What auditors actually ask about legacy logic
Regulatory reviews of older financial systems tend to come down to a few plain questions. Where does this number come from? Which rule decides whether an application is approved or declined? Who changed that calculation, and when? If the person who wrote the logic left years ago and the documentation is incomplete, those questions are hard to answer.
Core banking and insurance platforms often carry decades of business logic in COBOL, PL/I, Oracle Forms and older Java code. The original authors are usually gone. The documentation is missing or wrong. That does not stop an examiner from asking you to explain how an underwriting decision or a payment calculation actually works.
The questions usually fall into three groups:
- How a specific figure is calculated, such as a fee, a net payment or a premium.
- Which rules sit behind an automated decision, and where they are defined.
- What else is affected when a rule or a field changes.
Why documents alone fall short
The usual response is to hand over specifications and process documents. The trouble is that these describe what the system was meant to do when it was designed. After years of patches and quiet changes, the running code may behave differently. An auditor who compares the document with the code will find the gaps quickly, and each gap becomes a finding.
A stronger answer points to the code itself. If you can show a rule, show the exact place in the source where it lives, and show what depends on it, you are no longer asking the reviewer to trust a description. You are letting them inspect the evidence.
What source-backed evidence looks like
Replai reads existing code, including COBOL, Oracle Forms and PL/I, and builds a structured map of what the system does: the business rules, the workflows and the dependencies between components. Each rule stays connected to the source it came from, so a statement about the logic can be checked against the code behind it.
Take a simple case. A field called PAYMENT-AMOUNT feeds a rule that calculates a net payment as the amount minus a fee. That net amount is written to a ledger entry, and the payment detail is kept in an audit record. With the relationships mapped, you can answer three audit questions in one pass: what the rule is, where it is defined, and which records it touches. Replai's own illustration of this flow is deliberately labeled as an example and not a complete picture of impact, and the same caution applies in a review. Follow the relationships, then inspect the evidence before you state a conclusion.
Your team can also ask plain-language questions about the code, which helps compliance staff who do not read COBOL. Human judgment stays in the loop. The platform surfaces the rules and their context, and your people decide what to present.
How to prepare before the regulator arrives
Waiting for the review notice is the most expensive time to start. A practical sequence looks like this:
- List the calculations and decisions most likely to be examined, such as underwriting logic and payment or premium calculations.
- Recover the rules behind each one from the source, and note where each is defined. Our guide on extracting business rules from COBOL code walks through this step.
- Trace dependencies for any field or formula you plan to change, so you can show what a change would touch. See legacy code analysis for the wider method.
- Keep the written record current. If documentation is the weak point, read about documenting a system nobody fully understands.
- Give compliance and engineering the same view, so both can answer from one source instead of two competing accounts.
Risk teams reviewing a wider program may also want the risks of legacy modernization for financial institutions, since an audit and a migration often draw on the same evidence.
Where to start
You do not need to map the whole estate first. Pick the one calculation or decision that worries your compliance lead most, and recover its rules and dependencies from the source. A single well-evidenced answer shows how the approach would work across the rest. If you want to see how this works on your own systems, the Replai solutions page covers the compliance and audit use case, and how AI agents read legacy code explains the method in plain language.
Frequently asked questions
What do auditors usually ask about legacy business logic?
They ask how a specific figure is calculated, which rules sit behind an automated decision, and what else is affected when a rule or field changes. These are hard to answer when the original authors are gone and documentation is incomplete.
Why are specification documents not enough for a regulatory review?
Documents describe what a system was meant to do at design time, while the running code may have changed since. An auditor who compares the two will find gaps, and each gap can become a finding.
What does source-backed evidence mean?
It means each business rule stays connected to the source code it came from. A reviewer can inspect the exact place a rule lives and see what depends on it, instead of relying on a description.
Which legacy languages can Replai read?
Replai reads existing code including COBOL, Oracle Forms, PL/I and Java, and builds a structured map of the rules, workflows and dependencies in it.
Can compliance staff use this without reading COBOL?
Yes. Your team can ask plain-language questions about the code and explore rules with their source context, so compliance and engineering can work from the same view.
Where should a team start before a review?
Start with the one calculation or decision your compliance lead is most concerned about. Recover its rules and dependencies from the source, then extend the same approach to other areas.