The Legacy Ledger Migration Dilemma
Midlands Manufacturing plc runs its financial consolidation on a 15-year-old COBOL-based ledger system. The system is stable but expensive to maintain: only two contractors understand the code, and they charge £1,200 per day. The CFO wants to migrate to a modern ERP cloud solution within 18 months. The IT director proposes a 'big bang' cutover during the year-end close, arguing that parallel running would double costs. The external auditors have flagged that the current system lacks segregation of duties controls: the same user can create and approve journal entries. A recent penetration test revealed unencrypted backups stored offsite. The board has set a risk appetite that tolerates no more than a 5% chance of a material misstatement in financial reporting. The project budget is £2.5m, and the vendor's implementation partner has quoted £2.8m for a phased approach with parallel running for two quarters. The CFO is under pressure to reduce costs and wants to proceed with the big bang to save £300k.
1. Evaluate the IT director's proposal for a big bang cutover against the board's risk appetite and the audit findings. Recommend an approach, justifying your reasoning with reference to governance and control principles.
Read the worked answer
The big bang cutover during year-end close is unacceptable given the board's risk appetite of no more than 5% chance of material misstatement. Year-end is the period of highest financial reporting risk, and a cutover then would amplify the chance of error. The existing system already has control weaknesses (lack of segregation of duties, unencrypted backups), which increase the baseline risk. A phased approach with parallel running for two quarters, although costing £300k more, provides a control environment where outputs can be reconciled, errors detected, and audit trails maintained. This aligns with governance principles of risk management and internal control (e.g., COBIT's focus on risk optimisation). The cost saving of £300k is trivial compared to the potential cost of a material misstatement, which could lead to restatements, reputational damage, and regulatory sanctions. Therefore, I recommend the phased approach, with parallel running, and using the migration as an opportunity to implement proper segregation of duties and encryption of backups. The decision should be documented and approved by the audit committee.
2. Identify the control deficiencies in the current system and explain how they should be addressed in the new system, referencing at least two COBIT governance objectives.
Read the worked answer
Control deficiencies: (1) Lack of segregation of duties – same user can create and approve journal entries. This violates the principle of segregation of duties and increases fraud and error risk. In the new system, role-based access controls should be configured so that creation and approval are separate roles, with no user having both. (2) Unencrypted backups – data at rest is vulnerable. The new system should enforce encryption of backups both at rest and in transit. (3) Reliance on two contractors – knowledge concentration risk. The new system should include documentation and knowledge transfer. COBIT objectives: (a) APO01 Manage IT Management Framework – ensure a control framework is in place; (b) DSS06 Manage Business Process Controls – ensure that business process controls, including segregation of duties, are embedded. Also, MEA02 Monitor, Evaluate and Assess the System of Internal Control. Addressing these in the new system will improve the control environment and align with the board's risk appetite.