Seven reasons projects start that nobody actually approved

Every organization has work underway that never went through a decision. It is rarely rebellion. These are the seven mechanisms, and each has a different fix.

1. The approved route is slower than the work

If getting a request through intake takes longer than building the thing, people will build the thing. This is the root cause behind most of the others, and no amount of policy fixes it. The intake has to be fast enough to be worth using.

2. A pilot that was never meant to be permanent

Someone trials a tool to answer a question. It works. People start relying on it. Nobody decides to adopt it, but by the time anyone notices, three teams depend on it and there is data inside it.

A pilot needs an end date and a decision point from the start — including an agreed answer to what happens to the data if the answer is no.

3. It was bought with a credit card

Software that costs a few hundred dollars a month does not hit a procurement threshold. It becomes a business system anyway. The organization discovers it during an audit, a security review, or when the person who owned it leaves.

4. It arrived inside something else

A vendor includes a capability in a platform already being bought, so it is switched on without a separate decision. Nobody evaluated it, nobody owns it, and it may duplicate something the organization already runs.

5. Nobody can say who decides

Where decision rights are unwritten, work is approved by whoever is confident enough to start. This looks like a governance failure but is usually an operating model gap: the authority to commit was never allocated, so it defaults to the assertive.

6. It is a regulatory or safety obligation with no home

Work that has to happen and has no owner starts anyway, driven by whoever feels the exposure. It is usually the right work, badly funded, and invisible in the portfolio.

7. Somebody senior asked for it

The most common of all, and the least discussed. A direct request from an executive outranks the intake process in practice, whatever the policy says. Naming this explicitly — that anything going in this way still gets added to the list and still consumes the same capacity — is more useful than pretending it does not happen.

What to change

Make the official path fast. A request should get a yes, a no, or a date within days, not weeks. Most shadow work disappears when the alternative is genuinely quicker.

Then add everything you find to the list, without penalty, once. The goal is a complete picture, and you will not get one if surfacing something gets a team into trouble.