We retired an order history system in March after eighteen months of migration. Ninety days of notice went to every department, twice. Nobody objected. We switched it off on a Friday evening, and by Monday afternoon seven things had broken, not one of which used the application we had spent eighteen months replacing.
A commission calculation in sales. A reconciliation a logistics partner ran against us every Tuesday. A credit check step inside a workflow tool. A label printer in the warehouse. A dashboard somebody had built in 2018. A monthly regulatory extract. And a spreadsheet on a finance manager's machine with a database connection in it, which she had been refreshing every week since 2016 and had never thought of as an integration, because to her it was a button.
All seven read the database directly. None went near the application, its interfaces or its support team, and so none of them appeared in any handover, any architecture diagram or any of the migration workshops. Our entire decommissioning plan had catalogued what the system did. It had catalogued nothing about who was reading it.
The reason they existed is not mysterious. The application's reporting was poor, the database was on the network, and over fifteen years read-only credentials were handed out by colleagues who were being helpful and are now retired. Every one of those grants solved a real problem on the day it was made.
We restored the database read only for eight days and spent nine weeks rebuilding those consumers properly. The lasting change was cheaper than any of that. Before a system is retired we now log every login to its database for a full quarter, because a month misses month end and a quarter catches the regulatory cycle. We have done this three times since and found eleven consumers, then three, then nineteen. Direct database access now requires a registered owner and an expiry date, and the registration is reviewed when the owner changes role.
An application's supported interfaces are what we designed. Its real interfaces are whatever anyone ever found a way to connect to, and the only honest inventory of those is the connection log, which almost nobody reads until the week they need it.
– Serguey Shinder
