A High Risk With No Owner and a Discount Expiring

Why the entry cannot support a decision. 'Migration risk - High' on a 3x3 matrix is a label, not an assessment. It has no owner, no cause, no consequence, no treatment and no review date. It also flattens genuinely different risks into one, so it cannot distinguish a batch-feed failure from a cost overrun. Executives cannot trade off a label.

What the assessment must add.

• Decomposition: separate risks for batch feed continuity, data integrity across four million records, DR readiness, regulatory notification timing, vendor lock-in and release sequencing. Each gets its own owner.
• Cause → event → consequence, so treatment can target the cause rather than the symptom.
• Calibrated likelihood and impact, with impact expressed in the bank's own terms - hours of critical service unavailability, records affected, regulatory breach - rather than 'High'.
• Velocity and proximity: how fast the risk would materialise and how soon it could. A DR gap that is untested is not equally risky in release one and release six.
• Inherent vs residual position, with the effect of proposed treatments stated explicitly.
• Risk appetite: what level of critical-service disruption the bank is prepared to accept. Without it, the board cannot say whether any residual level is tolerable.

Judgement point. The vendor discount is a cost consideration, not a risk assessment input. It should be priced as one factor in the decision, not allowed to set the timetable.

Recommendation: proceed conditionally, not unconditionally, and not on the vendor's clock.

Conditions before release one.

• Named risk owners for batch continuity, data integrity and DR, with treatments and target dates in the plan itself, not a parallel document.
• DR tested on the cloud target for at least one critical service; an untested plan is an assumption, and release one is the cheapest time to convert it into evidence.
• Regulatory notification path agreed with compliance, including what constitutes 'material' and who signs the notification.
• Release one scoped as a reversible pilot - non-critical data or a single feed - with explicit exit criteria and a documented rollback. Reversibility is what makes an early start defensible.
• Trigger thresholds defined in advance, so a decision to pause is pre-agreed rather than argued under pressure.

How to govern it.

• The programme board owns the decision and the residual risk position; the CIO is accountable for the plan; risk owners report status against treatments at each release gate.
• Gate reviews test evidence, not confidence: DR test result, data reconciliation figures, feed continuity records.
• Report residual risk to the governing body at a stated cadence, with the appetite statement alongside it so the board can judge tolerance rather than just receive a colour.

On the discount. If the commercial benefit is real, seek to secure it contractually with a conditional start rather than compressing the assurance work. A discount that buys an unmanaged critical-service risk is not a saving.

Trade-off to state plainly. Conditional start may delay release one by some weeks and puts the discount at risk. The alternative is accepting a known, untested exposure on services the regulator already watches - which no governing body can evidence as a sound decision.