When You Should NOT Build It Yourself

The short version

Internal development is not categorically off limits for anything. The honest rule is that the controls and the expertise have to increase with the consequence of being wrong. Higher-risk areas are the ones where a defect reaches an emergency, a patient, a personnel file or a legal record. CAD and dispatch decision-making. Clinical decisions. Patient information. Personnel discipline and hiring. Public-safety authentication. Life-safety systems. Mission-critical infrastructure. Anything whose failure immediately affects emergency operations. A simple risk framework is usually enough to place a project. LOWER RISK. Internal tools whose failure causes inconvenience but not operational harm — a training scheduling helper, an internal dashboard, an equipment request workflow, a prototype. Build these, learn from them, and keep them small. MODERATE RISK. Tools using important organisational data or influencing resource decisions. These need more testing, real access control, written documentation and your IT department involved rather than informed afterwards. HIGHER RISK. Tools involving protected health information, clinical decisions, dispatch, emergency communications, mission-critical response, personnel rights or safety-critical recommendations. These need professional-level governance, security, testing and named ownership. That is not a reason never to pursue them. It is a reason not to pursue them as a side project. The useful moment is recognising that a project has moved from one band to the next. Tools rarely stay where they started: a dashboard someone built for themselves becomes the thing three battalions rely on, and nobody re-asked the question.