On a Monday morning in April 2021, registration at the College of William & Mary stopped working. The Banner system buckled under the load of students trying to register at once, crashed, and forced the registrar’s office to split the student body into “Green” and “Gold” groups with staggered windows just to get through the week, according to reporting in the student newspaper Flat Hat News. Nobody on the board had asked about Banner’s technical debt the week before. Everyone asked about it the week after.
That is the pattern. Technical debt inside a Banner ERP system is invisible to a board of trustees or a provost’s cabinet until it produces a visible failure: a registration outage, a botched financial aid report, a security incident. By then the CIO is explaining a fire instead of a forecast, and the conversation happens on the board’s terms, not the CIO’s.
Why the Board Never Hears About This Until It’s Too Late
IT budgets get scrutinized line by line, but the risk accumulating inside the Banner ERP system rarely gets a line of its own. A decade of one-off customizations and deferred upgrades, each patched with a promise to “fix it properly next cycle,” builds up quietly. It shows up in headcount pressure on a lean team and in longer timelines for anything new. Eventually it shows up in an outage nobody can still call a minor maintenance overrun.
EDUCAUSE’s February 2025 QuickPoll on institutional debt found that this kind of deferred technology debt is now widespread across higher education IT, and that it compounds hardest at the institutions least equipped to absorb it: smaller shops running lean, with stretched budgets and thin cybersecurity coverage. That finding matters for any CIO managing a heavily customized Banner ERP system with a small team, because it means the exposure is structural, not a symptom of one department falling behind.
None of that is dramatic enough for a board agenda on its own. A crash during add/drop week is.
The Facilities Maintenance Analogy
Boards understand deferred maintenance on buildings. Skip a roof replacement for five years and the roof still keeps out rain, until the day it doesn’t, and a $400,000 planned job becomes a $2 million emergency. Every capital committee at every university has had that conversation at least once.
A Banner ERP system ages the same way. A decade of undocumented customizations layered on top of earlier customizations, an upgrade deferred because the workarounds still technically function, a report built on a table structure nobody remembers changing: these are the equivalent of a roof with three layers of patched shingles. It holds, until the week 30,000 registration transactions hit it at once.
The advantage of this analogy for a CIO is that it reframes the ask. The board is not being asked to fund an IT project. It is being asked to approve capital maintenance on the system that runs registration, financial aid disbursement, payroll, and compliance reporting, the institutional equivalent of the power plant.
What’s Actually Accumulating Behind the Interface
A board conversation does not need the technical detail. The CIO does, because it is the basis for everything said afterward:
- Undocumented customizations to core Banner forms and processes, often written by staff who have since left the institution
- Deferred version upgrades, sometimes several releases behind, because the customizations were never tested against a newer baseline
- Workaround-on-workaround fixes, where a defect in a customization gets patched with another customization instead of a fix at the source
- Integration sprawl, as more systems connect to Banner over the years without a coordinated data or security review
No single item on that list is a crisis. Together, they are why one registration surge, one failed report, or one credential exposure can turn into a multi-day incident instead of a contained one.
Board-Level Talking Points
A provost’s cabinet does not need architecture diagrams. It needs the numbers below, framed the way a facilities committee already understands risk.
- Risk exposure. How many core functions, registration, financial aid, payroll, compliance reporting, run through customizations that are undocumented or unsupported at the institution’s current Banner version.
- Cost of inaction versus cost of a phased fix. What an unplanned outage costs in staff overtime, reputational damage, and emergency vendor spend, set against a scoped remediation plan spread across two or three budget cycles.
- Peer comparison. Where the institution sits relative to peer institutions on upgrade currency and customization load. Boards respond faster to competitive standing than to abstract risk.
Gartner’s research on infrastructure technical debt makes the payoff side of this case directly: IT leaders who actively manage and reduce technical debt achieve service delivery times at least 50% faster than those who let it accumulate, cited in a Forbes Technology Council analysis of the research. That is the inverse of the William & Mary story: an institution that gets ahead of the load before the surge, not after it.
The security dimension deserves its own line. In 2019, the U.S. Department of Education’s Federal Student Aid office issued a formal alert to Banner-running institutions about a vulnerability in the system, urging patches and additional validation controls on registration portals. Whatever the outcome at any single campus, the alert itself is worth citing to a board: a platform this widely deployed and this heavily customized draws scrutiny from outside the institution, not only from within it.
Naming the Conversation Before an Outage Names It for You
CIOs who manage this well do not wait for the incident. They put a technical debt review on the board calendar the way facilities puts a deferred maintenance report on it: on a fixed cycle, with a number attached, not as a crisis briefing.
That review needs an honest inventory: what’s customized, what’s undocumented, what’s overdue for upgrade, what remediation would cost in phases. This is where an outside read helps, because it is hard to audit a system objectively while running it day to day and answering support tickets on it. Sanguine Tech Group’s work with Banner-running institutions is built around producing exactly that kind of independent picture, a clear map of where the risk sits and what a phased plan costs, so the CIO walks into the board room with a plan instead of a postmortem.
Where to Start
If your institution has not had a technical debt conversation with its board in the past year, the next incident involving your Banner ERP system will start that conversation for you, on a timeline you did not choose. A short, scoped audit of the systems that matter most, registration, financial aid, payroll, is a reasonable place to begin. It gives a CIO a number and a plan to bring to the next board cycle instead of a warning with nothing attached to it. If mapping that out for your specific Banner environment would help ahead of your next board meeting, Sanguine Tech Group is glad to walk through what that audit would look like.
Sources
- EDUCAUSE Review, “EDUCAUSE QuickPoll Results: The Varied and Compounding Effects of Institutional Debt” (February 2025): https://er.educause.edu/articles/2025/2/educause-quickpoll-results-the-varied-and-compounding-effects-of-institutional-debt
- Flat Hat News (College of William & Mary student newspaper), “Back-to-back Banner registration crashes should be cause for alarm and change” (April 19, 2021): https://flathatnews.com/2021/04/19/back-to-back-banner-registration-crashes-should-be-cause-for-alarm-and-change/
- Flat Hat News, “Campus prepares for new PATH registration system replacing Banner 9” (March 5, 2024): https://flathatnews.com/2024/03/05/campus-braces-for-new-path-registration-system-replacing-banner-9/
- Gartner research on IT infrastructure technical debt, cited in Forbes Technology Council, “Measuring And Managing Technical Debt” (August 10, 2022): https://www.forbes.com/councils/forbestechcouncil/2022/08/10/measuring-and-managing-technical-debt/
- U.S. Department of Education, Federal Student Aid, “Technology Security Alert – Exploitation of Ellucian Banner System Vulnerability – Update #1” (2019): https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2019-08-06/technology-security-alert-exploitation-ellucian-banner-system-vulnerability-update-1
