Acquisition, Development and Implementation · Topic 4 of 4
Migration, Data Conversion and Post-Implementation Review
Parallel, phased, pilot and direct changeover, infrastructure deployment, data conversion controls and the post-implementation review for CISA.
- 3 min
- Includes a diagram
- Parallel is safest and costliest; direct cutover is riskiest.
- Reconcile record counts and control totals in data conversion.
- Data owners sign off converted data.
What it is
Migration moves the business from the old system to the new one. It includes deploying infrastructure and converting data from old formats to new. The post-implementation review (PIR) comes afterwards and asks whether the project delivered its objectives and benefits and what can be learned.
How it works
Changeover methods
| Method | How it works | Risk | Cost |
|---|---|---|---|
| Parallel changeover | Old and new systems run together and results are compared | Lowest | Highest (double work) |
| Phased changeover | Modules or functions move over in stages | Moderate | Moderate |
| Pilot | One site or group goes live first | Moderate | Moderate |
| Direct (abrupt) cutover | The old system is switched off and the new one switched on | Highest | Lowest |
With a direct cutover, a tested fallback plan matters most, because there is no old system running to return to.
Infrastructure deployment
New servers, networks or cloud resources must be built to approved, hardened configurations, with capacity sized for the expected load, monitoring and backup in place, and access limited before data arrives. Deployment by scripts or templates (infrastructure as code) makes builds repeatable and auditable.
Data conversion
Data conversion is one of the riskiest parts of implementation. Controls include:
| Control | Purpose |
|---|---|
| Data mapping and cleansing | Old fields map correctly to new ones; bad data is fixed before moving |
| Record counts | Same number of records before and after |
| Control totals | Sums of key amounts match before and after |
| Sample checks | Individual records compared field by field |
| Exception handling | Records that fail conversion are logged and resolved |
| Sign-off by data owners | The business confirms the converted data is complete and accurate |
| Retention of old data | Old data and the conversion trail are kept for audit and fallback |
The auditor's main concern is that converted data is complete and accurate and that this has been proven by reconciliation, not assumed.
Post-implementation review
A PIR usually takes place after the system has run long enough for benefits to show. It covers:
- Whether the business case benefits are being achieved, measured against the original targets.
- Whether user needs are met and controls work as designed.
- What went well and badly in the project (lessons learned).
- Open issues and recommendations, with owners.
An IS auditor who was not part of the project team can perform or review the PIR independently. Recommendations from PIRs should be tracked, or the same lessons repeat.
When a question asks how to confirm a migrated system holds all the old data, look for reconciliation of record counts and control totals, signed off by the data owner.
How the exam asks about this
- "Which changeover has the lowest risk?" Parallel changeover.
- "What is the PRIMARY purpose of a PIR?" To assess whether the project met its objectives and delivered the expected benefits.
- "Conversion succeeded according to the vendor." Verify with independent reconciliation before relying on it.
What to remember for the exam
- Parallel is safest and costliest; direct cutover is riskiest.
- Reconcile record counts and control totals in data conversion.
- Data owners sign off converted data.
- Keep old data and conversion logs.
- PIR measures benefits against the business case and captures lessons.
Decommissioning the old system immediately after a direct cutover removes the fallback and the reference data needed to investigate conversion errors.
Common mistakes
Doing the PIR too early, before benefits can be measured.
Relying on the conversion tool's success message. Reconcile independently.
Never following up PIR recommendations.
Check yourself
Which changeover method runs old and new systems at the same time?
Parallel changeover.
Name two controls that show data conversion was complete.
Matching record counts and matching control totals before and after conversion.
When should a post-implementation review usually take place?
After the system has operated long enough for its benefits and issues to be measured.
Topic 4 of 4 in Acquisition, Development and Implementation
Test yourself on Acquisition, Development and Implementation
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.