Revisiting Shadow IT research: What we already know, what we still need to know, and how do we get there?

The implementation of information technology (IT) solutions by end-users while bypassing formal IT processes and controls is a major concern for most organisations. This phenomenon is known as Shadow IT (SIT). Over the years, research on SIT focused on understanding the risks, benefits and necessary controls to prevent the occurrence of SIT in organisations. The main objective of this study was to review the past literature to identify the gaps and to propose a future direction for SIT research. The PRISMA approach was used to systematically identify the literature. The findings indicate that the literature is still far from reaching maturity. The definitions used in the literature display a diverse understanding of the concept of SIT. The usage of terminologies is also not consistent, which is problematic for new researchers wanting to build on existing research. Most studies focus on the individual's perspective of SIT rather than the group perspective - such as business unit decision making with respect to the implementation of SIT. The consequences and punishment for implementing SIT are not explored. This study informs theory on research gaps and future research opportunities in the field of SIT.