Migration & Modernisation
Migration risk register
Twenty risks that materialise on integration migrations, each with an early warning sign. Score them for your estate and export.
Save inputs locally to resume this tool. Files may contain sensitive entered information; review before sharing. No automatic storage or transmission. Report JSON is an output record, not an input import format.
Twenty risks that materialise on integration migrations often enough to be worth pre-writing. Default likelihood and impact are ours; override both for your estate, exclude what does not apply, and export the result.
- In register
- 20
- High
- 8
- Medium
- 12
- Low
- 0
- Excluded
- 0
Where the included risks sit
Each cell counts included risks at that likelihood and impact. Score = likelihood × impact: low below 8, medium 8–14, high 15–25. Editing or excluding a risk updates this view.
| L / I | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | — | — | — | 1 | — |
| 4 | — | 1 | 4 | 2 | 1 |
| 3 | — | — | 1 | 6 | 4 |
| 2 | — | — | — | — | — |
| 1 | — | — | — | — | — |
Cell colours show score bands, not measured probabilities or guaranteed outcomes. The risk details and mitigations remain below.
- ScopeThe interface inventory is incompletehigh · 20
Interfaces surface after the plan is baselined, usually from a team that was not in the workshops.
Early warning
Someone says 'there's also the one that…' in a status meeting.Mitigation
Reconcile the inventory against platform logs and firewall rules, not against memory. Budget contingency as a percentage of interface count, not of effort. - Third partyPartner re-certification takes longer than plannedhigh · 20
Trading partners must retest and approve on their own change calendar, which is not yours to compress.
Early warning
The first partner takes more than two weeks to respond to the initial contact.Mitigation
Open the conversation in week one regardless of when the build lands. Sequence partner work by their responsiveness, not by your convenience. - DeliveryTest data is unavailable or unrepresentativehigh · 16
Testing proves the happy path because that is the only data anyone can produce.
Early warning
Test cases all use the same three records.Mitigation
Capture and mask a slice of production traffic early. Include the awkward records deliberately — long names, negative quantities, missing optional fields. - DeliveryNon-production does not resemble productionhigh · 16
Integration points are stubbed, volumes are tiny, and configuration differs.
Early warning
A defect is described as 'works in test'.Mitigation
Treat environment parity as a deliverable of the foundation phase with its own acceptance criteria. - TechnicalCustom code has no equivalent on the targethigh · 15
Java services, scripts or a transformation language the new platform cannot express.
Early warning
A capability comparison produces the phrase 'we can work around that'.Mitigation
Identify these before platform selection, not after. They often justify keeping a capability where it is rather than moving it. - OperationalRollback has never been testedhigh · 15
A documented rollback that has not been rehearsed is an assumption, not a plan.
Early warning
The rollback step in the runbook has no duration against it.Mitigation
Rehearse rollback in a non-production cutover. Time it. If it exceeds the window, it is not a rollback plan. - DeliveryLegacy platform expertise leaveshigh · 15
The one person who understands the old estate resigns or is reassigned.
Early warning
Only one name appears against the legacy platform in every conversation.Mitigation
Extract knowledge into the inventory and runbooks early, while there is no urgency. Pair them with someone from day one. - CommercialThe old platform is never switched offhigh · 15
A handful of interfaces are too hard to move, so both platforms run permanently and the saving never lands.
Early warning
The hardest interfaces keep moving to a later wave.Mitigation
Do the hardest interfaces early, while contingency exists. Name a person accountable for decommissioning with a date. - Third partyPartner allow-lists still point at the old platformmedium · 12
Egress addresses change with the platform and partners must update firewall rules.
Early warning
Nobody can produce the list of partners who allow-list you.Mitigation
Collect egress requirements before the pilot. Where possible keep a stable outbound address so partners never have to change. - TechnicalConfiguration is hard-coded inside interfacesmedium · 12
Endpoints, credentials and business rules set inline rather than externalised, discovered on promotion.
Early warning
The same interface behaves differently in two environments and nobody can say why.Mitigation
Scan for literals before estimating. Externalising configuration is migration work that is usually left out of the estimate entirely. - TechnicalSubtle behaviour differences reach productionmedium · 12
Rounding, null handling, date formats, character encoding and ordering differ between platforms.
Early warning
Output is compared by eye rather than by diff.Mitigation
Run old and new in parallel against the same input and compare programmatically. Manual comparison finds the obvious differences only. - TechnicalBehaviour differs at production volumemedium · 12
Timeouts, memory limits, throttling and batch sizes that never appear in testing.
Early warning
Peak volumes are unknown or quoted as averages.Mitigation
Load test the largest interfaces at peak plus headroom, before cutover rather than after. - OperationalA certificate or key expires mid-migrationmedium · 12
Expiry lands during the programme and is initially diagnosed as a migration defect.
Early warning
There is no inventory of certificates with expiry dates and owners.Mitigation
Build the certificate inventory during discovery and renew anything expiring inside the programme window plus three months. - OperationalThe cutover window is too shortmedium · 12
The plan assumes everything goes right, and the go/no-go point arrives after the point of no return.
Early warning
The runbook has no explicit go/no-go time.Mitigation
Set the go/no-go decision at a point where rollback still fits in the remaining window, and hold to it. - OperationalMonitoring is not migrated with the interfacesmedium · 12
Interfaces move but alerting, dashboards and log routing stay pointed at the old platform.
Early warning
The monitoring workstream has no owner.Mitigation
Treat monitoring as part of the definition of done for each interface, not as a separate phase. - ScopeUndocumented downstream consumersmedium · 12
Someone reads a file, a table or a queue that was never considered an interface.
Early warning
A staging table or shared folder has more readers than the design shows.Mitigation
Trace consumers from the data, not the documentation. Announce decommissioning early and loudly enough that they surface. - DeliverySource system teams are unavailable when neededmedium · 12
Migration needs their time for testing and cutover, which is not in their plan.
Early warning
Their commitment exists in your plan but not in theirs.Mitigation
Get named people and dates into their planning cycle, not yours. Sequence waves around their availability. - CommercialDual-running costs are not budgetedmedium · 12
Both platforms are licensed and supported in parallel, sometimes for a year.
Early warning
The business case shows the old platform cost ending at go-live.Mitigation
Budget the overlap explicitly and negotiate licence terms for it before signing the target platform. - CommercialA wave collides with a business freezemedium · 9
Year end, peak season or a regulatory window blocks change for weeks.
Early warning
The plan has no freeze periods marked on it.Mitigation
Map freezes before sequencing. A collision costs a quarter, not a sprint. - ScopeDead interfaces are migrated anywaymedium · 8
Nobody will confirm an interface is unused, so it gets migrated to be safe.
Early warning
An interface has no owner and no message in the last quarter, but is still in scope.Mitigation
Turn it off in place for a fixed period before the migration and see who complains. Migrating it is the more expensive way to find out.
A generic register is not a risk assessment. Twenty risks that could happen is a starting list; knowing which three will actually bite your estate needs someone who has seen it, and usually needs the inventory first. Talk to us about yours.
Every risk here carries an early warning sign, because a risk you can only detect after it has happened is not a risk — it is an issue with better paperwork. Nothing is stored; export as you go.
More in this category
These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.
Stay ahead of the integration layer.
Integronauts Signal — practical enterprise integration, API and agentic AI thinking. The tools stay free either way.
Integronauts Signal is launching soon.
Practical enterprise integration, APIs, agentic AI and emerging architecture. Sign-up opens when the list does — nothing to enter yet.