Compliance Risk from Legacy Tools