HMRC explained that there are three key risks that arise from operating legacy systems: lower levels of security; lower reliability and resilience; and higher costs of system changes. HMRC said that its executive team and its digital team track how up to date its systems are and how that is changing over time. HMRC told us that it now has a tolerable level of risk in its IT estate, but progress on remediation was not as fast as it would like.44