Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 3 of 5

Fallback testing

11 min

Listen to this lesson

0:00 / 8:06

Every cutover plan has a section called something like "fallback" or "rollback." In many programs that section has never been executed. It describes how to restore the old system, reopen it to users and resume business, and the first time anyone tries it is during a crisis at three in the morning. A fallback plan you have not tested is a hope, not a plan.

Rollback, fallback and fix-forward

OptionWhat it meansWhen it applies
Rollback (restore)Return the target system to a known state, usually from a backup taken at a defined point, and redo steps.A load or conversion step failed and you have time to repeat it within the window.
Fallback (to legacy)Abandon this cutover attempt and reopen the legacy system for business.The cutover cannot finish in time or a go-live critical issue cannot be fixed.
Fix forwardStay on the new system and fix the problem there.After the point of no return, or when the issue is contained and has a workaround.

Three different responses to trouble; each needs its own steps and decision criteria.

The point of no return

The point of no return is the moment after which falling back costs more than fixing forward. Before it, the legacy system still holds the truth and can be reopened. After it, the new system has taken real business transactions (orders entered, goods shipped, invoices sent, payments made, interface messages exchanged with partners) that the old system knows nothing about. Falling back then means re-keying or losing that activity.

For Contoso, Luis set the point of no return at the moment interfaces to the carrier and the bank are switched to the new system and the first real shipments leave the Detroit and Chicago plants. Until then, the ECC system is locked but intact, and fallback means unlocking it, re-enabling its background jobs and pointing interfaces back.

  1. Is the cutover still within the time window with contingency left?Yes → continue to the next checkpoint · No → convene the go/no-go group now
  2. Has a checkpoint failed?Yes → can it be fixed and re-proven before the next decision point? · No → continue
  3. Can the failure be fixed in time?Yes → rollback the step and repeat it · No → fall back to legacy
  4. Have we passed the point of no return?Yes → fix forward with a workaround and hypercare · No → fallback remains available
Decision points during the cutover window. Each one needs a named decision maker and a deadline.
The Sign-Off Table · thesignofftable.com/academy/sap-tst-309

What a fallback test covers

You do not need to rehearse a full fallback at every mock, but you do need to prove each fallback step at least once, timed, before go-live. A practical approach is to run a fallback test at the end of mock 2, after the main cutover tasks are done.

  • Backup and restore: the Basis team restores the target system to the pre-load backup and records how long it takes. That time must fit inside the window with the decision deadline.
  • Legacy reopening: unlock users, release suspended background jobs, reverse any period or posting locks, and confirm that a key user can transact in ECC.
  • Interface reversal: point inbound and outbound interfaces back to the legacy system and confirm a test message flows each way with the partner's agreement.
  • Data delta: identify any transactions entered in the new system before fallback and how they will be re-entered in legacy.
  • Communication: the message to users, partners and management, who sends it and when.

Defining decision points

Fallback needs a decision, and a decision needs a decision maker, a deadline and criteria. Write them into the runbook as go/no-go points: for example, "Saturday 18:00: if the finance balance reconciliation is not signed by Dan, the go/no-go group decides between a second load attempt and fallback." The latest safe time to start fallback is the end of the window minus the measured fallback duration minus a margin. Your fallback test gives you that duration.

  1. Fri 18:00Legacy locked, backup takenStart of window; fallback is cheap.
  2. Sat 18:00Go/no-go 1: data loaded and reconciledRollback of a load step still possible.
  3. Sun 08:00Latest fallback startWindow end minus measured fallback time (9h) minus margin.
  4. Sun 14:00Go/no-go 2: verification passedFinal decision to release the business.
  5. Mon 06:00Point of no returnInterfaces live, first shipments leave; fix forward from here.
Contoso's decision points, derived from the measured fallback duration.
The Sign-Off Table · thesignofftable.com/academy/sap-tst-309

What would you do?

During Contoso's dress rehearsal, the restore from backup takes 9 hours, not the 4 hours written in the fallback plan. What should Priya and Luis do?

Key points
  • Rollback, fallback and fix-forward are different responses; each needs its own steps and criteria.
  • The point of no return comes when the new system holds business activity the legacy system does not.
  • Test each fallback step at least once, timed: restore, legacy reopening, interface reversal, data delta, communication.
  • Set the latest fallback start from the measured fallback duration, and name the decision maker for each go/no-go point.

Check your understanding · not graded

Lesson check

  1. 1. What defines the point of no return in a cutover?

  2. 2. Which is a fallback test step rather than a rollback step?

  3. 3. How should the latest fallback start time be set?

  4. 4. Why ask for a timed restore during a rehearsal?