Shadow SaaS at Northbridge Mutual: Who Decides, and What Happens in 45 Days
Northbridge Mutual, a property-and-casualty insurer with 1,200 employees, ran a cloud access security broker discovery scan and found 340 SaaS applications in use. Only 62 had gone through IT procurement. Finance's card-spend analysis puts SaaS at $2.1M annually, and the architecture team estimates that 38% of the applications duplicate a function already provided by another tool. Most subscriptions were bought by department heads on corporate cards under a $25,000 approval threshold that procurement never sees.
The steering committee wants a single approved-product list and an immediate freeze on new purchases. The head of Claims objects: her $240,000 claims-analytics subscription renews in 45 days, she says the sanctioned analytics tool cannot handle catastrophe-modeling volumes, and she argues that centralizing procurement would add six weeks to the renewal. The CIO wants the committee to mandate centralization now and treat the renewal as an exception to be dealt with afterward.
1. Recommend how decision rights for SaaS purchasing should be allocated, and specify what the committee should do about the Claims renewal within the next 45 days. Justify the design.
Read the worked answer
A blanket mandate plus a freeze will not work, because the $25,000 card threshold is the actual control failure: any rule that lives above the card limit will keep producing unregistered purchases. Fix the cheap control first (lower the threshold, require the card provider to flag recurring software merchants, and require a procurement reference number before a subscription can be expensed).
Then allocate decision rights in tiers rather than centrally. Business units keep product choice inside an approved category; security and architecture review applies in proportion to the data classification (customer PII and claims data get full review, collaboration tools get a checklist); and purchases above a defined value require joint CIO/CFO sign-off against a published rubric. Publish a 5-business-day service level and an exception route, because slow procurement is what created the card spend in the first place.
For the renewal, neither option is acceptable: refusing it strands a live claims function in 45 days, and approving it merely because of the deadline rewards the bypass. Grant a 12-month extension with three conditions: a termination-for-convenience right on 90 days' notice, delivery of 90 days of usage telemetry and an integration inventory, and a joint performance test against the sanctioned tool at catastrophe-modeling volumes. Run the consolidation evaluation in parallel. The deadline is a negotiating lever, not a governance argument, and a conditional extension converts it into one.
2. What criteria and evidence should the committee use to decide whether to fund the Claims renewal given the duplicate-function finding?
Read the worked answer
The 38% duplication figure is a category-level estimate and is not decision-grade on its own; the committee needs capability-level overlap. Require, for the specific analytics capability: active-user counts and query volumes over 90 days, the list of downstream integrations that read the tool's outputs and what it would cost to repoint them, data volume and performance against the stated catastrophe-modeling requirement validated by a witnessed benchmark rather than the vendor's datasheet, and the contractual exit cost including any data-export charges.
The committee should set the decision rule before seeing the answer, so the decision cannot be reverse-engineered from the incumbent's preference. A defensible rule: fund if the tool is the only one that meets a documented business requirement with evidence, or if the cost of exit exceeds 24 months of subscription fees; consolidate if functional overlap is material and adoption data shows low or duplicated use. Either way, require the renewal to be recorded in the registry with an owner, a data classification, and a review date.
Note two traps. First, low usage does not prove low value in claims analytics, where a tool may be used by a handful of catastrophe modelers during events; usage must be read against the work pattern. Second, the sanctioned tool's suitability is a claim made by IT, and the benchmark is the fair way to test it without making the dispute about hierarchy.
3. Name three measures that would show, twelve months on, whether the new model worked, and one way each could be gamed.
Read the worked answer
Percentage of SaaS spend carrying a purchase order or registry record. This is the direct outcome measure and catches the original problem. Gaming: spending gets reclassified as professional services, support, or data subscriptions, or annual subscriptions are split into smaller card purchases that fall under the threshold. Countermeasure: reconcile against merchant categories at the card provider, not against what requesters label the spend.
Number of applications in a category versus the approved list, and the count of duplicate subscriptions. Gaming: requesters label new tools as 'pilots' or 'evaluations' that never convert on paper but run for years. Countermeasure: time-bound every pilot with automatic expiry and a decommission check.
Median procurement cycle time from request to decision. Without this, centralization will look successful on cost while quietly degrading delivery, and shadow IT will return. Gaming: blanket pre-approvals of broad categories, or counting the clock from the moment a complete packet arrives while the packet requirements creep. Countermeasure: measure from the requester's first submission and audit the packet requirements quarterly.
Add one security measure as a leading indicator: percentage of registered applications using SSO and automated deprovisioning. It converts registry compliance into real risk reduction, which is the reason governance is doing this at all.