Living with legacy risk—the limits of practicalities?