Statements like these without discussing the language standard most of the Software you have uses is kind of pointless.

I guess most of the legacy code for which they do this risk assessment is Fortran 77. Not any more modern.

And getting it up to date to modern fortran would be as much effort as any other modern language.