Use decision gates between dependent steps
| Step | Owner | Evidence | Proceed only when |
|---|---|---|---|
| Freeze source changes | Business lead | Freeze time and pending-work list | Users know the fallback route |
| Final extract | Data operator | Export revision and row totals | Boundary matches the freeze |
| Import and reconcile | Migration owner | Accepted/rejected totals and sample matches | Critical mismatches resolved |
| Open new system | Release decision maker | Recorded go decision and release version | Agreed acceptance tests pass |
Replace role labels with named people and add actual start/end times in the working file. Keep the fallback and rollback owner available for the window. A task’s planned time is not evidence that it completed.
Agree how to stop before starting
Example stop condition: accepted and rejected totals cannot account for the final extract. Hold opening the new system and inspect the difference. If users have already made new records, a rollback needs a reconciliation decision for those writes; switching the application version alone may be insufficient.
The import passes, but the named business approver is unavailable. What should happen?
Show the worked answer
Keep the agreed hold state or use a previously authorised substitute. Do not reinterpret technical success as business approval. Record the decision and actual decision maker.