Data Migration: Planning, Execution, and Validation
Learn the key phases of data migration and audit controls that CISA candidates need to understand for successful exam preparation.
Data migration is the process of transferring data from one system to another, typically as part of a system implementation or upgrade. For CISA candidates, understanding data migration risks and controls is essential because migration failures can result in data loss, corruption, or business disruption.
Data Migration Planning
Thorough planning is the most critical success factor for data migration. Key planning activities include:
Data Assessment
Before migration, the source data must be assessed for quality, completeness, and compatibility with the target system. This includes profiling data to understand its structure, identifying data quality issues, and determining how data will map from the source to the target schema.
Migration Strategy
The migration strategy defines how data will be extracted, transformed, and loaded (ETL). Key decisions include:
- Whether migration will occur in a single event (big bang) or in phases
- How data will be cleansed and standardized before loading
- How historical data will be handled (full migration, partial migration, or archival)
- What transformation rules will be applied to convert data formats
Testing Plan
The testing plan should include multiple rehearsal migrations using production data copies to identify and resolve issues before the actual migration event.
Data Migration Execution
During execution, controls should be in place to ensure data integrity:
- Record Counts: Comparing the number of records in the source and target systems to verify completeness.
- Control Totals: Summing key numeric fields (such as account balances) in both systems to verify accuracy.
- Data Sampling: Selecting representative records for detailed comparison between source and target.
- Error Logging: Capturing and tracking all records that fail to migrate or require manual intervention.
Post-Migration Validation
After migration, validation activities should confirm that the migration was successful:
Reconciliation
Systematic comparison of source and target data using automated reconciliation tools. This should cover record counts, control totals, and key field comparisons across all migrated data sets.
Business Validation
Business users should review migrated data to confirm that it accurately represents their records and supports their business processes. This is analogous to UAT for data.
Data Quality Assessment
Post-migration data quality checks should verify that data integrity constraints are satisfied in the target system and that relationships between data elements are preserved.
Audit Considerations
IS auditors should assess:
- Whether a documented migration plan exists with defined roles, procedures, and timelines
- Whether data mapping rules are documented and approved by data owners
- Whether rehearsal migrations were performed and issues were resolved
- Whether reconciliation controls verified completeness and accuracy
- Whether a rollback plan exists in case of migration failure
- Whether source data was retained for a defined period after migration as a safety measure
CISA Exam Tips
Data migration questions on the CISA exam typically focus on what controls should be in place to ensure data integrity. The most important controls are reconciliation of record counts and control totals between source and target systems. Remember that validation should be performed by both technical staff and business users, and that source data should be preserved until the migration is confirmed successful.