Cost of keeping legacy systems for record retention: a CFO view

What does it really cost to keep a legacy system for retention?#

Keeping a legacy system for retention costs the full price of running an application, even though the business only needs the records inside it. The line items sit in different budgets, which is why the total rarely reaches the CFO in one view.

Typical lines include the vendor's support contract, sometimes at extended-support pricing; the server or cloud instance with its operating system, database licenses and backups; the time of the one or two people who still know how to run its reports; and security work on software that may no longer receive patches. Each audit request, subpoena or customer dispute adds retrieval hours on top.

Which retention rules actually need the old system?#

Few retention rules need the old system itself; most need the records and the ability to produce them in usable form. The real question for the CFO and counsel is whether an export preserves what an auditor, regulator or court would ask to see.

Tax rules are the usual anchor. The IRS says to keep records supporting income, deductions or credits until the limitations period for that return runs out: generally 3 years, 6 years if unreported income exceeds 25% of the gross income shown, and 7 years for a loss from worthless securities or a bad debt deduction. It says to keep employment tax records for at least 4 years, and property records until the limitations period ends for the year the property is disposed of.

For electronic accounting data, Rev. Proc. 98-25 treats machine-sensible records in an automated data processing system as records that must be kept while their contents may become material to tax administration. It also lets a taxpayer request a Record Retention Limitation Agreement with the IRS to narrow which electronic records must be kept, and it requires prompt notice if such records are lost or destroyed.

• 1Which tax years are still open, and which ERP or accounting tables support them?
• 2Are any records under a litigation hold or tied to a pending dispute?
• 3Do customer, vendor or employee agreements require deletion or return of data when a relationship ends?
• 4Do warranty, safety or industry rules require longer retention for specific record types?
• 5Does the export keep the fields an auditor needs to rebuild a transaction from source document to ledger?

The cloud subscription deletion clock#

Cancelling a cloud subscription starts the vendor's deletion clock, and for retired SaaS tools that clock, not the retention schedule, often sets the real deadline. Many finance teams discover this only after notice has gone out.

The windows differ by vendor and plan. Freshworks partner support says Freshdesk permanently deletes the account and its data 14 days after the subscription end date, and advises exporting first because an export can take up to 10 business days. Microsoft's Trust Center says that when a cloud subscription ends, Microsoft keeps customer data in a limited-function account for 90 days so the customer can export it or renew. Atlassian says data from a deactivated paid cloud site is retained for 60 days before permanent deletion.

Check your own plan, order form and the vendor's current documentation, because terms change. Budget the export as a project with an owner and a validation step, and give notice only after the archive is verified.

Keep, archive or license: a decision table for CFOs#

The keep, archive or license decision usually follows from a few facts about the records, and the table gives a starting rule for each situation. Counsel and IT should confirm the facts before a rule is applied.

How to present the cost case to the board#

A board-ready cost case compares the annual run cost of keeping the system with the one-time cost of exporting, validating and indexing its records, plus the smaller ongoing cost of the archive. Put security exposure in the risk section rather than the budget lines, since it rarely has a clean figure.

Treat licensing as an option, not a forecast. Value is known only once a buyer engages, so the decommissioning decision should stand on retention and cost alone. If the archive later supports a license, that income is upside on a decision already justified.

Name owners for each part. Finance owns open tax years and the budget, IT owns the export and its validation, and counsel owns holds and contractual deletion duties. A decision missing any of the three tends to stall at the last server.

Illustrative: a distributor retires its old ERP#

Illustrative: a fictional regional industrial distributor moved live operations to NetSuite but kept its old on-premise ERP running on a server in the warehouse office. The old system held general ledger detail, order history and years of service exception notes, alongside a separate legacy helpdesk with customer complaint tickets.

The CFO's review found three costs that had never been added together: a vendor support contract, an aging server that no longer received operating system updates, and one administrator nearing retirement who knew how to run the old reports. Counsel confirmed there were no active legal holds, and the outside accountant listed which tax years were still open.

The company exported ledger, order, exception and ticket records to a read-only archive with an index, validated sample transactions against the old reports, and switched the server off. Later it ran a metadata-only fit check on the order exception history. The archive meets retention needs either way; any license would use a separately prepared copy with customer details removed.

Where SourceX fits in a system retirement#

SourceX fits after the retention decision, not before it. In the Supply step of the SourceX five-step transaction, the record families in a retired system are inventoried from metadata, and nothing is shared during that initial assessment.

If a package proceeds through Rights and Preparation, personal and confidential details are removed from the licensed copy while your retention copy stays untouched. Large datasets stay in your own storage or ship on encrypted drives, and SourceX never hosts multi-TB datasets. The SourceX Evidence Packet then records what was licensed, from which archive, and under whose approval.