The Overnight Migration Window
A regional insurer is moving its claims intake from an on-premise system to a hosted platform over a single weekend. The vendor's cutover plan allots 14 hours. On the Friday before, the operations lead reports that the data reconciliation script has only been tested against 2 of the 9 source tables, and that the rollback procedure requires restoring a 6 TB backup that takes an estimated 9 hours. The business owner says the Monday claims deadline is non-negotiable because regulators require intake within 48 hours. Nobody has documented what 'complete migration' means for sign-off, and the vendor contract has no acceptance criteria clause. The project sponsor asks whether to proceed.
1. Identify the core control weaknesses in this cutover plan and explain why the sponsor cannot make a sound go/no-go decision on the current information.
Read the worked answer
The plan has three separable weaknesses. First, verification is incomplete: testing reconciliation on 2 of 9 tables means roughly 78% of the source data has no proven path, so nobody knows whether the migration will be correct. Second, recovery is infeasible inside the window: a 9-hour restore against a 14-hour window leaves only 5 hours for actual migration work, and any failure late in the window pushes recovery past Monday. Third, acceptance is undefined: without documented completion criteria or a contract clause, sign-off becomes a matter of opinion, and disputes about defects have no reference point.
The sponsor cannot decide rationally because the decision inputs are missing, not merely unfavourable. A go/no-go needs a defined success state, a tested rollback, and evidence that the data path works. The correct move is to defer the cutover or run a partial, reversible pilot on one or two tables, and to negotiate acceptance criteria before any data moves.
2. The business owner proposes skipping the rollback rehearsal to save time. Evaluate this proposal.
Read the worked answer
Skipping the rehearsal trades a known, bounded cost (hours now) for an unknown, unbounded cost (a failed cutover with no working recovery). The rollback is the only thing standing between a mid-window failure and a regulatory breach on Monday. An untested 9-hour restore is not a plan; it is an assumption, and restore times routinely exceed estimates because of media errors, index rebuilds, and network throughput.
A defensible alternative is to rehearse the restore on a subset or to verify backup integrity and measure actual throughput, then re-plan the window around the measured figure. If the measured restore cannot fit, the cutover should move. The owner's deadline pressure is real, but missing the deadline because of a controlled deferral is recoverable; missing it because of a failed cutover with no recovery is not.