@misc{BroserFalterŁawrowskietal., author = {Broser, Christian and Falter, Thomas and Ławrowski, Robert Damian and Altenbuchner, Amelie and V{\"o}gele, Daniel and Koss, Claus and Schlampp, Matthias and Dunnweber, Jan and Steffens, Oliver and Heckner, Markus and Jaritz, Sabine and Schiegl, Thomas and Corsten, Sabine and Lauer, Norina and Guertler, Katherine and Koenig, Eric and Haug, Sonja and Huber, Dominik and Birkenmaier, Clemens and Krenkel, Lars and Wagner, Thomas and Justus, Xenia and Saßmannshausen, Sean Patrick and Kleine, Nadine and Weber, Karsten and Braun, Carina N. and Giacoppo, Giuliano and Heinrich, Michael and Just, Tobias and Schreck, Thomas and Schnabl, Andreas and Gilmore, Amador T{\´e}ran and Roeslin, Samuel and Schmid, Sandra and Wellnitz, Felix and Malz, Sebastian and Maurial, Andreas and Hauser, Florian and Mottok, J{\"u}rgen and Klettke, Meike and Scherzinger, Stefanie and St{\"o}rl, Uta and Heckner, Markus and Bazo, Alexander and Wolff, Christian and Kopper, Andreas and Westner, Markus and Pongratz, Christian and Ehrlich, Ingo and Briem, Ulrich and Hederer, Sebastian and Wagner, Marcus and Schillinger, Moritz and G{\"o}rlach, Julien and Hierl, Stefan and Siegl, Marco and Langer, Christoph and Hausladen, Matthias and Schreiner, Rupert and Haslbeck, Matthias and Kreuzer, Reinhard and Br{\"u}ckl, Oliver and Dawoud, Belal and Rabl, Hans-Peter and Gamisch, Bernd and Schmidt, Ottfried and Heberl, Michael and G{\"a}nsbauer, Bianca and Bick, Werner and Ellermeier, Andreas and Monkman, Gareth J. and Prem, Nina and Sindersberger, Dirk and Tschurtschenthaler, Karl and Aurbach, Maximilian and Dendorfer, Sebastian and Betz, Michael A. and Szecsey, Tamara and Mauerer, Wolfgang and Murr, Florian}, title = {Forschung 2018}, editor = {Baier, Wolfgang}, address = {Regensburg}, organization = {Ostbayerische Technische Hochschule Regensburg}, isbn = {978-3-9818209-5-9}, doi = {10.35096/othr/pub-1382}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-13826}, pages = {98}, subject = {Forschung}, language = {de} } @inproceedings{KopperWestner, author = {Kopper, Andreas and Westner, Markus}, title = {Towards a Taxonomy for Shadow IT}, series = {Proceedings of the 22nd Americas Conference on Information Systems (AMCIS 2016), San Diego, August 11-14}, booktitle = {Proceedings of the 22nd Americas Conference on Information Systems (AMCIS 2016), San Diego, August 11-14}, pages = {1 -- 10}, abstract = {In a comprehensive literature review, we identified 21 different terms used for Shadow IT related concepts. This variety makes it difficult to identify related research and build upon it. To address this ambiguity, we reduce the different terms to six distinct concepts by developing a taxonomy and examining their relation¬ships. We do so by using a rigorous iterative methodology to identify common characteristics and to classify terms along them. By clustering the results, we derive and visualize the taxonomy. The identified concepts are Feral Practices, Workarounds, Shadow IT, Shadow Systems, Un-enacted Projects, and Shadow Sourcing. We elaborate on the concepts along their characteristics and clearly define and delimit them. As a result, we create a guide for their usage, increase search- and comparability, and unify existing knowledge.}, subject = {Informationstechnik}, language = {en} } @inproceedings{KopperWestner, author = {Kopper, Andreas and Westner, Markus}, title = {Deriving a Framework for Causes, Consequences, and Governance of Shadow IT from Literature}, series = {Proceedings zur Multikonferenz Wirtschaftsinformatik 2016 (MKWI 2016), Technische Universit{\"a}t Ilmenau, Th{\"u}ringen, 09.-11. M{\"a}rz 2016}, booktitle = {Proceedings zur Multikonferenz Wirtschaftsinformatik 2016 (MKWI 2016), Technische Universit{\"a}t Ilmenau, Th{\"u}ringen, 09.-11. M{\"a}rz 2016}, pages = {1687 -- 1698}, abstract = {Shadow IT is a widespread phenomenon which includes systems, services, and processes that are not part of the "official" corporate IT. The topic is still an emerging research area and slowly gaining traction in recent years but a state of the art analysis is missing to date. We therefore conduct a structured literature review to derive a framework for causes, consequences, and governance of Shadow IT. We identify motivators, enablers, and missing barriers as causes for Shadow IT, both positive and negative consequences on an organizational and a technical level and governance approaches which focus on clearance of existing or prevention of future Shadow IT. Our review reveals that constructivist, qualitative design using a case study approach dominates existing research. There are no dominant theories yet to explain Shadow IT. We also highlight possibilities for future research to focus on the less explored governance aspect.