Businesses allowing employees without programming backgrounds to develop their own applications must retain oversight to prevent security risks and potential misuse of sensitive information, according to software company Kissflow.
In an exclusive interview with PhilSTAR Tech, Kissflow vice president for Asia-Pacific Rakesh Nandakumar and Philippines country director Michael Pagsisihan discussed the need for stronger governance as businesses allow employees to develop their own applications.
Nandakumar said companies should not expect so-called citizen developers to fully understand the security and legal implications of the applications they create.
“You shouldn’t expect citizen developers to assess security as such because that is not their core competence,” Nandakumar said.
Nandakumar said responsibility for security should instead fall on a company’s Center of Excellence (COE), which may be managed by its chief information officer, digital transformation team or process excellence team.
The COE should determine which applications employees can develop and how much control they should have over the process.
Pagsisihan said security safeguards should be established before employees begin building applications.
“IT will always define what can and cannot be touched, what integrations are available, what the business user can and cannot do,” Pagsisihan said.
He likened the approach to road safety, where lanes, speed limits and other regulations help prevent accidents rather than relying entirely on individual drivers.
Nandakumar said companies could also adopt application zoning, which classifies proposed applications into four categories: full, limited, restricted and prohibited citizen development.
It allows organizations to review potential risks, particularly when applications involve personal information.
“In citizen development model, we are ready to relax control of the build, but I don’t think the organization should be ready to relax the control of the outcomes,” Nandakumar said.
Balancing security and faster digital transformation
Nandakumar acknowledged that excessive restrictions could undermine the purpose of citizen development, particularly for companies seeking to accelerate digital transformation.
However, he said businesses should address this by allocating sufficient personnel to application development and oversight rather than weakening governance standards.
He explained that companies must assess how much of their operations remain undigitized, how quickly they want to close that gap and whether they have enough personnel to support their targets.
For organizations seeking to accelerate development, this could mean increasing both the number of employees building applications and the personnel responsible for reviewing them.
Nandakumar said governance requirements should also reflect each organization’s operational needs and internal culture, as there is no single approach suitable for every business.
He added that citizen development requires organizational changes alongside the adoption of new technology.
Pagsisihan also pointed to the competing demands facing IT departments as Philippine businesses pursue digital transformation.
He said some organizations continue to rely on legacy applications that require modernization, even as business units seek new automation solutions.
According to Pagsisihan, companies must balance these demands while ensuring that business users and IT teams work together in developing and managing applications.
He added that the next phase of digital transformation would depend on each industry’s technological maturity, with some businesses still focused on digitizing basic processes while others move toward integrating systems and autonomous operations.
Founded in 2012, Kissflow provides low-code and no-code software that allows businesses to develop applications, automate workflows and manage internal processes with minimal programming.
Its platform enables employees outside IT departments to build applications while allowing organizations to maintain oversight.
