Engineering guides / Software consulting and technical discovery
By Arte Soft engineering · 24 October 2026
A legacy software audit before the next expensive change
Legacy software is often software that still earns its place but has become difficult to change. An audit should identify why: undocumented behavior, unsupported dependencies, fragile releases or a mismatch with the business. The useful result is a prioritized decision about what to repair, preserve or replace, supported by evidence rather than by the age of the code alone.
Begin with a working baseline
Request repository access, build instructions, environment information and a list of important workflows. Attempt a clean build before drawing conclusions from source files. Record missing dependencies, manual configuration and credentials that have no clear owner without exposing their values. Identify the actual production revision where possible. A local project with an old version label may not represent the released system. If the baseline cannot be reproduced, say so and make environment recovery a visible finding. This prevents the audit from offering confident recommendations about behavior that nobody has been able to observe reliably.
Follow the risky business paths
Choose representative operations that affect revenue, customer data or staff productivity. Trace their data changes, external calls and error recovery. Inspect the tests that protect those paths and distinguish meaningful coverage from tests that merely mirror implementation details. Review unsupported dependencies and privileged access in context. A package with a newer release is not automatically an urgent business risk, while an undocumented manual billing correction may deserve immediate attention. Each finding should explain the trigger, consequence and evidence. That structure lets product owners compare risks without needing to understand every internal class or dependency.
Produce a decision-ready risk register
Group recommendations into immediate containment, maintainability improvements and longer-term structural choices. Include effort ranges only with stated assumptions and identify findings that require deeper investigation. Deliver reproduction steps, affected areas and a suggested acceptance check for the most important changes. Acceptance for the audit is a shared understanding of the top risks and a practical next increment, not proof that the whole codebase is free from defects. If a full security assessment or compliance review is needed, name it as separate work instead of implying that a general audit has already supplied that assurance.
Preserve findings that turn out to be false alarms with their supporting evidence. They can prevent the next maintainer from repeating the same investigation and help distinguish a deliberate older implementation from a genuinely unsupported or dangerous dependency.
Avoid making replacement the default answer
A rewrite must recover business rules and migrate users as well as recreate screens. Small targeted repairs may produce more value while preserving reliable behavior. Conversely, a component can be expensive enough to maintain that replacement is sensible. Arte Soft’s own ongoing product portfolio provides a practical maintenance perspective, not an invented client turnaround story. Bring the next change you want to make and the failures you are worried about. We can scope an audit around that decision and return a defensible sequence of actions rather than a generic judgment that old software is bad.
Relevant Arte Soft work
Cloud Calendars — our own product is our own product or engineering project. It provides context for the work we discuss here; it is not a claim of identical results for every client deployment.
Sources and further reading
Need help with Legacy application assessment?
Send the current app, system or brief, the behaviour you need and your constraints. We can agree a discovery, implementation or repair scope with concrete acceptance criteria.
Discuss this with Arte Soft