The custodians of a legacy system describe it as so fragile and tangled that any change could cause catastrophe, and modernization stalls on risks nobody else can check.
An example
With budget approved, the chief digital officer of a mobile carrier set out to replace a billing platform that was twenty-two years old. At each steering meeting the platform team brought a new warning. Half the rating logic lived in batch jobs written by an engineer who had retired. There were four hundred undocumented edge cases. One bad invoice run could reach three million subscribers before anyone caught it and bring the regulator in. The team never produced the list of edge cases or a dependency map, and requests for one were met with an estimate of how long it would take to write. The chief financial officer, who would answer for an outage and get little credit for a new system, asked to revisit it next year. The replacement was deferred twice, and the platform team's headcount was renewed.
Why it works
Doing nothing becomes the responsible position. A decision-maker can back the status quo without defending the old system, which is much easier than defending it. The custodians plant doubt that the replacement will deliver, and they load every change with vivid, unlikely, high-consequence failures that a non-technical executive cannot assess, so fear of loss does the rest. Four things keep it alive: custodians who are the only credible voice on risk, thin documentation, a decision-maker who carries the blame for outages and none of the credit for modernizing, and no outside audit so far.
The thinking behind it
Daniel Kahneman Kahneman and Tversky's Judgment under Uncertainty (1974) describes availability, judging probability by how easily examples come to mind. Vivid scenarios such as a billing outage, a regulator's letter, or a weekend war room are easy to imagine, so they feel likely, and loss aversion from Prospect Theory (1979) makes the possible loss weigh more than the promised gain. A written risk register and small incremental tests replace imagined catastrophes with measured ones.
George A. Akerlof Akerlof's The Market for "Lemons" (1970) shows how an information gap gives power to whoever knows what the other side cannot check. Custodians who are the only people able to speak to a system's risk set the terms of the decision. An independent assessor with comparable technical credibility closes the gap, and most catastrophe claims cannot survive being defended on specifics.
William Samuelson Samuelson and Zeckhauser's Status Quo Bias in Decision Making (1988) found that people choose an option disproportionately often when it is framed as the current state, which the authors attribute to transition costs, loss aversion, and commitment to past choices. Keeping an old system is the status quo, so it wins ties. Designing the change as a series of small steps shrinks each departure from the status quo and weakens that advantage.
Warning signs
Risk warnings never come with a written dependency map or a failure scenario anyone could test. Documentation is thin and stays thin. Counts of undocumented cases are cited but never listed. Each warning names a dramatic consequence: a weekend war room, a regulator, a billing outage. Every proposal is framed as a single big switch. The people warning are the only ones who can confirm or refute the warning.
How to defend yourself
Break the information monopoly and the all-or-nothing framing.
- Bring in an independent technical assessor with comparable credibility. Most catastrophe claims cannot survive being defended on specifics.
- Ask for a written risk register with each risk stated so it can be tested, and review it each quarter.
- Design the change in increments: a parallel run, replacing one function at a time, switching features over behind flags. Each step tests a claimed catastrophe on a small scale.
- Ask for the specific failure scenario behind each warning, and fund a test of it.
- Pay for documentation as a deliverable in its own right.
How a leader shuts it down
Fix the incentive that makes caution free. If an executive carries all the blame for outages and no credit for modernization, the custodians' warnings will always win. Commission periodic outside reviews of critical systems, fund documentation as its own work, and make incremental migration the default design for any replacement. Ask whose headcount depends on the system staying.