We got hit with that audit once. Since then we've made sure that we'll be doing those upgrades on our schedule, not theirs.
Same DEC VAX technology had been retired by damn' near the rest of the world all the way back in 1992/1993!!
One of the reasons the bank I now work for hired me is because I'm an SME (and author) on Technology Lifecycle, which includes all aspects of IT Risk, Business Risk, Regulatory Risk, Brand Reputation and Brand Damage. I actually copyrighted the Technology Lifecycle Process I developed, the evaluation criteria, and how the results are published in a dashboard form so that even Senior Executives can understand it.
So this bank hires me away from another bank, and I present them with my Technology Lifecycle Process complete with evaluation criteria and a guarantee that following my process will result in net savings to the bank. That was on my fourth day of employment.
Bank Senior Management loved it, and gave me six weeks to identify the technologies that needed to go in order to protect the bank from all the different types of damage I described (they were VERY concerned about Brand and Reputational damage, due to this particular bank catering only to the uber-wealthy.) I responded back in 4 weeks (2 weeks early...) with a list of 10 technologies they needed to get rid of to avoid all the categories of risk I outlined for them.
#1 on that list was the DEC VAX cluster that even HP couldn't support anymore, but was costing the bank upwards of $1.7 million a year to run in service contracts, consulting contracts, FTE's, environmental costs such as electric, a/c, data center footprint and other associated costs.
I then showed them how I could retire that DEC VAX in 180 days, including moving all 135 mission critical application components that STILL RAN on that platform and interfaced with other mission critical applications.
In my 30+ year career in IT, I'd never seen any other situation like this.
Several Senior IT Leaders were literally dead set against spending the $1.6 million dollars I said it would cost to retire it. They viewed it as a waste of money.
To convince the more "sane" and "rational" Senior IT Leaders that it was the right thing to do to spend $1.6 million to retire that platform, I went back into their IT budget over the 15 years that thing should've been gone, and calculated the Net Present Value of all the money they spent on service contracts that meant nothing, and consultants who literally baby-sat this thing for the last 15 years and never touched it.
When they saw the Net Present Value of the money they WASTED keeping that platform running, jaws literally dropped and the room was so quiet you could hear a pin drop.
Guess what happened? I retired that system in the 180 days I said I would, came in slightly under budget, and migrated all 135 applications and their components that were running on it off to the bank's existing platforms without buying a single piece of hardware, software, or renewing any of the existing application vendors agreements.
I had the pleasure of shutting the damn' things down in both data centers. Within 24 hours both data centers dropped several degrees and there was a noticeable uptick in available power in both data centers.
Now, what did I get for my efforts? Shunned by those in Senior Management who were betting against me. As it turned out, there had been several efforts to retire the DEC VAX platform before me. All failed. I succeeded. There was an actual betting pool going between our IT and Business Senior Management as to whether or not the DEC VAX could actually be retired.
How did I win enough Senior Management over to retire the platform? Simple. We're a bank. We have Shareholders. We pay annual dividends on our stock. We have a responsibility to run as efficiently and lean as possible to maximize their investment. So when I showed the NPV (Net Present Value) of all the money the bank WASTED over 15 years was in excess of $30,000,000 and then showed them how much modernization that money would've covered, I won enough Senior Management over to do the project.
Thankfully, the Senior Management who said NO to retiring that platform have either left the bank, or moved over to one of our business units. It's the ones that have moved over to our business units that still try and make my life difficult because I proved them wrong, and I proved how much money their stupid decisions actually cost the bank.
One thing is true though: Money talks, bullsh*t walks. Bankers HATE being told they're wasting money.
As I found out well after the project had concluded and the old systems were wheeled out the door, the distinction between me and the people who tried before me to retire that platform came down to one simple thing: NPV. I showed them how much money they wasted and literally shamed them into taking action.
So when I say that the bank I work at isn't going to move to Windows 10 anytime soon, I know what I'm talking about. :-)