Trust & Resilience

The Spreadsheet That Runs the Company: Finding Your Shadow Systems

Somewhere in the business is a spreadsheet that everything quietly depends on. Finding your shadow systems in January is easier than meeting them during a crisis.

A tidy white desk with a keyboard, notebooks, a potted succulent, a phone and binder clips.

Every company has one. The pricing sheet that only Brenda understands. The scheduling workbook with tabs named after people who left in 2019. The inventory tracker that the official inventory system lost to, years ago, because the spreadsheet was faster.

These are shadow systems: tools that became load-bearing without anyone ever deciding they should be. January, when the year is quiet enough to look around, is the right time to find them on purpose.

TLDR

  • A shadow system is any tool the business depends on that nobody formally chose or maintains.

  • The discovery question is "what would hurt if it disappeared," asked without blame.

  • Each one gets graduated, replaced, or accepted in writing; the only bad answer is denial.

  • Single-author spreadsheets are a person-dependency problem as much as a technology one.

How a spreadsheet becomes a system

Nobody sets out to run payroll adjacency or customer commitments out of a workbook. It starts as a quick fix: the official system was too slow, too expensive, or missing one column. The fix works. It gets a second tab, then a formula only its author understands, then a folder of copies named FINAL_v7.

The moment it becomes a system is invisible. It is the day someone says "check the sheet" in a meeting and everyone knows which one. From then on, the business has a dependency that appears in no budget line, no vendor list, and no continuity plan.

Why they are riskier than they look

The risk is not that spreadsheets are bad. It is that shadow systems skip every protection the real systems get. No backup routine mentions them. No access review covers them. The person who built them is the documentation, the administrator, and the recovery plan.

When that person is on vacation, sick, or gone, the company discovers a critical system it never approved. We wrote about the broader version of this in the person-dependency audit: the knowledge in one head is a single point of failure, and a shadow system is that problem wearing a grid.

Finding them without a witch hunt

The discovery question is gentle: what would hurt if its file disappeared tomorrow? Ask it in a staff meeting, not an audit letter. People hide spreadsheets when they fear the answer is punishment; they volunteer them when the answer is help.

The usual haul is five to fifteen candidates. Some turn out to be harmless conveniences. A few are real systems: customer data, pricing logic, commitments the business has made. Those get written into the same one-day data map as everything else that matters.

Three honest endings for each one

Every shadow system found gets one of three fates. Graduate it: if the business truly runs on it, treat it like a system, with an owner, a backup, and a note in the stack census. Replace it: if a tool you already pay for does the job, migrate the data and retire the sheet. Or accept it: small, low-stakes, and understood, written down so at least it is a known shadow.

What does not work is the fourth fate, pretending it does not exist. The spreadsheet that runs the company will make its existence known eventually. January is a much better time for the introduction than the day Brenda's laptop will not boot.

Frequently asked questions

Are all unofficial spreadsheets a problem?

No. Most spreadsheets are tools, not systems. The line is dependence: if the file vanishing or its author leaving would genuinely hurt the business, it deserves the same basic care as any system.

Should shadow systems be banned?

Banning them just drives them underground. They exist because the official tools are missing something. The better response is making them visible, then fixing the gap that created them.

Where do they belong on the tech inventory?

Right alongside everything else. Add them to the one-page stack census with an owner and a backup note. A shadow system that is written down is just a small system.

A practical next step

Ask the disappearing-file question at your next team meeting and write down whatever surfaces. If the haul includes customer data or commitments and you are not sure how exposed you are, book a Decision-Clarity Call and we will sort it together.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Trust & Resilience

All CISO Insights
Trust & Resilience

What to Do the Monday After a Competitor's Breach

A competitor's public breach is a free lesson. A five-day learning review converts it into an exposure check, a control gap check and a board note.

Trust & Resilience

Who Can See Your Most Sensitive Data Right Now?

Who holds access to your most sensitive data right now - people, service accounts and vendors? If nobody can answer with evidence, that is the finding.