: working software.
You could not commission that document.
Consultants would charge seven figures for a fraction of its accuracy and deliver it in prose instead of running code.
So the replacement project ran with Maureen as its product authority — not consulted; in charge of correctness — and the build was mostly translation: column AQ decoded at last (a genuinely clever carrier-cost interpolation, wearing eleven years of patches), the exception flows lifted tab by tab, her apprentices — the bus-factor playbook, run deliberately this time — writing the docs as they learned.
It took two quarters. The ERP now actually does what its balcony waves claimed. And the sheet —
the sheet is retired with full honors: final version preserved read-only, like a ship in a bottle, linked from the new system’s docs under the heading “Origins.” Maureen signs off the replacement’s exception releases.
She took three weeks in Crete this summer, laptop at home.
The freight moved anyway, which she reports with the complicated pride of every freed keeper — I’ve seen that pride before, on a postcard.
The census question
Workflow ending, and this one I’d genuinely urge on any engineering leader: your company runs on shadow systems right now — the only question is whether you know where they are.
So we ask, in every team’s
So we ask, in every team’s quarterly review, one disarming question, phrased exactly this way because blame kills the census — I’ve written about what blame does to information:
“What spreadsheet would hurt most if its laptop died today?”
The answers are the real architecture diagram. Every one is a Maureen: a gap, an arbitrage, a requirements document compounding in the dark, and a person quietly carrying a system nobody assigned them.
Find them before the audit does. Adopt, don’t confiscate. Decode column AQ with its author.
And when the freed keeper says your systems couldn’t keep up —
write it down. It’s the truest line in the whole discovery,
and it was never an accusation. It was the requirements talking.
I write about what building software actually feels like. Ask the question this quarter: what spreadsheet would hurt most if its laptop died today? Then go meet your Maureen — respectfully. She’s been keeping your requirements current for years.
