Assess the application portfolio to determine whether and when to migrate. The really good news about legacy systems, even very high value and high risk ones, is that their value and risk can be reliably estimated years in advance. Such estimates can be used to determine whether and when a strong business case will exist for migration of a given system.

To start the process of evaluating your legacy assets, first you have to know as much about them as possible — what their financial and contractual terms are, what technologies they run on, how many of them there are. The most valuable tool to aid in this process is the IT asset management (ITAM) repository. An ITAM repository tracks and cross-references procurement, contracts, inventory, maintenance, entitlement management and retirement information for the software and hardware that a company owns. This makes it easier to understand the full scope of assets involved in changes to the IT environment. The ability to cross-reference assets is especially useful when estimating costs for migration.

With a solid list of assets in place, the next step is to deduce today's business risks. In this context, a "business risk" is the likelihood and potential business impact of a specific application failure, from the inability to support business requirements to a catastrophic shutdown of the business process.

In general, business risks that heavily constrain the business model — such as, inability to support new business initiatives or potential for a catastrophic system failure — should be weighted most heavily. Once these risks are understood, now model how they will change in the future. Will each of them become more likely or more impactful, or less — and why? A reasonable timeline is to look outward for the next five years.

But when it comes to legacy assets, business risk is only half the story. The other half is business value. Calculating business value for a legacy asset needs to match the asset to the business in a repeatable way. The best way to do this is to take a process by process approach that looks at the business value delivered by each of a business's key processes and then apportions this value to the application or applications that supports it. By way of a guide, think of a business process, as opposed to a function, as something that generally starts and ends with a customer. Once these values have been determined for today, project out how these values will change into the future.

Now it is possible to overlay the value and risk of a given application both today and into the future. This allows the CIO to pinpoint the time when its business risk will seriously impact the value of the business processes it supports, and why. The resulting map of value and risk shows when and why the business must plan to migrate from its legacy systems. This also gives the CIO an idea of how much time remains in which to plan and execute migration or reduce the risk to acceptable levels.

Understanding value and risk over time are key elements of building the business case for migration, but the business case can't be completed until the CIO knows how to migrate a particular system.