“Citizen developer” typically means a business person outside of IT who uses one of many low code/no code (LCNC) tools to create a new software feature or application. Most citizen developers today are solving tactical problems—automating calculations, creating dashboards, or simplifying a manual process. The efficiency benefits are clear: Employees can do their work faster, while reducing the backlog of demands on resource-strapped IT departments.

“If you can give the person in the business who's closest to the problem, or to the opportunity, access to tools and technology to solve that problem themselves in a controlled way, that's going to create a whole different culture of innovation,” says Sam Sibley, global head of the Citizen Developer program for Project Management Institute (PMI). “It completely changes the game for any company, no matter what size.”

Most companies have some employees who are itching to add a new capability or who need a new app but may not be a top priority for the IT department, says Isaac Sacolick, president of consultancy StarCIO and author of Digital Trailblazer: Essential Lessons to Jumpstart Transformation and Accelerate Your Technology Leadership. These are the workers most likely to turn into citizen developers.

This method has become even more important in light of software engineer and developer shortages that won’t go away anytime soon. The global shortage of software engineers may reach 85.2 million by 2030, the U.S. Department of Labor estimates. To survive this gap, it seems companies have no choice but to widen the aperture of who does development. Gartner believes that 80% of new technology innovation will be done by businesspeople by 2024; one Microsoft executive has estimated that 450 million apps will be built using low-code tools in the next five years.

So, if citizen development offers such massive potential for innovation, what's the catch?

The catch is that it might tempt your employees to start recoding or building everything they can dream up, without the controls and processes that have long guided software development. While that might help shrink the line in front of IT’s door in the short run, it invites chaos in the long run. Ungoverned applications can create all sorts of risks, from duplicated data to broken integrations to hidden security holes.

It’s a paradox: To avoid getting burned by letting businesspeople run free to code on their own, you have to be willing to give back some—though not all—of the speed and flexibility that was citizen development's initial lure. CIOs and business leaders need to put the right support and guardrails in place to get the goods from citizen developers, without suffering the bad. Businesspeople who are solving problems with code require training, support, and controls.

Balancing flexibility and governance is a challenge CIOs have confronted for a long time, isn’t it? Here's the inside information on striking that balance in the realm of citizen development to make their work successful.

Low code vs. no code: Vive la différence!

To determine the right balance of controls you’ll need, the first step is understanding the implications of low code compared to no code.

No-code tools, as the name implies, do not require technical knowledge such as how to create an SQL query. In many cases, they are largely collections of templates for already-defined functionality. No-code functionality is often built into another business application, for example, and offered through a drop-down menu in a spreadsheet or dashboard options in a business intelligence tool. Often, these functions are used to automate repetitive tasks such as logging new candidates into a recruiting system, performing common calculations, or updating project trackers. No-code products will continue to add new capabilities and grow as stand-alone programming options, but that is the current state of much no-code work.

HR is a business function often cited for adopting no-code tools. At New York interior design firm F. Schumacher & Co., for example, HR recruiters use a no-code tool rather than wait for IT to make changes to the Web site. They can directly edit sections and arrange pre-made layouts, as described in an SHRM.com article. Similarly, marketers in many companies use no-code tools to create landing pages on the Web for digital marketing campaigns.

As such, no-code tools are useful—but not likely to drive big breakthroughs.

Low-code tools, on the other hand, offer more power, flexibility, and connectivity. As a result, low-code tools are much more likely to yield real innovation in the near term. But they also demand a higher degree of technical savvy from their users. They offer much of the same visual modeling and drag-and-drop functionality as their no-code cousins, but often require some facility with HTML, SQL, or a more robust language such as JavaScript, to build a more customized application or more powerful features.

With hundreds of low-code tools on the market, the usability of all is not created equal. Sacolick says he uses a “three-hour” benchmark: “If I can't figure it out and do something productive in it in a few hours, it's going to create more problems than it solves.” He notes that it’s common for citizen developers to hit a sticking point and need help from IT to complete a project.

Low-code tools can be powerful and sometimes specifically target IT developers, helping them deliver applications faster by automating parts of their work. In banking and financial services, for example, developers have used low-code tools to do things such as verify users of a banking app and reduce member-onboarding time.

