Dossier · Reversibility audit
Export the assets, rebuild an isolated target and have the internal team recover critical functions against criteria fixed before the exercise.
The test does not ask whether exit appears possible. It verifies that an identified minimum service can be restored on a given target using authorised assets and within limits approved by the authority named in the mandate.
Production may remain untouched: the exercise uses a controlled source state and an isolated target. Any extrapolation to the full system is written as a limitation.
Six prerequisites prevent a preparation failure from being confused with an impossible exit.
Every phase reuses register identifiers and emits a dated trace. Any phase not executed remains visible in the conclusion.
| Phase | Operation | Pass evidence |
|---|---|---|
| T0 | Freeze scope, version and criteria | Approved mandate and inventory |
| T1 | Produce the complete export | Manifests, volumes and errors |
| T2 | Check integrity and exclusions | Hashes, reconciliations and gaps |
| T3 | Load assets on the target | Import logs and available objects |
| T4 | Rebuild the environment | Replayed deployment and resolved dependencies |
| T5 | Execute critical journeys | Results compared with criteria |
| T6 | Test incident and restoration | Alerts, decisions and traces |
| T7 | Switch within the planned window | Observed start, interruption and recovery |
| T8 | Revoke source access | Rotated keys and removed accounts |
| T9 | Execute rollback | Controlled return or documented reservation |
| T10 | Close the exercise | Conclusion, gaps and retained evidence |
An export manifest is not enough. Volumes, hashes, schemas, metadata, time conventions and access rights are checked, then the data is actually read or queried on the target.
An exclusion may be legitimate. It must still be exhaustive, justified, linked to its effect on the service and accepted before the conclusion is signed.
The target is rebuilt from versioned artefacts. Interfaces, identities, observability, backups and incident procedures are replayed. Secrets are recreated on the target, never copied in clear text.
Functional equivalence is not technical identity. Shared features and acceptable deviation between source and target are defined before comparison.
The stopwatch is only one measure. The file also records data loss, manual work and residual calls to the source.
The lead suspends the exercise if production data could be altered, a secret leaves controlled custody, return to the safe state becomes impossible or a newly discovered dependency falls outside the authorised scope.
Every stop retains the time, observed fact, consulted authority and resumption condition. Rollback is executed or its impossibility appears as a reservation.
The conclusion distinguishes demonstrated, conditional and unproven exit. It identifies unexecuted phases, gaps, residual dependencies, owners and the reassessment date.
Primary sources
Last documentary review: 6 September 2026.
Switching data-processing services and removing exit obstacles.
ICT third-party risk management, exit strategies and transition plans in the financial sector.
Security choices, customer responsibilities, reversibility and operational skills.
Guidelines for auditing management systems: principles, programme, audit evidence.
Before you write to us
No. It can use a controlled source state and an isolated target. The report then limits its conclusion to the scope, version and conditions actually exercised.
The authority named in the mandate approves it before the exercise based on service criticality and applicable obligations. The method sets no universal time target.
No. Integrity must still be checked, the target rebuilt, critical journeys executed, source access revoked and target-team autonomy demonstrated.
Reversibility dossier
Present the source, target and expected minimum service. We assess whether the conditions for an interpretable exercise are met.
Scope the test