}, subject = {Informationsmanagement}, language = {en} } @article{KlotzKopperWestneretal., author = {Klotz, Stefan and Kopper, Andreas and Westner, Markus and Strahringer, Susanne}, title = {Causing factors, outcomes, and governance of Shadow IT and business-managed IT}, series = {International Journal of Information Systems and Project Management}, volume = {7}, journal = {International Journal of Information Systems and Project Management}, number = {1}, issn = {2182-7796}, doi = {10.12821/ijispm070102}, pages = {15 -- 43}, abstract = {Shadow IT and Business-managed IT describe the autonomous deployment/procurement or management of Information Technology (IT) instances, i.e., software, hardware, or IT services, by business entities. For Shadow IT, this happens covertly, i.e., without alignment with the IT organization; for Business-managed IT this happens overtly, i.e., in alignment with the IT organization or in a split responsibility model. We conduct a systematic literature review and structure the identified research themes in a framework of causing factors, outcomes, and governance. As causing factors, we identify enablers, motivators, and missing barriers. Outcomes can be benefits as well as risks/shortcomings of Shadow IT and Business-managed IT. Concerning governance, we distinguish two subcategories: general governance for Shadow IT and Business-managed IT and instance governance for overt Business-managed IT. Thus, a specific set of governance approaches exists for Business-managed IT that cannot be applied to Shadow IT due to its covert nature. Hence, we extend the existing conceptual understanding and allocate research themes to Shadow IT, Business-managed IT, or both concepts and particularly distinguish the governance of the two concepts. Besides, we find that governance themes have been the primary research focus since 2016, whereas older publications (until 2015) focused on causing factors.}, subject = {Betriebliches Informationssystem}, language = {en} } @article{KopperFuerstenauZimmermannetal., author = {Kopper, Andreas and F{\"u}rstenau, Daniel and Zimmermann, Stephan and Klotz, Stefan and Rentrop, Christopher and Rothe, Hannes and Strahringer, Susanne and Westner, Markus}, title = {Shadow IT and Business-Managed IT: A Conceptual Framework and Empirical Illustration}, series = {International Journal of IT/Business Alignment and Governance (IJITBAG)}, volume = {9}, journal = {International Journal of IT/Business Alignment and Governance (IJITBAG)}, number = {2}, publisher = {IGI Global}, doi = {10.4018/IJITBAG.2018070104}, pages = {53 -- 71}, abstract = {Research on Shadow IT is facing a conceptual dilemma in cases where previously "covert" systems developed by business entities are integrated in the organizational IT management. These systems become visible, are thus not "in the shadows" anymore, and subsequently do not fit to existing definitions of Shadow IT. Practice shows that some information systems share characteristics of Shadow IT but are created openly in alignment with the IT organization. This paper proposes the term "Business-managed IT" to describe "overt" information systems developed or managed by business entities and distinguishes it from Shadow IT by illustrating case vignettes. Accordingly,our contribution is to suggest a concept and its delineation against other concepts. In this way, IS researchers interested in IT originated from or maintained by business entities can construct theories with a wider scope of application that are at the same time more specific to practical problems. In addition, the terminology allows to value potentially innovative developments by business entities more adequately.}, subject = {Unternehmen}, language = {en} } @article{KopperWestnerStrahringer, author = {Kopper, Andreas and Westner, Markus and Strahringer, Susanne}, title = {Kontrollierte Nutzung von Schatten-IT}, series = {HMD Praxis der Wirtschaftsinformatik}, volume = {54}, journal = {HMD Praxis der Wirtschaftsinformatik}, publisher = {Springer}, doi = {10.1365/s40702-016-0286-x}, pages = {97 -- 110}, abstract = {Basierend auf einer systematischen und umfangreichen Analyse von Praxisbeitr{\"a}gen zum Thema Schatten-IT, die zwischen September 2015 und August 2016 erschienen sind, beschreibt der vorliegende Artikel Governance-Aspekte zu diesem Ph{\"a}nomen. Er erg{\"a}nzt damit vorhergehende akademische Studien. Es zeigt sich, dass unter Praktikern der Eindruck vorherrscht, dass IT-Abteilungen unter zunehmendem Druck stehen, schneller auf sich {\"a}ndernde Anforderungen aus den Fachbereichen reagieren zu m{\"u}ssen. K{\"o}nnen IT-Abteilungen diesen Erwartungen nicht