From Shadow IT to Business-managed IT and Back Again: How Responsibility for IT Instances Evolves Over Time

Today, information technology (IT) is not anymore solely deployed and maintained by the IT organization, but also by business units. IT deployed or managed by business units is called Shadow IT (without alignment with the IT organization) or Business-managed IT (in alignment or a split responsibility model with the IT organization), contrasting “classical” IT. However, the responsibility for deployed IT might change over time. Therefore, this paper conceptualizes the progression of the responsibility for IT as a trajectory through initialization, potential transitions, and discontinuance. The paper illustrates this conceptual framework using four exemplary case vignettes of IT instances. Empirical findings of the case vignettes determine indications when employees initialize an IT instance as Shadow IT, Business-managed IT, or IT-managed systems and reasons why the responsibility for an IT instance changes over time. The results suggest that scholars and practitioners should add a temporal dimension to the governance of IT instances.