Why legacy systems are a balance-sheet question rather than an engineering one, what an honest costing of technology debt contains, how build, buy or rent decisions commit the institution for years, and how a CIO sequences retirement at the pace the institution can afford.
In short
- The legacy question is whether the institution can afford to keep what it runs on, whether it can afford to replace it, and in what order — a balance-sheet question that only looks like an engineering one.
- An honest costing counts what the estate costs to run, what it prevents the institution from doing, what it exposes the institution to, and what it would cost to leave — the last two are the lines most often missing.
- Build, buy or rent are not procurement choices. Each is a balance-sheet commitment the institution lives with for years, and concentration in a few providers is a commitment of its own.
- Legacy is deferred politely because costing it honestly means asking for money and admitting exposure. Deferral does not lower the cost; it moves it to a day the institution does not choose.
- Retirement is sequenced, not announced: by exposure first, then by what the estate blocks, at the pace the balance sheet can carry, with the board told the order and the reason.
On this page
What the legacy question is#
The legacy question is whether the institution can afford to keep what it runs on, whether it can afford to replace it, and in what order. It is asked about systems, which is why it is usually handed to engineers, but it is a balance-sheet question: every answer commits capital, accepts exposure or forgoes capability, and the person who must sign for those is not an engineer.
Most institutions have a legacy estate they cannot afford to keep and cannot afford to replace. That is not a failure; it is the ordinary condition of any institution that has been open long enough to depend on technology. The failure is in how the question is handled: deferred politely, year after year, because costing it honestly means asking for money and admitting exposure.
Why it is deferred#
Deferral is rational for everyone in the room and disastrous for the institution. The CIO who costs the legacy honestly is asking for a sum that competes with growth and transformation, and is admitting that the estate carries exposure the board did not know about. The CFO would rather not fund it this year. The board would rather not hear it. So the item stays out of the plan, and the estate keeps running, until it does not.
Deferral does not lower the cost; it moves it to a day the institution does not choose. The estate that is retired on a plan is paid for in instalments the balance sheet can carry. The estate that fails is paid for all at once, in the worst week, with the regulator and the press in the room.
Deferral does not lower the cost; it moves it to a day the institution does not choose.
What an honest costing contains#
An honest costing of the legacy estate has four lines, and most costings stop after the first.
- What it costs to run: licences, hardware, the people who still know how it works, and the premium the institution pays because fewer of them exist each year.
- What it prevents: the products the institution cannot launch, the changes it cannot make, the data it cannot get out, and the speed it cannot reach — costed as the value of what is foregone, not left as an adjective.
- What it exposes: the security that cannot be patched, the concentration in a provider who may stop supporting it, and the day it stops — stated as what the board is being asked to accept.
- What it would cost to leave: the migration, the parallel running, the retraining and the risk of the transition itself, sequenced over the years the balance sheet can carry.
The second and third lines are the ones most often missing, and they are the ones that change the decision. An estate that is cheap to run and expensive in what it prevents is not cheap. An estate whose exposure has never been stated to the board has never been accepted by the board, whatever the minutes say.
Build, buy or rent, read as balance-sheet commitments#
Every legacy estate was once a build, buy or rent decision, and every replacement will be one too. The mistake is treating these as procurement choices judged on price and features. Each is a commitment the institution lives with for years: to build is to commit to keeping the skills; to buy is to commit to a provider’s roadmap and its survival; to rent is to commit to a dependency the institution does not control and, where much of the estate rents from the same few providers, to a concentration that is a risk of its own.
Read this way, the decision belongs at the top table, with the CFO who signs the balance sheet and the COO whose operations will run on it, not in a procurement committee. The CIO’s job is to bring it there in those terms.
Retiring the estate deliberately#
Retirement is sequenced, not announced. The order is set by exposure first — what the institution cannot afford to have fail — then by what the estate blocks, then by cost to run. The pace is set by what the balance sheet can carry each year without starving growth and transformation, and by what the operation can absorb without breaking. The board is told the order and the reason, and is told each year what moved and what did not.
A deliberate retirement also names what will not be replaced. Some of the estate should simply be switched off, and a CIO who can say so has done the institution a service that a modernisation programme rarely does.
What to do next#
Take the single most exposed component of the estate and cost it on all four lines, in the board’s terms, on one page. If the exposure line has never been shown to the board, show it. The CIO Mandate works this exact exercise — the legacy question costed honestly rather than deferred politely — with technology leaders who must carry the answer to the top table.
Frequently asked
What is technology debt?
Technology debt is the accumulated cost of decisions that were cheaper at the time than they are now: systems kept past the point where they should have been retired, shortcuts never repaid, and dependencies never reviewed. It is a balance-sheet concept in all but name — a liability that accrues interest in the form of running cost, foregone capability and exposure until it is paid down on a plan or paid all at once in a failure.
How should a CIO cost legacy systems for the board?
On four lines: what the estate costs to run, what it prevents the institution from doing, what it exposes the institution to, and what it would cost to leave. Most costings stop after the first line. The second and third are the ones that change the decision, and the third — exposure — is the one the board has never accepted if it has never been stated.
Should an institution build, buy or rent its technology?
There is no general answer, because the question is not about price or features but about which commitment the institution is prepared to live with for years. Building commits it to keeping the skills; buying to a provider’s roadmap and survival; renting to a dependency it does not control, and to concentration risk where much of the estate rents from the same few providers. The decision belongs at the top table in those terms.
In what order should legacy systems be retired?
By exposure first — what the institution cannot afford to have fail — then by what the estate blocks, then by cost to run. The pace is set by what the balance sheet can carry each year without starving growth and transformation, and by what the operation can absorb. The board should be told the order and the reason, and some of the estate should simply be switched off rather than replaced.
The programme behind this article
Work through this material with the practitioners who wrote it.
The CIO Mandate: Technology as Institutional Strategy
For CIOs, CTOs and chief digital officers — the technology estate as a board matter: investment, AI, cyber accountability and the legacy question.
View the programme →The CFO Agenda: Finance Leadership at the Top Table
For sitting and incoming CFOs — capital allocation, the numbers as one defensible narrative, the board relationship and the finance function itself.
View the programme →The COO: Operations at Scale
The widest seat in the house — running today’s operations while building tomorrow’s, for COOs and operations executives with an enterprise remit.
View the programme →