Systems capability debt as the root cause of citizen development

Research Question

What empirical evidence exists that systems capability debt, the accumulated gap between what people need from their systems and what those systems deliver across integration, functionality, data access, data quality, data migration, User Experience (UX), and timeliness dimensions, is the root cause of citizen development sprawl in regulated financial services organisations; what is its quantified operational risk cost; and what governance architectures have demonstrably reduced citizen development sprawl without suppressing legitimate automation demand?

Findings

Executive Summary

• The reviewed evidence supports a strong but not monocausal claim that the working category used here as systems capability debt, meaning recurring gaps between operational demand and sanctioned system capability across integration, data quality, workflow timeliness, and delivery capacity, is the dominant recurring driver of citizen development sprawl in regulated enterprises, while low-code preference is mainly the enabling mechanism that absorbs unmet delivery demand.
• Public quantified cost evidence shows that the operational-risk channels associated with that debt are already material, with organisations reporting more than USD 5 million annual losses from poor data quality and banking incidents ranging from a GBP 46.55 million fine to a mistaken USD 893 million payment and a USD 6.2 billion trading loss context involving spreadsheet-heavy controls.
• The governance architectures with the best public support do not suppress automation demand; they route it into tiered sanctioned lanes with telemetry, environment controls, DLP, shared pipelines, and central platform stewardship while simultaneously improving the underlying systems that created the workaround demand.
• No reviewed public framework provides a numeric readiness threshold for broad agentic autonomy, but all credible frameworks imply the same sequencing rule: capability remediation and platform control maturity must precede broad autonomous scope.

Key Findings

1. High confidence. The best available empirical evidence indicates that citizen development sprawl usually begins as a workaround response to slow, misaligned, or incomplete official systems rather than as an independent preference for low-code tools.
2. High confidence. Shadow IT and Business-managed IT research repeatedly identifies Information Technology slowness, business-IT misalignment, and shortcomings in mandatory systems as the recurring conditions that produce local workaround estates.
3. High confidence. The operational-risk costs associated with capability-debt manifestations are already economically material in public evidence, even when the loss event is described as data quality, spreadsheet error, or legacy workflow failure rather than citizen development.
4. Medium confidence. Public banking-loss evidence is sufficient to show materiality but insufficient to produce a reliable universal cost coefficient for citizen-development sprawl because bank consortium data is sensitive and public sources overrepresent the largest failures.
5. Medium confidence. The best-supported public governance pattern in the reviewed evidence is a tiered operating model with low-friction personal environments, formal promotion paths, shared and enterprise production lanes, central telemetry, and policy enforcement rather than a flat allow or deny regime.
6. Medium confidence. The reviewed Microsoft governance and product documentation implies that durable citizen-development governance requires enforceable controls over authentication, knowledge sources, connectors, triggers, channels, telemetry, and lifecycle promotion, because telemetry without intervention points leaves risky estates visible but still executable.
7. High confidence. The same maturity gaps that create citizen-development sprawl also narrow the safe scope of agentic AI because weak data, access controls, interfaces, and feedback loops are amplified by autonomous execution.
8. Medium confidence. A defensible risk-committee test for genuine AI value is whether the use case still creates material value after integration, data quality, workflow timeliness, and sanctioned automation are fixed, because use cases that fail that test are primarily capability-gap compensation.

Assumptions

• Assumption: Shadow IT, Business-managed IT, and large-enterprise Power Platform evidence is directionally applicable to regulated banking citizen development. Justification: direct bank-specific public case evidence is sparse, but the causal and governance mechanisms are organisational and platform patterns rather than bank-only technical patterns.

Analysis

• The causal claim was weighted most heavily toward the Shadow IT and Business-managed IT evidence because those sources directly investigate why unsanctioned or semi-sanctioned technology emerges inside organisations.
• Low-code studies were then used to test whether the evidence pointed instead to tool preference, and they did not displace the workaround explanation because they still describe pressure for faster, cheaper delivery under constrained engineering supply.
• Cost evidence was treated as channel evidence rather than label evidence, because public losses are recorded as data, spreadsheet, reporting, or workflow failures even when they arise from the same underlying capability deficits that drive citizen-development workarounds.
• Governance evidence was weighted toward architectures that preserve sanctioned speed, because the workaround literature and the HEINEKEN case both imply that durable control comes from combining guardrails with delivery capacity rather than from restriction alone.

Risks, Gaps, and Uncertainties

• Public banking-loss data is incomplete, and the most granular consortium datasets, including ORX-style collections, are typically anonymised or inaccessible.
• Quantified losses can be traced confidently to capability-debt manifestations, but not always to citizen development as a labelled category.
• Public governance case studies with clear before-and-after sprawl reduction counts are scarce, so the strongest evidence is measured scale under governance rather than precise reduction percentages.
• No public threshold model was found that converts readiness into a single score suitable for a board pack without further local judgment.

Open Questions

• Could a bank-specific internal loss study translate workaround-estate attributes, spreadsheets, local databases, manual reconciliations, and unsanctioned flows, into a more precise operational-risk cost coefficient?
• Can a practical readiness scorecard be built from data quality, access control, approved-interface coverage, test automation, and platform maturity without creating false precision?
• Which measured outcomes from large Microsoft 365 estates would remain valid when transferred into a prudentially regulated banking environment with tighter write-permission constraints?

