Even if software meets the functional requirements at hand, it may be rejected by users if, for example, it is cumbersome and not user-friendly. This can lead to users resorting to alternative forms of processing and misappropriating other IT systems or software for this purpose. For example, private IT systems can be used without consultation with the IT Operation Department. These alternative forms of processing are rarely considered from an information security perspective and thus pose an increased risk.