Who owns the app your finance team built with Claude?
Staff can build a working tool in an afternoon now. Eight questions that tell you whether anyone still knows what the business runs on.
Somebody in your finance team has built an application. They used Claude or ChatGPT, it took an afternoon, and it reconciles the payment provider’s export against the ledger better than the spreadsheet it replaced. It works and people like it, but nobody in the business could tell you where it runs.
That’s the new shadow IT. For fifteen years shadow IT meant somebody putting a subscription on a company card, which was irritating and fixable, because a vendor still owned the software and you could cancel it. Now the software was written by a member of staff, on their own account, and there’s no supplier to ring when it breaks.
Where the cost went
Software used to cost enough that somebody senior had to say yes before it existed. The price worked as a control, though nobody designed it as one, and with an AI assistant the price is now close to nothing.
I’m not against any of this, and I’d be a hypocrite to tell your staff to stop, since I build with the same assistants.
The cost has moved, though. A tool built in an afternoon still needs somebody to fix it when the payment provider changes its export, somebody to notice when the key it uses expires, and somebody who knows it exists on the day its author hands in their notice and walks out with the only copy on a laptop that IT will wipe a week later.
Twelve months on, the reconciliation tool is part of month-end, because each week it saved somebody an hour and nobody wanted to go back to the spreadsheet.
How the pieces join up
Each automation makes sense on its own. Sales connects the CRM to the email platform, operations connects the CRM to the warehouse, finance connects the warehouse to the ledger, and somebody in customer service builds an agent that reads all three to answer questions. Every one of those was a sensible call. Together they’re a system with no diagram and no owner. When a field gets renamed in the CRM, the failure turns up three steps away, in the ledger, a fortnight later.
When I say estate, I mean everything the business runs on, the joins between the tools included.
Where the AI part matters
I don’t treat AI-written code as the risk, since plenty of hand-written code is worse. What I look for is whether anything sits around it.
- Did anyone other than its author read it before it went live?
- Is there a test that would catch it breaking after the next change?
- Where do the keys live? A proper secret store, or pasted into the source, a shared document or a chat history?
- What can an agent do without a person approving it? Reading the ledger and writing to it are different permissions, so check which one was granted.
- Which company data has gone into which model, and under whose account?
A managing director can ask all five of a tool they couldn’t have written.
Eight questions for the board
If you run a business of fifty or two hundred people, you can answer these without a consultant, and I’d try that before hiring one.
- Is there a list of every internal application, automation and AI tool the business depends on?
- Does each one have a named owner who’d notice if it stopped?
- Could more than one person redeploy each critical system?
- Do you know which contain a lot of AI-written code, and was any of it reviewed?
- Are keys and passwords held centrally, or inside the tools?
- Which outside AI models can see customer or staff data, and did anyone agree to that?
- Which logins still work for people who’ve left the business this year?
- What does it all cost each month, model spend included?
Three or more answers of “I don’t know” is your list of where to start, and a better use of a week than the next automation.
What to do about it
Don’t ban the tools. A ban pushes the same work onto personal accounts, where you can see even less of it.
Write the list first, and a spreadsheet will do. Five columns: purpose, users, the person who could fix it, the data it touches, and what stops if it fails. The fifth earns the effort, because it tells you which five things out of fifty need an owner this month and which forty-five can stay as they are.
Then decide, one system at a time. Some stay as they are. Where two teams built the same thing, keep the better one. A few get rebuilt properly with tests and a named owner, and those few are where I’d spend the money.
I run this as a software audit when a business wants somebody from outside to build the list and rank it. The eight questions cost nothing, though, and a finance director with an afternoon can get a long way with them.