The Spreadsheet That Runs the Company: Finding Your Shadow Systems
Somewhere in the business is a spreadsheet that everything quietly depends on. Finding your shadow systems in January is easier than meeting them during a crisis.

Every company has one. The pricing sheet that only Brenda understands. The scheduling workbook with tabs named after people who left in 2019. The inventory tracker that the official inventory system lost to, years ago, because the spreadsheet was faster.
These are shadow systems: tools that became load-bearing without anyone ever deciding they should be. January, when the year is quiet enough to look around, is the right time to find them on purpose.
TLDR
A shadow system is any tool the business depends on that nobody formally chose or maintains.
The discovery question is "what would hurt if it disappeared," asked without blame.
Each one gets graduated, replaced, or accepted in writing; the only bad answer is denial.
Single-author spreadsheets are a person-dependency problem as much as a technology one.
How a spreadsheet becomes a system
Nobody sets out to run payroll adjacency or customer commitments out of a workbook. It starts as a quick fix: the official system was too slow, too expensive, or missing one column. The fix works. It gets a second tab, then a formula only its author understands, then a folder of copies named FINAL_v7.
The moment it becomes a system is invisible. It is the day someone says "check the sheet" in a meeting and everyone knows which one. From then on, the business has a dependency that appears in no budget line, no vendor list, and no continuity plan.
Why they are riskier than they look
The risk is not that spreadsheets are bad. It is that shadow systems skip every protection the real systems get. No backup routine mentions them. No access review covers them. The person who built them is the documentation, the administrator, and the recovery plan.
When that person is on vacation, sick, or gone, the company discovers a critical system it never approved. We wrote about the broader version of this in the person-dependency audit: the knowledge in one head is a single point of failure, and a shadow system is that problem wearing a grid.
Finding them without a witch hunt
The discovery question is gentle: what would hurt if its file disappeared tomorrow? Ask it in a staff meeting, not an audit letter. People hide spreadsheets when they fear the answer is punishment; they volunteer them when the answer is help.
The usual haul is five to fifteen candidates. Some turn out to be harmless conveniences. A few are real systems: customer data, pricing logic, commitments the business has made. Those get written into the same one-day data map as everything else that matters.
Three honest endings for each one
Every shadow system found gets one of three fates. Graduate it: if the business truly runs on it, treat it like a system, with an owner, a backup, and a note in the stack census. Replace it: if a tool you already pay for does the job, migrate the data and retire the sheet. Or accept it: small, low-stakes, and understood, written down so at least it is a known shadow.
What does not work is the fourth fate, pretending it does not exist. The spreadsheet that runs the company will make its existence known eventually. January is a much better time for the introduction than the day Brenda's laptop will not boot.
Frequently asked questions
Are all unofficial spreadsheets a problem?
No. Most spreadsheets are tools, not systems. The line is dependence: if the file vanishing or its author leaving would genuinely hurt the business, it deserves the same basic care as any system.
Should shadow systems be banned?
Banning them just drives them underground. They exist because the official tools are missing something. The better response is making them visible, then fixing the gap that created them.
Where do they belong on the tech inventory?
Right alongside everything else. Add them to the one-page stack census with an owner and a backup note. A shadow system that is written down is just a small system.
A practical next step
Ask the disappearing-file question at your next team meeting and write down whatever surfaces. If the haul includes customer data or commitments and you are not sure how exposed you are, book a Decision-Clarity Call and we will sort it together.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


