The Data Migration Dilemma
A $2M nonprofit is migrating its donor database to a cloud-based CRM. The project is 3 months behind schedule and 40% over budget. The vendor's implementation team has missed two milestones. The development director wants to go live next month to capture year-end giving. The IT consultant warns that the data mapping for recurring donors is incomplete and that 1,200 donor records have duplicate entries. The finance director is concerned that gift processing will fail during the critical giving season. The ED wants to 'just get it done' and fix issues later. The board's audit committee has asked for assurance that donor data will be secure and accurate. The vendor contract includes a 30-day cure period for performance issues but no penalty for delays.
1. What are the key risks of going live next month, and what should the ED recommend?
Read the worked answer
Key risks: (1) Data integrity-duplicate donor records and incomplete recurring gift mapping will cause inaccurate acknowledgments, missed gifts, and reporting errors; (2) Financial loss-failed gift processing during year-end could cost significant revenue and donor trust; (3) Security-rushing may skip security testing, exposing donor data; (4) Reputation-errors during giving season could damage donor relationships; (5) Contractual-the cure period is running, and going live may waive rights to remedy vendor performance.
Recommendation: Do not go live until data mapping for recurring donors is complete and duplicates are resolved. Instead, implement a phased approach: go live with a limited set of functions (e.g., one-time gifts) while keeping the legacy system for recurring gifts. Use the 30-day cure period to formally notify the vendor of performance issues and request a remediation plan. Present the audit committee with a risk assessment and a revised timeline. The ED should communicate to the development director that a failed go-live is worse than a delayed one.
2. How should the ED manage the vendor relationship and the board's concerns?
Read the worked answer
The ED should send a formal notice to the vendor citing the missed milestones and invoking the cure period, requesting a written remediation plan with dates. The ED should also review the contract for any leverage (e.g., final payment tied to acceptance) and consider withholding payment until issues are resolved. For the board, the ED should provide a clear status report with risks, mitigation steps, and a revised go-live date. The audit committee should be assured that data security testing will be completed before any live data is transferred. The ED should also establish a weekly project steering committee including finance, development, and IT to monitor progress and escalate issues.