Shadow SaaS in a wholesale distributor
You are the business relationship manager for a £1.2bn wholesale distributor. Over 18 months, regional directors have bought 14 SaaS tools - project planning, route analytics, field scheduling and customer surveys - with £620k annual spend. Three tools duplicate functionality already in the core service catalogue, none integrate with the ERP, and two hold customer personal data under contracts the security team has never reviewed. The CIO wants you to 'shut it down and enforce procurement'. The most active regional director, whose region is 22% ahead of target, says IT takes nine months to deliver anything, so he went direct. The finance director wants visibility but is worried about slowing the business down. You have no formal authority over the regions and a service review with the regional directors in three weeks.
1. The CIO's instruction is to shut the tools down. How do you respond, and what do you actually do in the next three weeks?
Read the worked answer
Reframe the instruction before acting on it. A shutdown order treats a relationship problem as a compliance problem and will confirm the director's view that IT is a blocker.
- Separate the risk tiers. The two tools holding unreviewed customer personal data are a non-negotiable risk; that is a direct conversation with the director and, if needed, the DPO, not a surprise audit.
- Meet the director one-to-one. Ask what he was trying to achieve, what IT did that made nine months feel real, and which of the 14 tools he would defend.
- Do not promise a shutdown you cannot deliver. Tell the CIO you will bring the estate under visibility and control in phases, starting with data risk.
- Create a lightweight intake with a published decision time, and route the next request through it as a test.
The judgement is to protect the relationship while removing the reasons for bypass, not to win the argument.
2. What evidence and measures would you put in front of the regional directors and the finance director to make the case for change?
Read the worked answer
Build a single evidence pack, but make it about value and time, not only spend.
- Cost and risk: £620k annual spend, three areas of duplication, integration cost not yet counted, two unreviewed data-processing contracts.
- Time-to-deliver: take five recent requests and show actual elapsed time from request to decision, separating IT delay from decision delay elsewhere. This tests the director's claim rather than contradicting it.
- Options: consolidate, retain with integration, or replace with a catalogue service, with cost and risk for each.
- A commitment you control: a 10-working-day intake decision, published.
Finance will support visibility; the directors will support speed. Give each what they actually need. Avoid presenting a slide that simply lists 14 tools as failures - it invites defensiveness and loses the room before the argument starts.
3. How would you know the relationship has improved, beyond reduced spend?
Read the worked answer
Spend reduction is a lagging indicator and can be achieved by driving demand underground. Use a small set of indicators:
- Early visibility: the proportion of new SaaS requests that reach IT before purchase, not after.
- Decision speed: median time from intake to decision, against the published commitment.
- Relationship quality: a short, regular pulse with the regional directors, plus service review attendance and tone.
- Risk: number of tools holding personal data without a completed review.
- Reuse: requests satisfied from the catalogue rather than new purchases.
Review these with the directors, not about them. If early visibility rises while spend stays flat, the relationship is working; if spend falls and visibility falls, you have merely pushed the problem out of sight.