Almost every small company has a custom-built application. It was commissioned eight or ten years ago, it solved a real problem and it still works. It was built by a small firm that changed hands, or by an IT specialist who went out on their own, or by an employee who has since left. Nobody has touched it since because nobody needed to, and that is precisely the problem.

It is worth saying without drama. An old application that does its job is not a management failure, it is an investment that paid off. What has failed is not the program. It is that the relationship keeping it alive ended without anyone putting it in writing. The day something has to change, or be integrated with something else, or a security flaw has to be fixed, the company will discover it holds neither the source code, nor the documentation, nor anyone to call.

The risk is not theoretical and it takes three concrete forms. The first is paralysis, when a change in the law or at a bank forces a change in the program and there is nobody to make it. The second is security, because every application rests on third-party components that age and accumulate known flaws nobody is fixing. The third is the client who asks, more and more often, who maintains the software that handles their data.

Custom software does not break. It is orphaned, and that only shows on the day it has to change.

What to sign before commissioning

None of these clauses makes a project more expensive, but they have to be asked for before the first invoice. Afterwards they are no longer negotiable.

  1. Ownership and delivery of the code. That the source code belongs to your company and is delivered with every version, not only at the end. Without this, everything else is pointless.
  2. Code held in escrow. A copy in a repository you can reach from day one, under your own account, not the supplier's.
  3. List of third-party components. Which libraries and external services it contains and in which version. That is what lets you know, years later, whether a published flaw affects you.
  4. Who patches and how fast. A written commitment to fix security flaws within a deadline, separate from the deadline for improvements.
  5. For how long. The years of maintenance included and the price of renewing them, so renewal is not a negotiation from scratch.
  6. Minimum documentation. How it installs, where it is configured and what is needed to bring it up on a new machine. One well-written page is worth more than a hundred-page manual.
  7. An orderly exit. What the supplier hands over if the relationship ends and within what deadline, including the data in a format readable without their program.
  8. Who to call. A named person and a channel, and a commitment to tell you if that person changes.

And the one you already have

The application that has been running for ten years cannot take retroactive clauses, but it can take four questions that get answered in an afternoon.

  • Who built it and whether they still exist. Find the invoice. If the firm is gone, the answer to everything else is that you are on your own.
  • Where the code is. If nobody can answer, that is the first purchase pending, because recovering it later costs far more than asking for it now.
  • What it runs on. The version of the operating system, of the database and of the environment it sits in. If any of them is out of support, the application inherits that problem whole.
  • What would happen if it did not start tomorrow. How long the business holds without it and whether a copy exists from which it could be rebuilt.

None of those questions is really technical. They are all questions about dependency, of the same kind you have to ask about any system holding up the business, and that work starts with the list we describe in The inventory you don't have.

You will commission the next custom build anyway, because it is often the right decision. The difference between commissioning it well and commissioning it badly is not in the price or the deadline, it is in eight lines of the contract, written once. What is left standing for next time is a reusable annex, and the application that comes out of it will still be yours on the day the supplier stops existing.