Somebody built your system four years ago. It still runs the business, nobody has touched it since the developer stopped replying, and now something needs to change. The quotes you get back are wild — one firm says RM20,000, another says RM250,000, and neither will explain the gap.
The gap is real, and it is not padding. Taking over software somebody else wrote is a different job from writing new software. The first weeks go on finding out what the code actually does, before anyone is allowed to change it. ZenWeb takes over inherited systems for Malaysian SMEs, and this page prices the decision honestly: the audit, the repair-versus-rebuild arithmetic, and the phased route most owners are never offered. The video below sets up the same trade-off from an engineering point of view.
1. What a Legacy System Takeover Costs in Malaysia
Quick Answer: Legacy system takeover cost splits into four routes: a code audit alone at RM4,000 to RM18,000, stabilise and adopt at RM15,000 to RM45,000, phased replacement at RM60,000 to RM220,000, and a full rebuild from RM90,000 upwards. You buy the audit first and choose the route afterwards, not the other way round.
The four routes are not four opinions about the same job. They are four different jobs, and an honest quote names which one it is pricing. A takeover sits inside ZenWeb's web development pricing rather than beside a website quote, because the deliverable is a working system you inherit, not a page you approve.
| Takeover route | Typical cost | Elapsed time | What you end up with |
|---|---|---|---|
| Code audit only | RM4,000 – RM18,000 | 2 – 4 weeks | A written verdict, a risk register and a costed route |
| Stabilise and adopt | RM15,000 – RM45,000 | 4 – 8 weeks | The same system, patched, backed up, documented and supported |
| Phased replacement | RM60,000 – RM220,000 | 6 – 18 months | A new system built module by module while the old one keeps running |
| Full rebuild | RM90,000 – RM300,000+ | 4 – 12 months | A replacement system, data migrated, the old one retired |
Source: ZenWeb client sample, legacy takeover engagements for Malaysian SMEs, 2024–2026. Licence.
Notice what the top row buys. An audit is the only route that produces a decision rather than a change, and it is the cheapest thing on the page. Owners who skip it usually pay for it later, inside a rebuild they did not need. It is the same lesson as the hidden costs of custom software, only dearer.
Key takeaway: Buy the audit before you buy the opinion. Four routes exist, they differ by a factor of twenty, and only a written audit tells you which one your system actually needs.
Not sure which route your system needs?
Send us what you have: a login, a repository, or just the URL. We will tell you which of the four routes is realistic before you commit to anything.
See how we take on custom applications →2. The Code Audit: What You Pay For and What You Get Back
Quick Answer: A legacy code audit costs RM4,000 to RM18,000 and takes two to four weeks. The deliverable is a document, not a fix: an inventory of what the system does, a security and dependency risk register, a data-quality read, and a costed recommendation for each of the four routes. You own it and can take it to any developer.
Price tracks system size and access. A single WordPress-based booking tool with a live repository sits near the bottom; a five-year-old ordering platform with two databases and no documentation sits near the top. Ask for the deliverable list in writing before you pay, because "audit" means very different things to different firms.
- Functional inventory. Every screen, job and integration the system actually runs, including the scheduled tasks nobody remembers setting up.
- Dependency and version report. Which frameworks, libraries and PHP or Node versions are in use, and which have stopped receiving security updates.
- Security and access risk register. Hardcoded passwords, open endpoints, missing encryption, and who currently holds every credential.
- Data-quality read. Whether the database can be migrated cleanly, or whether years of ad-hoc fixes have left records that no new system will accept.
- Costed route recommendation. One page saying stabilise, replace in phases or rebuild — with a number and a reason next to each.
The last item is the one that earns the fee. A good audit tells you which parts of the system are worth keeping, which is far more useful than "the code is bad". It also gives you the same standing when quotes arrive that comparing proposals properly gives you elsewhere. Pair it with the twelve technical checks for vetting a development team before you hand anyone production access.
Key takeaway: An audit is a document you own, not work done on your system. Insist on the five deliverables in writing, and the fee stops feeling like a consultation charge.
