legacy risk