Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 5 of 5

Contingency, fallback and the point of no return

11 min

Every cutover plan needs a credible answer to the question "what if it does not work?". That answer is the contingency plan. It covers repairing a single failed step, abandoning the cutover and returning to the legacy system, and running the business with workarounds if problems appear after the system is live. This lesson shows how to design each, and how to set the decision points that make them usable.

Three responses, three moments

ResponseWhat it meansWhen it applies
Rollback a stepUndo one failed load or conversion step and repeat itWithin the window, when the step can be repeated in the remaining float
FallbackAbandon the cutover, restore the pre-cutover state and resume business in the legacy systemBefore the point of no return, when go-live criteria cannot be met in time
Fix forwardStay live and correct problems in the new system, with workaroundsAfter the point of no return, or when the issue is contained and has a workaround
Three contingency responses. Each has a time when it is the right choice.
The Sign-Off Table · thesignofftable.com/academy/sap-pmo-301

The point of no return

The point of no return is the step after which fallback is no longer feasible, usually because real business activity has happened in the new system and cannot be cleanly moved back. For Contoso, Luis set it at Monday 06:00, when interfaces to the carrier and the bank are switched to the new system and the first real shipments leave. Before that point, fallback is costly but possible. After it, the program fixes forward.

Decision deadlines from measured fallback time

Fallback takes time: restore the backup, reopen the legacy system, re-enable interfaces, and tell users. Mock 2 measured that at nine hours for Contoso. The latest safe time to start fallback is therefore the end of the window minus the fallback duration minus a safety margin. Go/no-go points must fall before that time, with their criteria agreed in advance, so the decision group is choosing between options rather than discovering that one has expired.

  1. Fri 18:00Legacy locked, backup takenStart of window; fallback is cheap
  2. Sat 18:00Go/no-go 1Data loaded and reconciled; a failed load can still be repeated
  3. Sun 14:00Go/no-go 2Verification passed; final decision to release the business
  4. Mon 06:00Point of no returnInterfaces live, first shipments leave; fix forward from here
Contoso's decision points, set from the measured nine-hour fallback.
The Sign-Off Table · thesignofftable.com/academy/sap-pmo-301

What a fallback plan contains

  • The trigger: which go/no-go criteria, if failed, lead to fallback, and who decides.
  • The technical steps: restore or disable the new system, reopen the legacy system, re-point interfaces, with owners and times taken from the rehearsal.
  • The business steps: unlock legacy users, re-enter any transactions captured manually during the window, re-run blocked jobs.
  • The communications: to users, executives, customers and suppliers, pre-written.
  • The next attempt: how quickly a new cutover date can be chosen, and what must be fixed first.

Business contingency

Contingency is not only technical. Plan how the business keeps running if go-live is late or the first days are rough: shipments staged before the freeze, a manual order log for urgent customers such as Great Lakes Fleet Services, extra safety stock of CMC-ALT-100 at both plants, supplier deliveries from Lakeside Components scheduled around the window, and agreed workarounds for known issues. Maria and Dan should each own the business contingency for their area.

  1. Has a go/no-go criterion failed?No → continue to the next checkpoint · Yes → next question
  2. Can it be fixed and re-proven before the decision deadline?Yes → rollback the step and repeat it · No → next question
  3. Have we passed the point of no return?No → fallback remains available; decision group chooses fallback or accepts the risk · Yes → fix forward with workarounds and hypercare
  4. If the risk is accepted, is it documented with owner and conditions?Yes → proceed and track · No → do not proceed until it is
From a failed criterion to the right contingency response.
The Sign-Off Table · thesignofftable.com/academy/sap-pmo-301

What would you do?

At go/no-go 2 on Sunday 14:00, verification shows that output of delivery notes fails at the Chicago plant. A workaround exists (printing from a central printer and couriering), and IT expects a fix by Tuesday. All other criteria are met. What is the most defensible decision?

Key points
  • Rollback repeats a step, fallback returns to legacy, fix forward stays live with workarounds.
  • The point of no return is when fallback stops being feasible; set it explicitly.
  • Derive go/no-go deadlines from the measured fallback duration plus a margin.
  • Plan business contingency and pre-written communications, not just technical restore steps.

Check your understanding · not graded

Lesson check

  1. 1. The point of no return in cutover is:

  2. 2. How is the latest safe time to start fallback determined?

  3. 3. Which response fits a failed load step that can be repeated within the remaining float?

  4. 4. Which is an example of business contingency?