3. Why Undocumented Code Carries a Premium
Quick Answer: Missing artefacts raise a takeover quote by 8% to 30% each, and they stack. An unreachable original developer is the single most expensive gap at around 30%, because every business rule has to be rediscovered by reading code and testing it rather than by asking a question.
This is the line item owners argue with most, so it is worth being specific about what the money buys. It is not risk padding. It is discovery time: the hours spent turning an unknown system into a known one before a single safe change can be made. That is why source code ownership matters long before you ever need it.
| What is missing | Uplift on the quote | Why it costs |
|---|---|---|
| Original developer unreachable | +30% | Every business rule is rediscovered by reading code |
| No source control history | +22% | No record of what changed, and nothing to roll back to |
| No automated tests | +18% | Every change needs a manual pass over the whole system |
| No written documentation | +15% | Business rules live only in the code, never on paper |
| No staging environment | +12% | Fixes have to be proven on the live system |
| Hosting and domain credentials unknown | +8% | Access recovery has to finish before work can start |
Source: ZenWeb client sample, uplift against identical scope with full artefacts, 2024–2026. Licence.
Three of these six are recoverable before you ask for a quote, and recovering them is free. Find the hosting login, ask the original developer for the repository while they still answer, and get the domain into your own account. That is the ground covered in who owns your website, domain and files. Owners who do it before quoting routinely save more than the audit costs.
Key takeaway: The premium is discovery time, and it is partly refundable. Recover credentials, repository access and any documentation before you ask for quotes, and the same scope comes back cheaper.
4. Repair or Rebuild? The Arithmetic That Decides
Quick Answer: Compare the annual carry cost of keeping the system against the rebuild price spread over the years you would realistically use the replacement. If carrying the old system costs more per year than the rebuild divided by five, rebuild. If it costs less, repair and revisit in twelve months.
Most advice on this question is philosophical — never rewrite, or rewrite everything. Neither helps an owner with a budget. Treat it as arithmetic instead, using three numbers you can actually get.
- Annual carry cost. Support retainer plus emergency fixes plus the hours your own staff spend working around the system. Count the workarounds; they are usually the biggest number and the least visible.
- Rebuild price. The audit's costed figure for a replacement, including data migration and the parallel-running period.
- Remaining useful life. How many years the replacement would serve before the business outgrows it. Five years is a fair default for an SME operations system.
A worked example. Carrying an ageing ordering system costs RM3,800 a month in support and workarounds, so RM45,600 a year. A rebuild is quoted at RM160,000 with a five-year life, which is RM32,000 a year. The rebuild is cheaper from year one, and that is before counting the revenue the old system quietly blocks. Reverse the figures, at RM1,400 a month against a RM240,000 rebuild, and repairing is obviously right. The same discipline sits behind web app maintenance and SLA pricing, and behind deciding when a website is due for a rebuild, which is the visual version of this question.
One tax note worth checking with your accountant. Development cost for customised software can qualify for capital allowance under LHDN's Practice Note 2/2020, which changes the after-tax comparison between repairing and rebuilding. We cover the mechanics in custom software tax deduction and capital allowance.
Key takeaway: Annual carry cost versus rebuild price divided by useful life. Two numbers and a division decide a question that usually gets decided by whoever argued hardest in the meeting.
Want the repair-versus-rebuild sum done on your numbers?
Bring your support spend and your workaround hours, and we will put both routes on one page with a break-even year.
Compare custom application cost bands →5. The Strangler Approach: Replacing a System in Phases
Quick Answer: A phased replacement rebuilds one module at a time and routes traffic to the new module as each one is finished, so the old system shrinks instead of being switched off. It costs slightly more in total than a big-bang rebuild, but it delivers the first working module in about three months and removes the cutover weekend entirely.