entsprechen, beschaffen sich Fachbereiche und Nutzer selbst L{\"o}sungen in Form von Schatten-IT. Als m{\"o}gliche Antwort darauf kann sich die IT-Abteilung agiler organisieren und die IT-Architektur im Unternehmen modernisieren. Eine weitere M{\"o}glichkeit besteht darin, sich das innovative Potenzial von Schatten-IT zunutze zu machen und deren Umsetzung aktiv durch organisatorische und technische Maßnahmen zu unterst{\"u}tzen. IT-Sicherheitsmanagement und technische Schutzmechanismen k{\"o}nnen helfen, die so entstandenen L{\"o}sungen abzusichern und die Risiken zu minimieren. Nach vorherrschender Ansicht entwickelt sich die IT-Abteilung als Konsequenz aus all diesen Maßnahmen zu einem nutzerorientierten, internen Service-Provider und strategischen Partner f{\"u}r die Fachbereiche.}, subject = {IT-Abteilung}, language = {de} } @article{KopperKlotzWestneretal., author = {Kopper, Andreas and Klotz, Stefan and Westner, Markus and Strahringer, Susanne}, title = {Shadow IT and Business-managed IT}, series = {Journal of Information Technology Management (JITM)}, volume = {30}, journal = {Journal of Information Technology Management (JITM)}, number = {4}, issn = {1042-1319}, pages = {25}, abstract = {Two concepts describe the autonomous deployment of IT by business entities: Shadow IT and Business-managed IT. Shadow IT is deployed covertly, that is, software, hardware, or IT services created/procured or managed by business entities without alignment with the IT organization. In contrast, Business-managed IT describes the overt deployment of IT, that is, in alignment with the IT organization or in a split responsibility model. The purpose of this paper is to extend the conceptual understanding of Shadow IT and Business-managed IT, comparing the perceptions of 29 CIOs and senior IT managers with the results of a systematic literature review. By doing so, this paper presents a structured and comprehensive view of causing factors, outcomes, and governance of Shadow IT and Business-managed IT in practice. A comparison of academic literature and practitioner perceptions reveals the limitations and gaps of the current research and highlights avenues for future research. The authors find three category-spanning themes occurring as causing factors, outcomes, and—as part of governance measures—factors to improve the IT organization: (1) (Poor) business-IT alignment (2) (lack of) agility, and (3) (lack of) policies. This study is innovative with its comprehensive qualitative interview data that the authors compare to the existing literature. Therefore, the paper brings together theoretical and practical insights into Shadow IT and Businessmanaged IT, which should aid practitioners and scholars in decision making and future research.}, subject = {Corporate Governance}, language = {en} } @article{KopperWestnerStrahringer, author = {Kopper, Andreas and Westner, Markus and Strahringer, Susanne}, title = {From Shadow IT to Business-managed IT: A qualitative comparative analysis to determine configurations for successful management of IT by business entities}, series = {Information Systems and e-Business Management}, volume = {18}, journal = {Information Systems and e-Business Management}, number = {2}, doi = {10.1007/s10257-020-00472-6}, pages = {209 -- 257}, abstract = {Shadow IT describes covert/hidden IT systems that are managed by business entities themselves. Additionally, there are also overt forms in practice, so-called Business-managed IT, which share most of the characteristics of Shadow IT. To better understand this phenomenon, we interviewed 29 executive IT managers about positive and negative cases of Shadow IT and Business-managed IT. By applying qualitative comparative analysis (QCA), we derived four conditions that characterize these cases: Aligned, local, simple, and volatile. The results show that there are three sufficient configurations of conditions that lead to a positive outcome; one of them even encompasses Shadow IT. The most important solution indicates that IT systems managed by business entities are viewed as being positive if they are aligned with the IT department and limited to local requirements. This allows to balance local responsiveness to changing requirements and global standardization. In contrast, IT systems that are not aligned and permanent (and either organization-wide or simple) are consistently considered as negative. Our study is the first empirical quantitative-qualitative study to shed light on the success and failure of Shadow IT and Business-managed IT.