The Shadow System – and How to Avoid It

Every organisation has one. Sometimes it's a spreadsheet called something like “Onboarding Tracker FINAL v7”. Sometimes it's a database a payroll administrator built years ago that nobody else quite understands. Sometimes it's a shared inbox, a local HR folder or a list of starters that gets emailed round every Monday morning. Nobody designed it, it isn't on the architecture diagram and it certainly isn't in the business case. But it is very often the thing people actually trust.

That's the shadow system. In my experience it is one of the most reliable signs that a technology implementation hasn't quite landed, however green the go-live dashboard looked.

How shadow systems start

Nobody sets out to undermine a new platform. Shadow systems are rarely acts of rebellion; they are acts of survival. They appear when the system people have been given doesn't support the work they actually have to do. A country has a local compliance step the global process didn't allow for. A payroll provider can't take the integration file, so someone uploads it by hand. A hiring manager needs to know whether a new starter's equipment has been ordered, and the system can't tell them. So someone builds a tracker. It works, colleagues start using it, and within a year it's the place people go first. The enterprise platform becomes the place they update afterwards – if they remember.

I have watched exactly this happen on a large ERP implementation. The design was sound on paper, the intent was right and the sponsorship was strong. But the system didn't reflect how work really flowed on the ground, and teams quietly built alternatives around it. The moment that happened, the new platform stopped being trusted, and once trust goes it is very hard to win back.

Why it matters more than it looks

It's tempting to treat shadow systems as a housekeeping issue, a bit of local untidiness to be sorted out with a policy reminder. They aren't. When the real work happens in one place and the official record lives in another, the two inevitably drift apart. People are paid who aren't in the HR system. Leavers linger. Changes are made in one record and not the other, and duplicate and inconsistent data creeps in. The “single source of truth” that justified the investment quietly stops being true.

That has consequences well beyond HR, because executives make decisions on that data and auditors test it. The organisation can end up with less governance than it had before the programme started, not more – just with a more expensive platform sitting on top.

Banning them doesn't work

The instinctive leadership response is to outlaw the spreadsheet: mandate the system, remove access, send the memo. I understand the impulse, but it rarely works, because it treats the symptom rather than the cause. If the need that created the shadow system still exists, the workaround simply goes further underground, onto a personal drive, into email or into someone's head. You haven't removed the risk. You've just stopped being able to see it.

How to avoid it

The first step is a change of mindset: treat every shadow system as a requirement you missed. That spreadsheet is free, detailed user research. It shows you exactly what information people need, in what order, and which steps the design didn't account for. Before asking “how do we stop this?”, ask “what is this doing that our system doesn't?”

Second, design for operating reality rather than the org chart. Global programmes in particular tend to design the clean central process and treat local variation as an exception to be managed later. But multiple payroll providers, local compliance rules, systems that can't take an automated feed and routine manual uploads aren't exceptions. For many countries they are the process. If the design doesn't accommodate them, people will.

Third, make the governed route the easiest route. People follow the path of least resistance, especially under pressure. If raising a new starter in the official system takes twenty minutes and three approvals, and the spreadsheet takes two, you know which will win on a busy Friday. Governance that depends on people choosing the harder option every day isn't really governance; it's hope.

Fourth, close the loop. As I set out in The Governance Gap, pushing data in one direction isn't the same as control. Real control comes from reconciling what actually happened downstream, in payroll for example, against what the governed record says should have happened, and treating every mismatch as a signal to investigate rather than a number to adjust. Reconciliation doesn't only catch errors. It tells you where your shadow systems are.

Finally, keep listening after go-live. Shadow systems grow in the months after launch, once the project team has moved on and hypercare has ended. Someone needs to own the question “where is work happening outside the system, and why?”, and they need the authority and the budget to act on the answers.

The real test

No system earns the right to be called the source of truth by being declared one. It earns it because it genuinely supports how work gets done, and because the controls around it keep proving it is right. If people are building their own alternatives, they aren't being difficult. They are telling you, as clearly as they can, that the design isn't finished yet.

So the question for any leader sponsoring a transformation is a simple one: do you know where your shadow systems are, and what they are trying to tell you?

And how shadow systems show up depends a great deal on culture. In some organisations you'll hear about a bad process loudly and immediately; in others you won't hear anything at all. That's the subject of my next piece.