This is the route most Malaysian SMEs are never offered, and it is usually the one that fits them best. It turns one frightening payment into four manageable ones, and one frightening cutover into several small ones.
| Measure | Big-bang rebuild | Phased replacement |
|---|---|---|
| Quarter 1 outlay | RM60,000 | RM40,000 |
| Quarter 2 outlay | RM75,000 | RM55,000 |
| Quarter 3 outlay | RM55,000 | RM60,000 |
| Quarter 4 outlay | RM20,000 | RM70,000 |
| Year-one total | RM210,000 | RM225,000 |
| First working module live | Month 10 | Month 3 |
| Downtime at cutover | 1 – 3 days | None per module |
| If it goes wrong | The whole project is at risk | One module rolls back |
Modelled scenario built on ZenWeb project sizing for Malaysian SMEs, 2024–2026. Licence.
The RM15,000 difference is what you pay to keep your options open. You can stop after any phase, reorder after any phase, and you never bet the business on one weekend. It is the same logic that makes building an MVP first sensible for a new product, applied to a system that already exists. Sequencing matters: start with the module that hurts most and touches the least, and leave the shared database until last.
Key takeaway: Phased replacement costs about 7% more and removes the cutover weekend. For most SMEs that is the cheapest insurance on the page.
6. What the First Year After Takeover Actually Costs
Quick Answer: The first months after a handover are the expensive ones. In ZenWeb's client sample, stabilisation runs about 46 hours in month one and settles near 10 hours by month twelve, while monthly carry cost falls from roughly RM9,200 to RM3,800 as incidents drop and change requests take over.
Budget the curve, not the average. Owners who sign a flat retainer priced on month twelve run out of hours in month two, then conclude the new developer is slow. The shape below is simply what adoption looks like, and the same curve shows up in ongoing website maintenance costs, only flatter.
| Month | Stabilisation hours | Incidents raised | Change requests | Monthly carry cost |
|---|---|---|---|---|
| Month 1 | 46 | 11 | 2 | RM9,200 |
| Month 2 | 38 | 8 | 3 | RM7,800 |
| Month 3 | 28 | 6 | 4 | RM6,400 |
| Month 4 | 22 | 4 | 5 | RM5,600 |
| Month 6 | 16 | 3 | 5 | RM4,600 |
| Month 9 | 12 | 2 | 6 | RM4,100 |
| Month 12 | 10 | 1 | 6 | RM3,800 |
Source: ZenWeb client sample, legacy systems adopted for Malaysian SMEs, first twelve months after handover, 2024–2026. Licence.
Read the last two columns together. Incidents fall while change requests rise, and that crossover is the moment the takeover has succeeded. The system stops being a liability and starts being a tool again. Structure the retainer to allow for it, with heavier hours in the first quarter and a normal support and SLA plan from month four.
Key takeaway: Budget the first quarter at roughly double the steady-state rate. A takeover that looks expensive in month two is usually just following the normal curve.
7. Access, Ownership and the Things That Stall a Takeover
Quick Answer: Most takeovers stall on paperwork, not code. The four blockers are a domain registered in the old developer's name, hosting billed to their card, a licence for third-party components that does not transfer, and customer data moving hands without a PDPA-compliant basis.
Each of these is cheap to fix in week one and expensive to discover in week six, when the work has already been scoped and scheduled around access nobody actually has.
- Domain and DNS. The registrar account must be yours before anything is repointed, otherwise a routine change becomes a negotiation. Domain and hosting pricing explains what you should be paying directly.
- Hosting and server access. Root or panel access in your own name, with billing on your own card, so nobody can switch the business off over an unpaid invoice.
- Third-party licences. Paid themes, plugins, SDKs and API keys bought under the developer's account often cannot transfer — budget replacements rather than assume goodwill.
- Personal data. A system holding customer records changes hands under PDPA obligations, including a documented basis for processing and a plan for reporting a breach to the Personal Data Protection Department. The controls are covered in PDPA security for web systems.
Handle the handover as a process with a checklist, the way switching web developers without breaking your system sets out. Keep a tested restore point before anybody touches production, which is the discipline behind a proper backup and restore plan.
Key takeaway: Clear the four access blockers before the quote, not after. Ownership problems delay takeovers far more often than difficult code does.
