Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "

Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "shadow IT" will depend on who you ask. Personally I have never deployed something to prod that way (I did it for some lower envs), but it's something I've seen people do at every single place I've worked. And your last paragraph is 100% true in my experience.