Output

• Type: knowledge
• Description: An empirical research note arguing that the working category used here as systems capability debt is the dominant recurring driver of citizen development sprawl, quantifying adjacent operational-risk channels, and identifying tiered platform governance plus capability remediation as the most defensible regulated-bank response.
• Links:
  • Practitioner perceptions on Shadow IT and Business-managed IT
  • Prudential Regulation Authority (PRA) final notice to Standard Chartered
  • HEINEKEN customer story on Power Platform and Copilot Studio

sources

• [x] Operational Riskdata eXchange Association (ORX) research page — - checked as a seed source; returned 404 in this runtime and was not used for downstream claims.
• [x] Basel Committee on Banking Supervision, Principles for the Sound Management of Operational Risk (2011) — - checked as a seed source; accessible only as a raw PDF in this runtime and superseded in practice by newer, easier-to-audit Basel and Federal Reserve summaries for downstream claims.
• [x] Gartner citizen development topic page — - checked as a seed source; returned 403 in this runtime and was not used for downstream claims.
• [x] Forrester low-code and no-code research hub — - checked as a seed source; returned 404 in this runtime and was not used for downstream claims.
• [x] ISACA blog landing page — - checked as a seed source; accessible but too generic for precise downstream support in this item.
• [x] Microsoft Power Platform governance considerations — - seed governance page covering environments, licensing, roles, and governance themes.
• [x] Amazon Web Services (AWS) Bedrock security documentation — - seed documentation confirming shared-responsibility and governance expectations for Bedrock workloads.
• [x] RBNZ oversight of banks page — - checked as a seed source; returned 403 in this runtime and was replaced for contextual claims with accessible RBNZ materials found via search.
• [x] Office of the Privacy Commissioner, original seeded Privacy Act 2020 page — - checked as a seed source; returned 404 in this runtime and was replaced with current Privacy Act guidance pages.
• [x] PCI Security Standards Council Document Library — - seed source confirming current PCI-DSS v4.0.1 availability, although direct PDF access returned 403 in this runtime.
• [x] Practitioner perceptions on Shadow IT and Business-managed IT — - 29-chief-information-officer and senior-manager interview study quantifying perceived drivers and remediation patterns.
• [x] Causing factors, outcomes, and governance of Shadow IT and Business-managed IT — - systematic literature review of 107 studies on causes, outcomes, and governance.
• [x] Drivers and Inhibitors of Low Code Development Platform Adoption — - literature review showing adoption is driven by demand and talent scarcity but carries shadow IT and security risks.
• [x] [Practitioners' Perceptions on the Adoption of Low Code Development Platforms](Practitioners' Perceptions on the Adoption of Low Code Development Platforms — .html) - 17-expert empirical study on actual low-code development platform adoption drivers and inhibitors.
• [x] Adoption of low-code and no-code development: a systematic literature review and future research agenda — - 2025 review synthesising 40 primary studies on citizen development and Low-Code/No-Code (LCNC) adoption.
• [x] 2025 DevOps Research and Assessment (DORA) report overview — - AI amplifies existing weaknesses; platform quality and fast feedback loops are prerequisites.
• [x] 2025 DevOps Research and Assessment (DORA) AI Capabilities Model report landing page — - seven foundational capabilities; 90% platform adoption; 76% dedicated platform teams.
• [x] National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) Core — - govern, map, measure, and manage functions and risk-tolerance language.
• [x] National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) Playbook — - voluntary playbook for tailoring AI RMF actions by use case and context.
• [x] Amazon Web Services (AWS) Security Blog: Four security principles for agentic AI systems — - machine-speed autonomy, least privilege, and deterministic external controls.
• [x] Copilot Studio security and governance — - concrete tenant controls over knowledge sources, tools, channels, triggers, and environment routing.
• [x] Copilot Studio data loss prevention — - real-time policy enforcement over authentication, knowledge sources, tools, and HTTP requests.
• [x] Establish a Power Platform Center of Excellence (CoE) — - Microsoft governance pattern with measurable key results and use-case intake.
• [x] Manage Power Platform adoption at scale — - maturity model, roles, environment rules, and formalized request processes.
• [x] Power Platform CoE Starter Kit overview — - monitoring, orphaned-app detection, telemetry, and governance-tooling reference implementation.
• [x] HEINEKEN customer story on Power Platform and Copilot Studio — - public case with measured outcomes under an environment-tiering governance model.
• [x] International Business Machines (IBM): The true cost of poor data quality — - quantified annual loss ranges from poor data quality and explicit AI amplification risk.
• [x] Federal Reserve note on operational risk regulation — - operational losses at large banks, Advanced Measurement Approach (AMA) capital importance, and ORX consortium context.
• [x] Federal Deposit Insurance Corporation (FDIC) working paper, Financial Innovation and Risk: Evidence from Operational Losses at Large Banks — - supervisory dataset with 434,714 operational loss events and explicit link between innovation and higher operational losses.
• [x] Guardian summary of Standard Chartered Prudential Regulation Authority (PRA) fine — - accessible report of the spreadsheet-driven liquidity misreporting case and penalty.
• [x] Prudential Regulation Authority (PRA) final notice to Standard Chartered — - official enforcement notice with Line 49 spreadsheet details and penalty amount.
• [x] Citibank Revlon opinion, Southern District of New York — - official judicial record of the mistaken USD 893 million payment caused by human processing error in legacy workflows.
• [x] United States (US) Senate hearing record on JPMorgan's whale trades — - official record of the USD 6.2 billion loss, spreadsheet-heavy manual processes, and model-calculation defects.
• [x] JPMorgan whale-trades report mirror used for formula-detail verification — - secondary-access PDF used only to verify the published description of the spreadsheet averaging defect when the relevant appendix was difficult to pinpoint in the hearing record.
• [x] Office of the Privacy Commissioner fact sheet on Privacy Act 2020 changes — - notifiable privacy breaches, overseas disclosure, and enforcement changes.
• [x] Office of the Privacy Commissioner privacy principles page — - current guidance for storage, security, accuracy, and disclosure obligations.
• [x] Privacy Act 2020 on New Zealand Legislation — - official Act text.