What is the single most important risk control in a migration, and why?
Show the full answer Hide the answer
What is being tested
Whether you identify the control that bounds the consequence of every other thing going wrong.
Why reversibility
Every other control reduces the probability of a problem. Reversibility reduces its consequence, which is what matters because migrations surface things nobody anticipated — that is their defining characteristic.
With reversibility, a surprise is a revert and an investigation. Without it, the same surprise is an incident with no good options.
What it requires in practice
- Route behind a flag, so traffic shifts back instantly rather than requiring a deployment.
- Keep the source updated via reverse replication for a period after write cutover, so revert remains possible for a while afterwards.
- Name the point of no return explicitly in the plan.
- Take the irreversible step alone, after verification, rather than bundled with others.
- Test the rollback, rather than describing it.
The close second
Run-and-compare. Send production traffic to both systems, serve the old result, log every difference.
This is the only reliable way to discover the undocumented behaviour that no specification contains, and it will find dozens of cases. It converts unknown unknowns into a triage list, which is the single biggest source of migration surprise.
The full control set
| Risk | Control |
|---|---|
| Data loss or corruption | Verification at every stage; reconciliation; source kept intact |
| Undocumented behaviour missed | Run-and-compare on production traffic |
| Extended outage | Rehearsed cutover; phased rather than big-bang |
| No way back | Reversibility to the last step; tested rollback |
| Performance regression | Load test with production-scale data |
| Integration breakage | Contract tests; consumer inventory from actual traffic |
| Cancellation | Sequence so every step delivers value independently |
| Running both forever | Decommissioning budgeted; track capabilities remaining on legacy |
The general principle
Migrations concentrate risk at the cutover. Every technique that spreads it — phasing, gradual traffic shifting, capability-by-capability strangling — reduces total risk even though it increases total effort. That trade is almost always worth making, and the pressure to compress it usually comes from wanting the programme to be over rather than from a genuine constraint.