Replacing a critical legacy system without taking it offline
Modernization fails when it treats the old system as something to switch off on a Friday. The real constraint is that the service it runs cannot stop.
Delivery Practice
A legacy system is rarely hard to replace because it is old. It is hard to replace because it is load-bearing. Real people depend on it right now: a payment is clearing, a record is being looked up, a citizen or a customer is waiting on the other end. The replacement does not get a window where the service stops.
Design for the day the old system is still running
The most expensive mistake in modernization is the big-bang cutover: build the replacement in private, switch traffic over a weekend, and discover the edge cases live, with no way back. We design instead for a long period where both systems coexist and the new one earns trust before it carries weight.
- Keep the existing service fully operational throughout. Nothing about the rollout depends on turning it off first.
- Move work onto the new system in slices, starting where the risk is lowest and the relief is highest, while records still flow through familiar pipes.
- Run the new and old paths in parallel and compare their output before the new one becomes the source of truth.
- Keep a fast, rehearsed path back. A rollout you cannot reverse is a rollout you should not start.
Retire the workflow, not just the interface
A new front end on the old workflow is theater. The point of replacing a legacy system is to retire the process it encoded: the retyping, the workarounds, the steps that existed only because the software demanded them. The new system should let the institution do less, not the same amount in a nicer font.
If the replacement requires the service to stop for a weekend, it is not a replacement. It is a gamble.
Record the decisions
Modernization programs outlast the people who start them. Every meaningful architectural choice is captured as a decision record, so the team in year three understands why year one chose what it did. The migration is not finished when the new system is live; it is finished when the old one can be switched off without anyone holding their breath.