}, subject = {Informationsmanagement}, language = {en} } @article{KlotzKopperWestneretal., author = {Klotz, Stefan and Kopper, Andreas and Westner, Markus and Strahringer, Susanne}, title = {Von Schatten-IT zu Business-managed IT: Fachbereichs-IT gezielt gestalten}, series = {Wirtschaftsinformatik \& Management}, volume = {14}, journal = {Wirtschaftsinformatik \& Management}, number = {4}, publisher = {Springer Nature}, issn = {1867-5913}, doi = {10.1365/s35764-022-00421-7}, pages = {282 -- 287}, abstract = {Fachbereichs-IT, Schatten-IT, Business-managed IT. All diese Begriffe beschreiben IT, die neben den eigentlichen, regul{\"a}ren IT-Systemen oder -Prozessen in Unternehmen existieren und von Mitarbeiterinnen und Mitarbeitern der Fachbereiche genutzt werden. Im Fall von„Schatten-IT" handelt es sich um IT-Systeme und -Prozesse (IT-Instanzen), die sich ohne Kenntnis der IT-Verantwortlichen etabliert haben; im Fall von„Business-managed IT" entstehen die IT-Systeme und -Prozesse in Kenntnis der bzw. in Abstimmung mit den IT-Verantwortlichen im Unternehmen.„Fachbereichs-IT" subsumiert Schatten-IT und Business-managed IT. Welche Ursachen f{\"u}hren zu solchen IT-Instanzen, welche Potenziale und Risiken haben diese IT-Instanzen und wie lassen sie sich steuern?}, language = {de} } @inproceedings{KopperFurstenauZimmermannetal., author = {Kopper, Andreas and Furstenau, Daniel and Zimmermann, Stephan and Rentrop, Christopher and Rothe, Hannes and Strahringer, Susanne and Westner, Markus}, title = {Business-managed IT: A conceptual framework and empirical illustration}, series = {26. European Conference on Information Systems (ECIS 2018), Protsmouth, UK}, booktitle = {26. European Conference on Information Systems (ECIS 2018), Protsmouth, UK}, abstract = {Research on Shadow IT is facing a conceptual dilemma in cases where previously "covert" systems developed by business entities (individual users, business workgroups, or business units) are integrated in the organizational IT management. These systems become visible, are therefore not "in the shadows" anymore, and subsequently do not fit to existing definitions of Shadow IT. Practice shows that some information systems share characteristics of Shadow IT, but are created openly in alignment with the IT department. This paper therefore proposes the term "Business- managed IT" to describe "overt" information systems developed or managed by business entities. We distinguish Business- managed IT from Shadow IT by illustrating case vignettes. Accordingly, our contribution is to suggest a concept and its delineation against other concepts. In this way, IS researchers interested in IT originated from or maintained by business entities can construct theories with a wider scope of application that are at the same time more specific to practical problems. In addition, value-laden terminology is complemented by a vocabulary that values potentially innovative developments by business entities more adequately. From a practical point of view, the distinction can be used to discuss the distribution of task responsibilities for information systems.}, language = {en} } @incollection{KopperStrahringerWestner, author = {Kopper, Andreas and Strahringer, Susanne and Westner, Markus}, title = {Kontrollierte Nutzung von Schatten-IT}, series = {IT-GRC-Management - Governance, Risk und Compliance}, booktitle = {IT-GRC-Management - Governance, Risk und Compliance}, publisher = {Springer Vieweg}, address = {Wiesbaden}, isbn = {978-3-658-20058-9}, doi = {10.1007/978-3-658-20059-6_9}, pages = {129 -- 150}, abstract = {Basierend auf einer systematischen und umfangreichen Analyse von Praxisbeitr{\"a}gen zum Thema Schatten-IT und einer Interviewstudie mit 16 IT-F{\"u}hrungskr{\"a}ften beschreibt der vorliegende Artikel Governance-Aspekte zu diesem Ph{\"a}nomen. Er erg{\"a}nzt damit vorhergehende akademische Studien. Es zeigt sich, dass unter Praktikern der Eindruck vorherrscht, dass IT-Abteilungen unter zunehmendem Druck stehen, schneller auf sich {\"a}ndernde Anforderungen aus den Fachbereichen reagieren zu m{\"u}ssen. K{\"o}nnen IT-Abteilungen diesen Erwartungen nicht entsprechen, beschaffen sich Fachbereiche und Nutzer selbst L{\"o}sungen in Form von Schatten-IT. Als m{\"o}gliche Antwort darauf kann sich die IT-Abteilung agiler organisieren und die IT-Architektur im Unternehmen modernisieren. Eine weitere M{\"o}glichkeit besteht darin, sich das innovative Potenzial von Schatten-IT zunutze zu machen und deren Umsetzung aktiv durch organisatorische und technische Maßnahmen zu unterst{\"u}tzen. IT-Sicherheitsmanagement und technische Schutzmechanismen k{\"o}nnen helfen, die so entstandenen L{\"o}sungen abzusichern und die Risiken zu minimieren. Die IT-Abteilung k{\"o}nnte sich als Konsequenz aus all diesen Maßnahmen zu einem nutzerorientierten, internen Service-Provider und strategischen Partner f{\"u}r die Fachbereiche entwickeln.}, language = {de} }