Support Deadline Versus Unexperienced Rebuild
Meridian Trust's regulatory reporting platform runs on a vendor version whose support ends in 14 weeks, with no extension available. The regulator requires seven years of immutable audit history; the platform currently holds 1.2 million filing records and 40,000 attachments. The internal team has six engineers, a fixed budget of $400,000, and no prior experience implementing immutability controls. Two options are on the table: (A) lift-and-shift to a managed service quoted at $310,000 with a 20-week migration window, or (B) rebuild the audit-trail module in-house at an estimated $180,000 and 10-14 weeks. Two engineers resigned last quarter and were not replaced. The CFO wants a recommendation this week and has said, in writing, that she wants "no regulatory surprises."
1. Which option do you recommend, and what is the reasoning chain that gets you there?
Read the worked answer
Neither option fits cleanly, so start by separating must-haves from preferences.
Must-haves
- Support coverage at the moment the current version expires (week 14).
- Provable seven-year immutable audit history that survives an examination.
- An auditable change history for the new system itself.
Option A fails on timing, not on merit. A 20-week migration against a 14-week cliff leaves six weeks of unsupported operation. That is a gap the CFO explicitly ruled out. But the gap is a scheduling problem, not a technical one.
Option B fails on capability, not on cost. The team has no immutability experience and just lost a third of its headcount. A 10-14 week estimate from a team that has never built the thing is best read as a lower bound; the realistic distribution has a long right tail, and the tail lands after the support cliff.
Recommendation: take Option A, but do not accept the 20-week plan as quoted. Require the vendor to sequence work so the audit-history archive is cut over and verified first - inside 10 weeks - leaving only lower-risk functional migration in the unsupported window, and negotiate an interim support bridge for weeks 14-20. Fund the bridge out of the $90,000 delta between the two options, which is the only slack in the budget.
What would change the answer: if the vendor cannot bridge support or resequence, Option B becomes viable only with a contracted immutability specialist and a written 9-week checkpoint. Without both, the in-house path is a bet the team cannot currently cover.
2. During migration testing, you find that 0.4% of records (roughly 4,800) arrive with missing audit timestamps. The vendor calls this "cosmetic" and proposes backfilling with the migration date. How do you respond, and how does this affect the timeline you just committed to?
Read the worked answer
Reject the backfill as proposed, and treat this as a schedule event rather than a defect to negotiate later.
Why it is not cosmetic: the requirement is not 'a timestamp exists' but 'the timestamp evidences when the record was created or changed.' Stamping 4,800 records with the migration date manufactures false evidence. If an examiner samples any of them, the artefact is not a missing field - it is an inaccurate record, which converts a data-quality issue into a credibility issue. That is precisely the 'regulatory surprise' the sponsor excluded.
What to actually do:
- Classify the 4,800 by origin (source-system export defect, mapping omission, or field truncation) before any remediation decision. Do not remediate a category you have not diagnosed.
- Where the true timestamp is recoverable from source logs or backups, recover it. This is the only path that preserves evidential value.
- Where it is genuinely unrecoverable, mark the record explicitly as timestamp unavailable - reconstructed, retain the source extract as supporting evidence, and disclose the population and count to the regulator. A disclosed gap is survivable; a silent one is not.
- Re-run reconciliation after remediation and require a signed count of exceptions by category.
Timeline impact: put the archive cutover checkpoint at risk immediately and tell the sponsor this week, not at the checkpoint. Renegotiate the bridge period using the 4,800 figure as evidence, not the phrase 'minor data issues.'
3. The CFO asks: 'If I approve Option A, what is the single thing most likely to make this fail?' Answer in two sentences and justify the choice.
Read the worked answer
The most likely failure is not the migration technology - it is the loss of two engineers during a 20-week programme that depends on the six-person team absorbing a new operating model while also running the legacy system.
Why that risk outranks the others:
- Timing risk is already being actively managed through the bridge and the resequenced cutover.
- Vendor performance risk is contractually addressable - milestones, acceptance criteria, remedies.
- Knowledge risk is the one factor that compounds silently and degrades every other mitigation. The team is already down two people, has no immutability experience, and is being asked to learn a managed service mid-flight. If one more departure occurs, the bridge period stops being a buffer and becomes the whole plan.
The judgement the sponsor needs to make is therefore not 'A or B' but 'is A funded with retention and backfill, or is it a 20-week plan staffed by a four-person team?' Answer the second question honestly or the first is fiction.