Map the Systems Before You Fund the Project

The Decision in Front of You

Somewhere on your desk is a proposal to move to the cloud, replace an ERP, modernize a legacy platform or put AI into a core process. It arrives with a business case, a vendor estimate and a go-live date. The decision is whether to approve it as written or first spend a few weeks finding out what it will touch.

The stakes are well measured. McKinsey and Oxford University studied more than 5,400 IT projects and found that those with budgets above $15 million ran 45% over budget and 7% over schedule on average, while delivering 56% less value than predicted ¹. The same 2012 research found 17% of IT projects went badly enough to threaten the company's existence ¹. Flyvbjerg and Budzier's analysis of 1,471 projects found an average cost overrun of 27%, which hides the real risk: one project in six was a "black swan" with an average cost overrun of 200% and a schedule overrun of almost 70% ².

These studies are more than a decade old, and the cases below show the pattern continuing. The recommendation in this paper is narrow: approve no major technology project until a short discovery has mapped the infrastructure, the dependencies between services and the business workflows that run across them.

What's Happening

Nobody has an accurate list

Most organizations cannot say with confidence what they run. In an October 2026 benchmark of 203 organizations with more than 1,000 employees, Enterprise Management Associates found only 18.5% rated their IT service and configuration management database (CMDB) asset data at 95% accuracy or better ⁵. About two-thirds (65.5%) still build the CMDB at least partly by hand ⁵. In the author's experience, the missing records are usually integrations, which is where cutovers fail.

Government is no better. The UK government's 2025 State of Digital Government review estimated that 28% of central government systems were legacy in 2024 and said there is no comprehensive record of the scale of legacy IT across central government ³. Around 15% of respondents could not estimate the size of their own legacy estate ³. In the United States, GAO's 2025 review of the 11 federal legacy systems most in need of modernization found ages from 23 to 60 years, and only 3 of the 11 had modernization plans covering all of GAO's key practices ⁴. For one Commerce Department system, hardware information was unknown to the Census Bureau because several bureaus manage hardware separately ⁴.

Spending has moved outside the IT department

Software no longer arrives only through IT purchasing. Zylo's 2025 SaaS Management Index, based on more than 40 million licenses and $40 billion of spend, found that business units account for 70% of SaaS spend and IT for 26.1% ⁶. The prior year's index found more than a third of a company's applications were shadow IT, bought and run without IT's involvement ⁷. Any of them may call an internal system through an API key that no architecture diagram shows.

The standards already require the maps

The security frameworks your auditors cite expect these inventories to exist. NIST's Cybersecurity Framework 2.0 (2024) asks organizations to maintain inventories of hardware (ID.AM-01), of software, services and systems (ID.AM-02), of services provided by suppliers (ID.AM-04), and representations of authorized network communication and internal and external data flows (ID.AM-03) ⁸. CIS Critical Security Controls v8.1 makes inventory and control of enterprise assets its first control, covering end-user devices, network devices, IoT devices and servers whether they connect physically, virtually, remotely or through the cloud ⁹. CISA's August 2025 asset inventory guidance, written with the NSA, the FBI and five allied agencies, sets out the method: define scope, identify assets and their network dependencies through both physical inspection and network surveys, classify them by criticality, map process dependencies and keep the inventory current on every change ¹⁰.

These controls were written for security. They are also the starting picture every migration and ERP project needs.

AI raises the stakes

AI projects add a new failure path. Gartner predicted in 2024 that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, citing poor data quality, weak risk controls, rising costs and unclear value ¹⁴. In 2025 it reported that 63% of organizations either lacked or were unsure they had the right data management practices for AI ¹⁶. In June 2026 Gartner predicted that more than 70% of mainframe exit projects will fail because buyers overestimate what generative AI can do ¹⁵. A tool that converts code still needs to know which jobs call it and who reads what it writes.

Two Recent Cases

Asda, 2021 to 2025. After Walmart sold Asda in February 2021, the retailer started Project Future to separate its technology from Walmart's, with an initial budget of £189 million ¹¹. The work meant untangling more than 2,500 legacy systems ¹¹. By the end of 2023 the cost had reached £430 million ¹¹. The annual report released in June 2026 put the total at £1.224 billion, more than £1 billion of it operating expense, about 6.5 times the original budget ¹². The cutover in 2025 disrupted stock flow between depots and stores, and Asda said the problems materially affected its third-quarter trading, when revenue fell 2.8% to £5.1 billion ¹¹. Chairman Allan Leighton called the issues "totally self-inflicted" and blamed poor integration, insufficient testing and a lack of capacity planning, adding that the delays set the turnaround back six months ¹¹. The lesson: in a carve-out, the dependency map is the project, and every connection found after approval arrives as a change order.

