How do the cost and risk of custom development compare with extending an existing system?

Wavesteam primarily delivers controlled custom projects and will not promise to modify unknown source that cannot be built. For a mature product, configuration and official extensions come first. For an existing client system, we audit source, licences, data, and deployment before recommending continued extension, partial modernization, or replacement.

Custom and secondary development are not quality labels. An established ERP, CMS, commerce, or low-code product can be faster and safer when standard workflows fit and extensions use supported points. A clear repository with tests and cooperation from the current maintainer may also be worth evolving. The high-risk case is an undocumented zip with no reproducible environment and unclear rights, quoted only by the number of requested screens.

Route	Prerequisite	Initial cost	Main risk	Wavesteam default
Configure standard software	Common core process and acceptable plan/export	Lowest	Business adapts to product and subscription	Trial first
Official plugin/API extension	Stable extension model and bounded differences	Low/medium	Licence, version, and API constraints	Preferred secondary development
Continue inherited source	Clear rights, reproducible build, maintainable stack	Depends on audit	Hidden defects, absent tests, historic liability	Audit before quoting
Rebuild around the business	Distinct core or unsustainable old system	Usually highest first cost	Requirements, migration, cutover	Only when long-term value covers cost

An inherited-system assessment needs repository history, branches and tags, lockfiles, schema and migrations, deployment, third parties, APIs, recent incidents, tests and monitoring, users, and volume. First prove a clean isolated build and critical flow. Files found on a production server without a known version or rollback are not maintainable evidence.

The client must have the right to provide source and data. Open source retains its licence; commercial SDKs, fonts, media, and former-supplier components need individual review. SPDX identifiers help inventory licences but do not replace the actual agreement. Wavesteam will not copy uncertain code to bypass ownership.

An audit states facts: build result, severe dependency findings, tests in critical modules, repeatable migrations, API authorization, secrets in source, sensitive logs, and rehearsed release/rollback. Findings are categorized as pre-release mandatory, planned debt, accepted, or rebuild candidates, with effort ranges and assumptions.

Inherited work is often harder to estimate because feature scope is visible while coupling must be discovered. A bounded paid takeover assessment delivers build evidence, architecture/dependency map, risks, remediation or modernization routes, and the next estimate. Safe modules remain while dangerous ones are replaced incrementally.

Compare configuration/subscription, takeover and extension, and rebuild across 36 months, including migration, parallel running, downtime, reconciliation, training, and upgrades. The project budget guide explains the costing basis. If extension proceeds, use versioned OpenAPI contracts, database migrations, and critical regression tests before new functions. Baseline and change records distinguish historic and introduced defects.

Wavesteam does not offer “modify first, understand later,” but will assess mature official extensions and well-evidenced inherited systems. The Transparent Delivery Standard describes related takeover assets.