Risk register
Append-only. Trigger, warning sign and response for each recurring migration risk.
| Risk | Warning sign | Response |
|---|---|---|
| Unsupported migration path | Support for the exact source and target cannot be confirmed | Obtain current product confirmation or select another method before approval |
| Throughput shortfall | Rehearsal misses the window or the recovery allowance | Re-sequence, add capacity, reduce scope or revise the continuity design |
| Migration unit too large to restart | Any single unit designed to run beyond roughly twelve hours | Decompose into modules that complete, verify and bank inside the window |
| Unverified module backlog | Modules loaded but integrity checks deferred during rolling catch-up | Treat a rising unverified count as a stop condition, not a catch-up task |
| Instrumentation interfering with the run | Monitoring, auditing or housekeeping contending with migration workload | Test observability under load during rehearsal; it is part of the system, not outside it |
| Incomplete dependency discovery | A BI, ETL or access dependency emerges late | Update the inventory and cutover grouping; re-test acceptance |
| Estate larger than the centre believes | Undocumented LoB domains surfacing after the business case was set | Verify the inventory against system evidence before costing; re-baseline openly |
| Analytical asset has become operational | A warehouse output found feeding billing, pricing, payments or regulatory reporting | Isolate it, escalate it, govern it separately from the reporting migration |
| Scope never reduced | No retirement decisions taken; everything is “critical” | Escalate to sponsor; use usage evidence to force the decision |
| Code conversion underestimated | Conversion output failing review at a rate above forecast | Re-baseline from measured throughput, not from object counts |
| Method chosen on volume, not complexity | Estimates built from data size with no dependency or object assessment | Score model complexity before selecting; revisit the method if the score moves |
| Estimate generalised from a simpler dataset | Confidence drawn from a previous bulk load of uniform data | Re-estimate against this model’s dependency depth and non-data objects |
| Project shape fights the architecture | Wave boundaries keep splitting shared integration objects | Re-cut waves at the consumer layer, or dual-run the foundation |
| Temporary component acquiring dependencies | A new consumer, feed or extension request against the interim build | Refuse the dependency; restate the decommission trigger to the sponsor |
| Reconciliation exception | Counts or business checks differ | Triage with the owner; define correction, acceptance or rollback |
| Performance regression | Critical workload misses the baseline | Check statistics first; then plans, parallelism and concurrency shape |
| Performance tested below full volume | Test environment smaller than production; subset timings used as evidence | Escalate as a finding; qualitative behaviour changes with scale and subsets mislead |
| No rectification capacity in the plan | Tuning time held as contingency rather than a resourced workstream | Name, staff and schedule it; performance problems are certain, not probable |
| Divergence presumed to be migration defect | Users challenging figures the new platform has improved | Publish the divergence catalogue with named business owners before release |
| Correction triggers external restatement | A corrected metric feeds financial, regulatory or market reporting | Escalate to finance, legal and compliance at discovery; decide whether to correct or preserve |
| Source decommissioned while divergences open | Reconciliation requests arriving with no way to reproduce old figures | Extend source retention and preserve the ability to run old transformations |
| Feeder evidence unavailable | Upstream systems being decommissioned or archived during the migration | Secure feeder extracts for disputed periods before those systems are retired |
| Security boundary failure | A credential, encryption or sovereignty control has not been demonstrated | Stop movement across that boundary until the control is corrected |
| Irreversible cutover | Target writes or a downstream switch invalidate return | Name the boundary, the authority and the source-preservation actions before crossing |
| Abort point relitigated on the night | Pressure to continue past an agreed milestone that has been missed | Pre-agree the milestone, the named authority and the escalation route; do not decide by consensus in the room |
| Rewind duration unverified | Abort arithmetic resting on an estimated rewind time | Time the rewind during rehearsal as an objective in its own right |
For each risk record likelihood, impact, owner, due date, planned response, fallback, evidence and current decision. Give open questions a decision date so they do not quietly disappear into the plan.