When do you trigger a rollback?
A rollback is triggered when a condition written down before the window is met: a failed verification step, reconciliation outside tolerance, an unrecoverable defect, or the clock passing a checkpoint. The triggers and the person authorised to call them are agreed in advance, and the decision has to be made before the point of no return.
Triggers are written before the window, not during it
At two in the morning, with a deadline approaching and a team that has worked for months to get here, nobody makes a good decision about whether the situation is bad enough to reverse. Optimism is the default. The next step usually looks like it might fix it.
Rollback triggers exist to move that decision to a time when it can be made calmly. Each one states a condition that, if met, starts the reverse sequence unless a named person explicitly overrides it. Writing them down does two things: it removes the debate, and it makes the override visible as a decision someone took rather than a drift nobody noticed.
The four kinds of trigger
| Type | Example condition |
|---|---|
| Time-based | Checkpoint at 03:00 not reached; data load not complete by the agreed clock time |
| Technical | Deployment fails and cannot be re-run; a critical service will not start; an interface cannot be established with a third party |
| Data | Reconciliation outside the agreed tolerance; control totals do not balance; a mandatory object fails to load |
| Business | A critical business process cannot be completed in verification; a regulatory or financial control cannot be evidenced |
Time-based triggers are the ones most often left out and the ones that do the most work. They convert a vague sense that things are running late into a checkpoint that either passed or did not. The Rollback Plan Template holds the triggers next to the reverse sequence they start.
The point of no return
Every window has a moment after which reversing is no longer practical — because the old system has been decommissioned, because transactions have been taken in the new one, because the reverse sequence would run past the time the business needs to be live, or because a third party has already switched.
That moment is a clock time, and it is calculated the same way the window is: work backwards from the deadline through the duration of the reverse sequence, measured in a rehearsal rather than estimated. After it passes, the only remaining options are forward fixes and workarounds, and the plan should say so plainly. Teams that have not identified it tend to discover it about an hour after crossing it.
Before the point of no return, a rollback is a decision. After it, the conversation changes to degraded operation, manual workarounds and how long the business can run that way. Both belong in the cutover plan.
Who calls it
One named person, with a named deputy, both agreed before the window opens. In practice the technical lead recommends and the person accountable for the service or the business impact decides, because a rollback has consequences beyond the system: users told to expect a new system arrive to find the old one, communications go out, and the date moves.
What does not work is a decision by consensus among tired people. Consensus produces delay, and delay in a rollback decision is expensive because the reverse sequence still has to fit inside what is left of the window.
Rollback, partial rollback, or fix forward
Full reversal is not the only option, and the plan should say which are available. A partial rollback reverts one component while leaving others in place — viable only if the interfaces and the data model tolerate it, which is a question to answer during design rather than during the window. A fix forward keeps the change and repairs the defect in place, which is usually the right call for a small, well-understood problem and the wrong one when the fault is in migrated data.
The distinction to make in advance is which faults are eligible for a fix forward at all. Anything affecting data integrity, financial records or an audit trail usually is not, because the fix has to be reconciled as well as applied. The data migration guide covers the tolerances those decisions rest on.
What happens when the trigger fires
The reverse sequence runs as its own numbered list — restore from the snapshot, revert configuration, re-point interfaces, restart services, verify the old system, confirm no transactions are stranded. It is rehearsed, because an untested rollback is a hope. Verification after a rollback matters as much as verification after a go-live: the old system has been stopped, restored and restarted, and it needs the same smoke tests before users are told it is available.
Communication runs in parallel and is written in advance. Users, the service desk, third parties and anyone whose own schedule depended on the change all need telling, and drafting those messages at four in the morning produces the wrong tone and the wrong facts.
Recording the call
Whichever way it goes, the record is the same: which trigger fired, at what time, what the evidence was, who took the decision, what was done, and what state each system was left in. That record is the basis of the re-plan and of the post-implementation review. Writing the rollback plan covers the structure, and the Cutover Runbook & Hypercare Pack keeps the decision log alongside the runbook so the sequence and the deviations sit in one place.
Questions
Should triggers be automatic or advisory?
The usual arrangement is that a trigger starts the rollback unless a named person overrides it, and the override is recorded. That keeps the default safe while allowing judgement.
How is the point of no return calculated?
Work backwards from the time the business must be live through the rehearsed duration of the reverse sequence and its verification. What is left is the latest moment a rollback can start.
Does a rollback mean the project failed?
It means a condition agreed in advance was met. A rollback executed cleanly inside its window is a plan working; the failure is discovering there was no way back.
Who tells users a rollback has happened?
Whoever owns the communications plan, using messages drafted before the window. The service desk needs telling first, because they take the calls.