Someone on your team has found a tool they love. It solves a real problem, it’s quick to set up, and they want to start using it today. That request is usually a good sign, people trying to work smarter. But before you say yes, a few quick questions can save you a much bigger headache later.

This isn’t about slowing your team down or saying no to everything new. It’s about the difference between adopting a tool properly and ending up with another piece of Shadow IT running quietly in the background.

Here are the five worth asking every time.

1. Where does our data actually go?

Once information goes into a new tool, where is it stored, who owns it, and which country is it held in? This matters for GDPR compliance as much as it matters for basic peace of mind. If the answer isn’t clear from the provider’s website, that’s already worth flagging.

2. Who else has access, and can we control it?

Can you set individual user permissions, or is it one shared login for the whole team? Can you see who did what, and can you switch off access the moment someone leaves the business? If the answer to any of these is no, that’s a gap that will need managing manually, which is exactly how things slip through the cracks.

3. What happens to our data if we stop using it?

Tools get replaced. Contracts end. Before signing up, it’s worth knowing whether you can export your data cleanly, and whether it gets properly deleted from the provider’s systems once you’ve left. Getting locked into a tool because there’s no clean way out is a common, avoidable problem.

4. Does it play nicely with what we already have?

A great tool used in isolation from everything else can create more friction than it saves, duplicate data entry, information sitting in silos, extra logins for staff to manage. It’s worth checking whether it integrates with your existing systems, or whether it’ll just become one more disconnected piece of the puzzle.

5. Who’s responsible for it once it’s in?

Every tool needs an owner. Someone to manage updates, handle access changes, and know it exists when a security review or an audit comes around. If nobody’s clearly responsible, it tends to become invisible fast, which is exactly how so much credential management ends up scattered across a dozen personal logins nobody’s tracking.

The Bottom Line

None of these questions are about blocking new tools. They’re about making sure the tools your team relies on are ones your business can actually see, manage, and trust with its data. Five quick questions now is a lot easier than untangling a mess later.

If you want a hand building a simple approval process for new software, or just want a clearer picture of what’s already running across your business, get in touch with the team at Gardner Systems. Our managed IT support covers exactly this kind of thing.