There's an elephant in the room: outside of core business applications nobody needs to wait for IT any more. They don't even need to bother with sales people or demonstrations. A little time invested on Google a trial, a painless credit card signup and voila: your organisation now has yet another collaboration tool or project management space or document sharing solution which does whatever it was your core systems don't do that the user really, really wanted. Sharepoint too clumsy? Let's use Basecamp! Can't get a customer or partner on a shared drive? Dropbox! Need to make a presentation but don't have a conferencing account? join.me! Now, there's nothing wrong with these examples by themselves. They, and many others, are good grass roots solutions to problems or obstacles that people felt were stopping them from working effectively, and they felt so strongly about it that they engineered a solution. No longer bound by the constraints imposed by corporate IT policy, new workspaces spring up like desert flowers after rain. From the standpoint of the user, these solutions make sense. From a corporate governance standpoint, it's not so good. Where is information kept, how is it backed up, is it compliant with your organisation's information retention policy? How does the organisation report across teams, projects, business units? If faced with a request for disclosure – which could be an internal audit or a legal team gathering data about a contract in dispute, and not just the doomsday scenario of a court order or warrant – would your compliance team know where to look? Has anyone really reviewed the terms and conditions to see if there are disclosure, data protection or intellectual property concerns? If the service provider ceases trading – or the person holding the account leaves – what processes or solutions are in place to make sure that knowledge isn't lost to the organisation? Last, but by no means least, how do you know how much you're spending? Who's holding the baby financially? Is there duplication of functionality and cost that could be better managed with a smaller portfolio of applications?