Two kinds of engagement, one developer
Start by deciding which engagement this is
There are two honest answers to "what should we do with our CodeIgniter application", and they lead to different weeks. One is to keep it on CodeIgniter 3, patched and tidy, because it meets the need. The other is to move it to CodeIgniter 4 over time. Your developer helps you choose in the first fortnight, after reading the code. They look at its size, how much logic lives in controllers, which third-party libraries have no modern equivalent and how well it runs on the PHP release your host requires.
When the plan is upkeep
A maintenance week is driven by tickets from the people who use the system. The developer reproduces the problem on a staging copy, fixes it on a branch and adds a regression test where the code allows it. Alongside tickets they work down a standing list: PHP deprecations, queries built by string concatenation, logic repeated across controllers. Releases are small and frequent. This is a good fit for the part-time model if the system is stable.
When the plan is a move to version 4
We do not port everything and switch over in one night. The CodeIgniter 4 application is created alongside the old one, pointed at the same database, with shared login so users move between old and new screens without noticing. Modules are rebuilt one at a time, each with migrations and tests the old code never had, and traffic is routed to the new version as each one is ready. The old application shrinks until it can be switched off. Our CodeIgniter 3 to 4 upgrade page explains the sequencing in more detail.
Hand-over, review and testing
Either way, tasks reach the developer through a board, with an example record for bugs and a short description of the screen for new features. Code goes through pull requests. A second developer reviews changes that touch money, permissions or shared tables. Older CodeIgniter code is hard to unit test, so we lean on staging checks with realistic data and add automated tests as modules are modernized.
How to judge the developer
Ask them to explain your application's request flow from route to view, including any hooks and base controllers, by the end of week two. Someone who can do that clearly will maintain it safely. Someone who answers with a pitch for another framework is telling you what they would prefer to work on. If a broader cleanup is on your mind, see legacy PHP modernization.