College of Policing, 2023 to 2026. In October 2023 the College moved its accounting to the Home Office's Oracle-based Metis system and outsourced most payroll ¹³. The National Audit Office found it went live with known problems unresolved and without a line-by-line reconciliation of its data ¹³. The College overspent its budget by £1.3 million that year, and by the end of audit fieldwork could not support 56% of the audit sample ¹³. In July 2025 the Comptroller and Auditor General disclaimed an opinion on its 2023-24 accounts, and the 2024-25 accounts were disclaimed again in early 2026 because of the earlier problems ¹³¹⁷. The lesson: a workflow map of what the old system did, down to reconciliations and month-end steps, is the acceptance test for the new one.

Birmingham City Council's move from SAP to Oracle, budgeted at £19 million and now forecast at £144.4 million, is covered elsewhere in this series ¹⁸.

Why the Usual Approach Fails

The usual sequence runs business case, vendor selection, contract, then discovery inside the project. By the time the team finds the undocumented interfaces, the budget, date and price are set, and each surprise becomes a change request negotiated under deadline pressure.

Estimates come from the vendor. The party writing the estimate knows its product well and your environment barely at all. Its numbers describe a clean installation.

The CMDB is treated as the truth. Most are built at least partly by hand ⁵, and teams plan from them because they are the only list available. Discovery checks the records against the network, the schedulers and the logs.

Calendar effects are missed. Two weeks of observation shows daily traffic. It misses the quarter-end close, the annual tax file and the batch job that runs on the first Sunday of the month.

Workflow lives in people. The official process says invoices flow from the ERP to the bank. The real process includes an analyst who exports a file, fixes three columns in a spreadsheet and uploads it. That step is a dependency. It will break when the export format changes, and no system inventory will find it.

The Framework: Three Maps Before Money

A discovery is a small, fixed-price piece of work with a defined output. It takes two weeks for a single site or business unit and up to six weeks for a multi-site organization or a carve-out. It produces three maps and a decision memo. Each map is checked against live evidence, so that every item is either confirmed by the systems themselves or marked as an assumption.

flowchart LR
    A[Fund discovery<br/>2 to 6 weeks<br/>fixed price] --> B[Infrastructure map<br/>what runs where]
    B --> C[Dependency map<br/>what calls what]
    C --> D[Workflow map<br/>how work moves]
    D --> E[Decision memo<br/>scope, cost, sequence]
    E --> F[Board decision<br/>fund, rescope<br/>or stop]

The decision memo then states, in two or three pages, what the project will touch, how many integrations are confirmed versus assumed, what can be switched off first, the order of work, and a budget range with contingency sized to the remaining unknowns. The board approves the memo. A project with 40 confirmed interfaces and 3 unknowns is a different investment from one with 40 confirmed and 60 suspected, even if the vendor quote is the same.

Two practices keep discovery honest. Observe for long enough to catch a month-end close, or read the scheduler configurations to find what runs less often. Have business staff walk the workflow map and mark every place they leave the system to finish a task.

Costs, Risks, and Tradeoffs

Discovery costs money and time. Consider a hypothetical $20 million ERP or migration program. A team of four working six weeks at a blended $250 an hour costs about $240,000, or 1.2% of the budget. If the program carries the one-in-six chance of a 200% overrun that Flyvbjerg and Budzier measured ², the expected tail cost is about $6.7 million (one-sixth of $40 million). Even the 27% average overrun ² is $5.4 million. This is the author's illustrative estimate. It assumes the program resembles the projects in that research, and it does not assume discovery removes all overrun risk.

How to Act

Questions to Ask Your Team

1. For the project we are about to approve, how many integrations does it touch, and how many of those have we confirmed from the systems themselves?
2. What runs only at month end, quarter end or year end, and how did we find out?
3. How accurate is our CMDB, measured against a scan, and when did we last check?
4. How much of our software is bought outside IT, and is it in the inventory?
5. Where do staff leave the system to finish a task in a spreadsheet or email?
6. Which systems could we switch off before the project starts?
7. Who wrote the estimate, and how much of our environment had they seen?
8. If discovery found the project should be half the size, would we be willing to rescope it?

Closing

Every large technology project is an estimate about systems someone has not fully counted. The research shows the cost of guessing: average overruns in the tens of percent, and one project in six running at three times its budget. A discovery of two to six weeks, priced at a percent or two of the program, replaces the guess with three maps checked against the systems themselves. Make it the gate. Approve migrations, ERP replacements, modernization and AI projects from the maps, and send back any proposal that arrives without them.