Luis Javier Caño
Great question.
And a challenge more common than many teams would like to admit.
When transitioning from informal or undocumented legacy processes to structured digital solutions, it's not unusual for latent risks to surface.
hese are often long-known, quietly tolerated, and never formally tracked.
Once exposed under a more rigorous governance approach, they can create noise and threaten delivery - not because they are new, but because they were previously unmanaged.
Here’s how I typically approach legacy or inherited risks, based on best practices from frameworks like the PMBOK® Guide, ISO 31000, and real-world experience in organizational change:
1. Reframe It as a Transitional Risk, Not a Failure
The fact that the current team surfaced this risk is a positive indicator of risk maturity.
Avoid framing it as “something missed” - instead, treat it as part of the natural learning curve during transformation.
This builds psychological safety and trust within the team.
2. Classify and Document Transparently
Even if undocumented, the risk must now be formalized:
-Add it to the current risk register, tagged as "legacy/inherited"
- Identify origin, potential impact, and explain why it wasn't mitigated before
- Include it under the appropriate risk category (e.g., process, compliance, operational)
This aligns with PMBOK® risk categorization and ISO 31000’s emphasis on traceability and context.
3. Engage Stakeholders with Neutral Framing
Legacy risks often involve political or emotional undercurrents.
Position your communication carefully:
- Emphasize that this is about ensuring continuity, not assigning blame
- Create a shared ownership model for assessing and addressing it
- Use “humble inquiry” (Schein) when discussing causes with previous process owners
4. Evaluate and Decide Collectively
Facilitate a quick impact/probability analysis:
- Is this a high-impact risk?
- Can it be accepted, transferred, mitigated, or avoided?
- Does it require escalation or executive attention?
In a recent ERP migration I led, a legacy tax configuration caused similar noise.
By classifying it as a technical debt risk, engaging finance leaders, and mapping scenarios, we absorbed and mitigated it collaboratively.
5. Integrate It into the Transition and Change Plan
Legacy risks should be explicitly tracked as part of the transition roadmap.
This shows stakeholders that you're managing not just the digital system, but also the organizational learning debt - a subtle but critical factor in successful transformation.
Final Thought
Legacy risks are not signs of poor planning - they’re signs of evolving awareness.
How we handle them reflects the maturity of our risk culture.
Would love to hear how others integrate legacy risks into their risk registers, especially when there's no formal documentation behind them.