8. How to Run a Takeover Decision in Four Weeks
Quick Answer: Four weeks is enough to go from "nobody will touch it" to a costed decision. Recover access in week one, commission the audit in weeks two and three, and hold a single decision meeting in week four with the carry-cost sum already done.
How to decide on a legacy system takeover in five steps
Run these in order. Each one makes the next cheaper, and skipping the first makes all the others more expensive.
- Recover every credential you can. Registrar, hosting, database, repository, payment gateway and email. Do this before you contact anyone for a quote, because it can cut the price on its own.
- Write down what the system must keep doing. One page of business rules from the people who use it daily, not from the code. This becomes the acceptance test whichever route you take.
- Commission a paid audit with a fixed deliverable list. Two to four weeks, with the five deliverables named in the engagement letter and the report belonging to you.
- Do the carry-cost arithmetic. Annual cost of keeping the system, against the rebuild figure divided by five years. Include staff workaround hours; they are usually the deciding number.
- Pick the route and fix the sequence. Stabilise, replace in phases, or rebuild — then agree which module goes first and what "done" means for it before any work starts.
That page of answers turns a vague fear into a project any developer can quote against, in the same way a simple requirements document does for a new build. It is also what separates a clean takeover from rescuing a stalled project six months later.
Key takeaway: Access, business rules, audit, arithmetic, route. Five steps in four weeks, and the decision stops depending on whose quote arrived last.
9. Budgeting the Real Number
Quick Answer: Budget the audit, the chosen route, and a first year that costs roughly double the steady-state retainer for its first quarter. That total is the honest legacy system takeover cost, and it is the figure to approve rather than the headline build price.
An inherited system is rarely as bad as it feels in the week you discover nobody supports it, and rarely as cheap to fix as the lowest quote suggests. The audit is what closes that gap, and RM4,000 spent finding out is a better trade than RM160,000 spent guessing.
ZenWeb prices the audit, the route and the first year on one page, so the number you approve is the number you live with. Start from our web development pricing. Read the neighbouring budgets too: system integration and API project costs if the takeover involves connecting systems, and multi-vendor marketplace budgets if the inherited platform serves several sellers. If the system is really a website rather than an application, start instead with what a website costs in Malaysia and choosing between WordPress, Shopify and custom, with what a CMS is for the vocabulary.
Inherited a system nobody wants to touch?
Book a free 30-minute session. Bring whatever access you have and what the system costs you each month, and we will hand back an audit scope, a route recommendation and a first-year budget.
Get my takeover assessment →
10. Frequently Asked Questions
1. How much does a legacy system takeover cost in Malaysia?
A code audit costs RM4,000 to RM18,000, stabilising and adopting the system costs RM15,000 to RM45,000, a phased replacement costs RM60,000 to RM220,000, and a full rebuild starts around RM90,000. The audit decides which of the four you actually need.
2. Is it cheaper to fix an old system or rebuild it?
Compare the annual cost of carrying the old system against the rebuild price divided by five years of useful life. If carrying it costs more per year, rebuild. Include the hours your staff spend on workarounds — that number usually decides it.
3. Why do developers charge more to work on someone else's code?
Because the first weeks are discovery, not development. Missing documentation, tests, source control history and an unreachable original developer each add between 8% and 30% to the quote, and those uplifts stack.
4. What is a strangler or phased replacement?
Rebuilding one module at a time and routing traffic to each new module as it goes live, so the old system shrinks gradually instead of being switched off in one weekend. It costs slightly more overall but removes cutover downtime.
5. What do I need before asking for a takeover quote?
Registrar, hosting, database and repository access, a one-page list of what the system must keep doing, and any documentation that exists. Recovering access alone often lowers the quote by more than the audit costs.
6. Can takeover and rebuild costs be claimed against tax?
Development cost for customised software may qualify for capital allowance under LHDN Practice Note 2/2020, while routine repairs are usually treated differently. Confirm the split with your tax agent before you structure the engagement.