The demands and risks of using low-code tools

So, what happens when you give your line-of-business folks low-code tools? Totally getting out of the way is not a good option. Low-code is still a form of coding, and coding has complexity and risks. Experts cite potential negatives from citizen development gone awry, including app proliferation, governance policies ignored, accidental data exposure, unplanned drain on IT resources, or even business systems knocked over.

Preventing those results takes some work. Most of the same governance, security, quality, and testing practices that govern the IT development team—the whole Software Development Lifecycle methodology, in short—need to cover citizen developers, too.

CIOs are right to wonder how they will protect their data and systems, says Sacolick. “How do I prevent hundreds of these things running around and exposing our data? How do I make sure we're not proliferating data in places we're not supposed to? What if somebody creates a form and is asking for Social Security numbers? How do I prevent that from happening?”

On top of the obvious security risks posed by increasing the number of people who can interact with back-end systems, citizen development has the potential to vastly increase complexity. In 2021, U.S. employees already toggled among an average of 13 apps 30 times per day, according to an Asana survey.

That’s ridiculous, says John Michelsen, CEO of Krista Software. “I don't know a single line-of-business leader whose goal is to get more apps on people’s desktops.”

Additional risks develop as applications and application development projects grow in numbers and scope. LexisNexis Legal & Professional found its early low-code apps didn’t scale well; while at Nutanix, automation efforts were hampered by enthusiastic adoption of too many low-code tools that didn’t play well together, IT leaders told CIO.com.

Making it work

Sacolick advises creating a Center of Excellence (CoE)—a common strategy for building organizational skills in a particular area that doesn't fit neatly into the traditional org chart—to help guide and support citizen developers, including the following:

• Hands-on support. People will get stuck when they start developing, so it’s important to create connections to the developers so they can get help when they need it.
• Clear rules where absolutely required. The specific details for governance and data-usage will be highly organization-specific, warns Sacolick. “Every company is different. So, a healthcare company that is highly regulated, for example, might say citizen developers are not to touch patient information. But if you're not touching patient information, go ahead and use this platform.”
• A set of best practices for other development work. Beyond those regulatory requirements or other business-critical rules, Sacolick says CoEs should not aim to provide oversight per se—that can be too controlling—but should provide a framework of best practices instead. For example, if an employee wants to work on the customer record within a CRM system, the CoE might provide a model for when and how to create custom fields. “Otherwise, someone might go create 150 different fields, because every department needs its own taxonomy—not a good idea,” he says. The CoE could also provide guidelines for colors and methods of presenting data to maintain usability standards for the whole organization.
• Training on how to get the most out of the tools. LCNC tools are designed from the ground up to be used by “regular” business folk, but that doesn’t mean training can go by the wayside. In fact, much training may be required, particularly to get citizen development work up and running, especially when working in low-code mode. This requirement is not to be overlooked. Michelsen examined job postings that mentioned LCNC technologies and found it takes an average of 101 days of training, mentoring, or upgrading the skills of citizen developers to overcome the skills-gap problem. “Just go to your favorite job posting board and look at the requirements of low-/no-code platform jobs. You’ll see they require five years of Java and three years of SQL experience! What’s the difference between those postings and typical IT developer postings?” Michelson wrote in a column on VentureBeat.

A bigger IT army

The risks are many and the promise of citizen developers leading breakthrough innovations due to their familiarity with the business data seems to be largely aspirational. Still, there is reason to believe the trend will only increase.

Sacolick sums up the appeal of citizen development: “I've never talked to a CIO who says, I have exactly the number of people and the number of teams I need to do everything everybody's asking me to do. So, when I use no-code, I'm expanding the walls of IT.”

“Then it's not just my IT team of 1,000 people, I've got another 9,000 people I can tap into part-time, who might be able to build apps better than we can, because they understand the workflow and they understand the data,” he says.

Yes, you will have to put in place a similar framework for citizen developers as you would for your regular developers—along with a generous serving of support and training. But that is what’s required to move beyond today’s efficiency gains and to safely allow more innovative work.