Legacy systems risk in insurance