The Workaround Nobody Remembers Building

The Workaround Nobody Remembers Building

Every organization of any age runs on a few processes that work perfectly and that nobody can explain. They were built years ago, by someone solving a real problem, and they have run unattended ever since. The better they work, the less anyone looks at them.

‍

The Setup

A K-12 school district asked for what looked like a clean integration: connect a new attendance and gradebook platform to the student information system already in place. One API connection between two known systems.

‍

‍

What Blueprint Found

The Blueprint review of the existing data flows found something the request could not have known to mention. Years earlier, the SIS's native reporting module could not produce the state's required submission format without heavy manual rework. So IT staff did what capable IT staff do: they wrote a script. It pulled student records out of the SIS, reformatted them to the state specification, and staged the output on a shared network drive for the downstream reporting tool. It ran unattended for years. It never failed, so nobody ever revisited it.

‍

The Risk

The drive's permissions had never been secured. FERPA-protected records were accumulating on an unsecured share, not through negligence, but as the byproduct of a reasonable workaround that outlived everyone's memory of it.

‍

The Fix

Because the audit surfaced this before the new integration was built, remediation folded into the same project: reporting rebuilt to pull directly from the system of record, the script decommissioned, the exposed files removed. The project shipped on its original estimate, because the estimate was built on the audit results rather than assumptions.

‍

‍

The Pattern

Workarounds are load-bearing and invisible in direct proportion to how well they work. The most dangerous data flow in a mature environment is the one that has run flawlessly for five years, because flawless means unexamined.

Before connecting anything new to an old system, the question is not what the system does. It is what has been quietly built around it, and where that output goes.