Shadow IT introduces governance risks primarily because it operates outside formal oversight. Which statement is most accurate?

• A. It increases governance risk due to lack of oversight
• B. Reduces risks
• C. No effect
• D. Improves security

Answer: (A)

Shadow IT means people use apps, services, or devices without formal IT approval or governance. Because these tools operate outside the established controls, there’s no centralized oversight to enforce security policies, data handling rules, or risk assessments. That gap makes it much easier for weak configurations, unmanaged access, data leakage, licensing issues, and regulatory noncompliance to slip through, which is exactly why governance risk goes up. When IT can’t see or govern what’s being used, the organization loses visibility and control over risk, making incidents harder to detect and respond to.

So the most accurate statement is that Shadow IT increases governance risk due to the lack of oversight. It does not reduce risk, have no effect, or improve security, since unapproved tools typically bypass security controls and governance measures.