Integration & APIs

Migration risk register

Twenty risks that materialise on integration migrations, each with an early warning sign. Score them for your estate and export.

Twenty risks that materialise on integration migrations often enough to be worth pre-writing. Default likelihood and impact are ours; override both for your estate, exclude what does not apply, and export the result.

In register: 20
High: 8
Medium: 12
Low: 0
Excluded: 0

ScopeThe interface inventory is incompletehigh · 20
Interfaces surface after the plan is baselined, usually from a team that was not in the workshops.
Early warning
Someone says 'there's also the one that…' in a status meeting.
Mitigation
Reconcile the inventory against platform logs and firewall rules, not against memory. Budget contingency as a percentage of interface count, not of effort.
Likelihood5Impact4
Third partyPartner re-certification takes longer than plannedhigh · 20
Trading partners must retest and approve on their own change calendar, which is not yours to compress.
Early warning
The first partner takes more than two weeks to respond to the initial contact.
Mitigation
Open the conversation in week one regardless of when the build lands. Sequence partner work by their responsiveness, not by your convenience.
Likelihood4Impact5
DeliveryTest data is unavailable or unrepresentativehigh · 16
Testing proves the happy path because that is the only data anyone can produce.
Early warning
Test cases all use the same three records.
Mitigation
Capture and mask a slice of production traffic early. Include the awkward records deliberately — long names, negative quantities, missing optional fields.
Likelihood4Impact4
DeliveryNon-production does not resemble productionhigh · 16
Integration points are stubbed, volumes are tiny, and configuration differs.
Early warning
A defect is described as 'works in test'.
Mitigation
Treat environment parity as a deliverable of the foundation phase with its own acceptance criteria.
Likelihood4Impact4
TechnicalCustom code has no equivalent on the targethigh · 15
Java services, scripts or a transformation language the new platform cannot express.
Early warning
A capability comparison produces the phrase 'we can work around that'.
Mitigation
Identify these before platform selection, not after. They often justify keeping a capability where it is rather than moving it.
Likelihood3Impact5
OperationalRollback has never been testedhigh · 15
A documented rollback that has not been rehearsed is an assumption, not a plan.
Early warning
The rollback step in the runbook has no duration against it.
Mitigation
Rehearse rollback in a non-production cutover. Time it. If it exceeds the window, it is not a rollback plan.
Likelihood3Impact5
DeliveryLegacy platform expertise leaveshigh · 15
The one person who understands the old estate resigns or is reassigned.
Early warning
Only one name appears against the legacy platform in every conversation.
Mitigation
Extract knowledge into the inventory and runbooks early, while there is no urgency. Pair them with someone from day one.
Likelihood3Impact5
CommercialThe old platform is never switched offhigh · 15
A handful of interfaces are too hard to move, so both platforms run permanently and the saving never lands.
Early warning
The hardest interfaces keep moving to a later wave.
Mitigation
Do the hardest interfaces early, while contingency exists. Name a person accountable for decommissioning with a date.
Likelihood3Impact5
Third partyPartner allow-lists still point at the old platformmedium · 12
Egress addresses change with the platform and partners must update firewall rules.
Early warning
Nobody can produce the list of partners who allow-list you.
Mitigation
Collect egress requirements before the pilot. Where possible keep a stable outbound address so partners never have to change.
Likelihood3Impact4
TechnicalConfiguration is hard-coded inside interfacesmedium · 12
Endpoints, credentials and business rules set inline rather than externalised, discovered on promotion.
Early warning
The same interface behaves differently in two environments and nobody can say why.
Mitigation
Scan for literals before estimating. Externalising configuration is migration work that is usually left out of the estimate entirely.
Likelihood4Impact3
TechnicalSubtle behaviour differences reach productionmedium · 12
Rounding, null handling, date formats, character encoding and ordering differ between platforms.
Early warning
Output is compared by eye rather than by diff.
Mitigation
Run old and new in parallel against the same input and compare programmatically. Manual comparison finds the obvious differences only.
Likelihood3Impact4
TechnicalBehaviour differs at production volumemedium · 12
Timeouts, memory limits, throttling and batch sizes that never appear in testing.
Early warning
Peak volumes are unknown or quoted as averages.
Mitigation
Load test the largest interfaces at peak plus headroom, before cutover rather than after.
Likelihood3Impact4
OperationalA certificate or key expires mid-migrationmedium · 12
Expiry lands during the programme and is initially diagnosed as a migration defect.
Early warning
There is no inventory of certificates with expiry dates and owners.
Mitigation
Build the certificate inventory during discovery and renew anything expiring inside the programme window plus three months.
Likelihood3Impact4
OperationalThe cutover window is too shortmedium · 12
The plan assumes everything goes right, and the go/no-go point arrives after the point of no return.
Early warning
The runbook has no explicit go/no-go time.
Mitigation
Set the go/no-go decision at a point where rollback still fits in the remaining window, and hold to it.
Likelihood3Impact4
OperationalMonitoring is not migrated with the interfacesmedium · 12
Interfaces move but alerting, dashboards and log routing stay pointed at the old platform.
Early warning
The monitoring workstream has no owner.
Mitigation
Treat monitoring as part of the definition of done for each interface, not as a separate phase.
Likelihood4Impact3
ScopeUndocumented downstream consumersmedium · 12
Someone reads a file, a table or a queue that was never considered an interface.
Early warning
A staging table or shared folder has more readers than the design shows.
Mitigation
Trace consumers from the data, not the documentation. Announce decommissioning early and loudly enough that they surface.
Likelihood3Impact4
DeliverySource system teams are unavailable when neededmedium · 12
Migration needs their time for testing and cutover, which is not in their plan.
Early warning
Their commitment exists in your plan but not in theirs.
Mitigation
Get named people and dates into their planning cycle, not yours. Sequence waves around their availability.
Likelihood4Impact3
CommercialDual-running costs are not budgetedmedium · 12
Both platforms are licensed and supported in parallel, sometimes for a year.
Early warning
The business case shows the old platform cost ending at go-live.
Mitigation
Budget the overlap explicitly and negotiate licence terms for it before signing the target platform.
Likelihood4Impact3
CommercialA wave collides with a business freezemedium · 9
Year end, peak season or a regulatory window blocks change for weeks.
Early warning
The plan has no freeze periods marked on it.
Mitigation
Map freezes before sequencing. A collision costs a quarter, not a sprint.
Likelihood3Impact3
ScopeDead interfaces are migrated anywaymedium · 8
Nobody will confirm an interface is unused, so it gets migrated to be safe.
Early warning
An interface has no owner and no message in the last quarter, but is still in scope.
Mitigation
Turn it off in place for a fixed period before the migration and see who complains. Migrating it is the more expensive way to find out.
Likelihood4Impact2

A generic register is not a risk assessment. Twenty risks that could happen is a starting list; knowing which three will actually bite your estate needs someone who has seen it, and usually needs the inventory first. Talk to us about yours.

Every risk here carries an early warning sign, because a risk you can only detect after it has happened is not a risk — it is an issue with better paperwork. Nothing is stored; export as you go.

Other tools

These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.

Tell us what you're running