Why You Need an Approval Workflow for Every New SaaS Request

Shadow IT doesn't usually happen because employees want to circumvent IT — it happens because the official channel is too slow, too opaque, or too burdensome. If your software approval process takes three weeks and requires six sign-offs, people will find ways around it. The solution isn't to remove the process; it's to make the process fast enough that it's not worth bypassing.

What a Good Approval Workflow Looks Like

A well-designed SaaS approval workflow captures the minimum information needed to assess risk and cost, routes the request to the right reviewers, and returns a decision within a defined SLA. For most tools, that should be 48–72 hours. For low-risk free-tier tools, it can be same-day.

The Intake Form

Your request form should collect: the tool name and URL, the business use case, the proposed number of users, the annual cost and billing method, the data types it will process, and whether an SSO integration is available. This gives reviewers everything they need without requiring the requester to undergo an interview.

Risk-Based Routing

Not every request needs the same review. A free-tier browser extension that processes only public data needs a lightweight security check. A tool that will process customer PII needs legal and compliance review. Build risk tiers into your workflow and route accordingly — this speeds up the low-risk cases without creating shortcuts on high-risk ones.

The Software Catalogue: Pre-Approving Common Tools

The most efficient approval outcome is no approval at all — because the tool is already pre-approved and available in a self-service catalogue. A software catalogue lists tools that have passed IT and security review and can be adopted immediately by any employee without a separate approval process. For tools in the catalogue, onboarding typically takes minutes: the employee submits a request, IT provisions the licence, and the tool is accessible by end of day.

Build the catalogue by starting with your most-requested tools — the ones that generate the highest volume of approval requests — and fast-tracking them through a one-time review. Most common productivity, collaboration, and development tools are straightforward to approve; getting them into the catalogue removes the recurring overhead of reviewing the same tools over and over. Aim for a catalogue covering 60–70% of all software requests within six months of launch.

Measuring Process Health

An approval workflow is only effective if it's actually being used. Track the submission volume (how many requests come through the formal process versus the total number of new tools discovered), the mean time to decision (how long requests sit in the queue), and the approval rate (what percentage of requests are approved, rejected, or redirected). A low submission rate relative to discovery volume suggests the process is being bypassed. A high mean time to decision suggests bottlenecks that need to be addressed before they drive employees to go around the process.

Survey employees quarterly about their experience with the software request process. The feedback will tell you what the metrics alone won't: whether the process feels fair, whether the turnaround time feels reasonable, and whether the outcomes make sense. Employee perception of the process is as important as its technical efficiency — a process that's fast but feels arbitrary won't drive compliance the way a slightly slower but transparent process will.

Connecting Approvals to Cost Visibility

Every approved software request should flow directly into your software inventory and cost tracking system — not sit in a separate approval tool that's disconnected from your ITAM platform. When an approval is granted, the tool should appear in the inventory with its cost, its business owner, its approval date, and its next review date pre-populated. This connection between the approval workflow and the asset management system is what allows you to answer the question "how did this tool end up in our stack?" years later, without digging through email archives.