Shadow SaaS and a Toothless Risk Appetite
A mid-sized European insurer with 1,800 employees uses 240 SaaS applications. Procurement records show 38% of subscriptions, about €1.2 million annual spend, were bought by business units without IT review. The board risk appetite statement says the company has “low tolerance for unmanaged technology risk,” but the enterprise risk register lists only 14 IT risks and contains no SaaS inventory. The chief risk officer asks internal audit for a view before the next risk committee. You have six weeks and one auditor. The IT director argues this is a procurement efficiency issue, not a governance failure, and points out that no breach has occurred. The CFO wants a short, actionable report; the audit committee chair wants assurance that the risk appetite statement is more than a slogan. The audit team has no prior SaaS-specific testing methodology, and budget for external specialist support is not approved.
1. Is the IT director right that this is a procurement efficiency issue rather than a governance failure? Justify your position and state what audit evidence would settle the question.
Read the worked answer
The IT director is wrong to frame this as purely a procurement efficiency issue. The decisive test is not whether a breach occurred, but whether risk was identified, evaluated, and accepted by someone with authority. A risk appetite statement that promises low tolerance for unmanaged technology risk is inconsistent with 38% of SaaS spend bypassing IT review and no SaaS inventory. That is a governance gap: the organization cannot demonstrate that it knows what technology risk it carries or that decisions are escalated to the right level.
Efficiency concerns matter, but they are secondary. Unreviewed SaaS creates data residency, security, contract, and exit risks that may not appear in procurement metrics. The absence of a breach is not evidence of effective control; it may reflect luck or undetected incidents.
Audit evidence to settle the question should include: the procurement policy and delegated approval limits; a sample of 15 business-unit SaaS purchases traced to approvals, security review, and contract terms; board and risk committee minutes showing whether SaaS risk was reported; the risk register and risk appetite definitions; interviews with business unit heads about what they believed they were authorized to do; and the IT security review records for the highest-risk applications. If business units had authority and risk was reported upward, the issue is narrower. If not, it is a governance failure.
2. Recommend three board-level actions and one metric for each.
Read the worked answer
First, the board should approve a tiered SaaS governance policy that distinguishes low-risk productivity tools from applications processing personal, financial, or health data. Business units can retain speed through a pre-approved catalogue, but higher-risk purchases require IT security, legal, and data protection review. The metric should be the percentage of SaaS spend purchased through an approved channel, reported quarterly; a target above 95% is more meaningful than a vague aspiration.
Second, the board should mandate a complete SaaS inventory with an accountable owner, data classification, contract end date, and security risk rating. The metric should be the percentage of active SaaS applications with a completed risk assessment and named owner; this directly tests whether the register is real rather than a one-off exercise.
Third, the board should require that risk acceptance above a defined threshold be escalated to the risk committee, not left to business units. The metric should be the number and value of high-risk SaaS exceptions with time-bound accepted risk and a named executive owner. These metrics are actionable because they expose both residual exposure and the speed of remediation, and they connect the risk appetite statement to decisions rather than to slogans.
3. Design a short audit test to determine whether the risk appetite statement is operating effectively.
Read the worked answer
The test should trace the statement from words to decisions, not simply confirm that it exists. Start by obtaining the board-approved appetite and identifying the specific limits it implies for technology risk, such as approval thresholds, prohibited data types, or required security reviews. Then compare those limits with the risk register, the policy suite, delegated authority matrices, and the last four risk committee packs to see whether technology risk is reported against the stated appetite.
Next, select a judgmental sample of 10 SaaS purchases, including the highest-spend and highest-data-sensitivity applications. For each, obtain the business case, approval trail, security review, contract, data processing terms, and evidence of risk acceptance where policy was waived. Compare the actual decision with the appetite and authority limits. Interview three business unit heads and two risk committee members to test whether they understand the appetite and know when to escalate.
Conclude on three attributes: whether limits exist, whether decisions respect them, and whether breaches are detected and escalated. A statement that is not linked to decision rights or reporting is not operating effectively, even if it is well written. Document the sample rationale and any exceptions.