Deactivation of legacy systems

• Home
• Risks
• Experience
• Contact

The handling of unused systems comes with inherent risks for both – Finance and IT. These stem from a multitude of legal requirements and retention periods that have to be complied with in everyday business processes. Non-compliance can lead to sanctions.

What will happen when a corporate auditor has announced a visit? As a rule it is the finance department that is expected to prepare for a smooth audit and to conduct same without any problems. Consequently, the head of finance is the designated contact of the auditor. If problems arise at the onset of the audit, the relationship between employee and auditor will be highly volatile in a worst case scenario.

If the auditor should decide to use the auditing method of indirect system access, the employees who possess the system know-how, i.e. the IT staff, will have to be available. If this is not the case, the company may possibly be compelled to commission external support for the duration of the audit. However, given that the duration of an audit is difficult to project in advance, this may in some cases result in significant expenses. Legacy systems regularly incur costs for maintenance and licenses, expert staff, etc., which can sometimes have a negative impact on the cost effectiveness of a company. Legacy systems can also influence the in-house management. In concrete terms this means: If a company is compelled to work with such data in the future, the requirements the legacy system has to meet in terms of functionalities, analytical options, dynamics and flexibility are much more exacting.

The responsibility to guarantee the availability of all three types of access for a time period of at least ten years is challenging indeed. Given that system manufacturers do terminate the maintenance services for legacy systems every now and then, a pertinent risk arises. You as the entrepreneur will also have to wonder whether the employees in charge who are familiar with the operation of the system will continue to work for your company for the duration of the retention mandate. After all, the operating documentation for older systems is frequently spotty, which complicates their operation and the assurance of GDPdU conformity.

Systems that have already been deactivated generate problems as well. If systems have been deactivated in the absence of the creation of equivalent qualitative and quantitative analysis options to those available for productive systems, you will not be in compliance with applicable laws and will have to anticipate the imposition of pertinent sanctions. Restarting a system that has been deactivated may sometimes come with inherent risks that are difficult to calculate.
One factor whose impact is sometimes underestimated is that legacy systems do have a sustained adverse impact on the IT budget due to the multi-year retention periods.