A few weekends ago I was skimming through some articles around the concept of “Shadow IT”, ie the IT solutions deployed within an organisation without the sanction of the CIO.  A quote jumped out at me in one article discussing why employees might chose to use public cloud services in a corporate context, Professor Nelson Philips of Imperial College Business School said it was an example of “positive deviance” as people were genuinely just seeking to overcome obstacles preventing their success.  I really liked that term as in my experience there has always been a positive intent behind the deployments of “credit card funded IT “, usually from frustration at being unable to progress through official channels.

Now as a career CIO I am not about to fall into the gamekeeper turned poacher trap and argue that this is always fine and appropriate.  I have enough scars from well intended but not entirely understood leaps into the solution that appeared so “quick, easy and risk free” to forget that there are often sound reasons for the IT function’s apparent unwillingness to act.  However, I do accept that there are times when the oh so enticing cloud service can be a highly effect rapid means to solving a business requirement.  The critical questions around data security, process integrity and integration requirements have to be asked but they should not always be used as a great reason to say “no”.   One tactic that I have found effective is to enable people to intelligently self-assess the viability of a given cloud based solution.  We created a simple “viability qualification” questionnaire tool through which we articulated the key questions that make clear the integration and risk implications of a given cloud service; all offered under the guise of self empowerment.  We built up the use of the tool by responding quickly to requests which were based on it.  Over a relatively short period of time we found people self-filtering material volumes of tempting solutions they might have otherwise have championed.  I will not claim it solved all the challenges but it certainly removed a deal of the potential conflict points.

It seems to me that being operationally excellent just gives the CIO a seat at the decision table. To use that seat to manage the IT lurking in the shadows the CIO must prove that they can, and are seen to be able to,  enable the business to succeed at the pace set by the competition.  I believe that they need to enable their colleagues to be positive deviant in a context where the company is assured that it understands the risk to true cost to value gained equation.