Executive Briefing · Boards

Board Guide to Legacy-System Risk

Legacy technology is not automatically bad technology. The board risk appears when critical capability becomes difficult to secure, recover, understand, integrate or change.

Questions leaders should ask

  1. 1.Which critical processes depend on unsupported or poorly understood technology?
  2. 2.Can the organisation restore the service from tested backups?
  3. 3.Where does key-person knowledge create operational concentration risk?
  4. 4.Which interfaces, batch jobs or workarounds would break during replacement?
  5. 5.What is the cost and risk of keeping the system versus modernising it?
  6. 6.Is a full replacement actually necessary, or can risk be reduced incrementally?

Practical next actions

  • • Map critical dependencies before choosing a replacement.
  • • Stabilise backup, access and observability weaknesses first where practical.
  • • Create controlled seams/APIs around legacy behaviour.
  • • Modernise bounded capabilities incrementally.
  • • Define measurable decommissioning and rollback criteria.

This briefing is general decision-support material, not legal, regulatory, financial or investment advice. Apply sector-specific obligations and evidence before acting.

All executive briefings