A company acquires a regional service business and consolidates its document platforms. Staff see a successful migration because every familiar folder appears in the new system. Months later, an auditor discovers that inspection records no longer show approval history and that contract documents inherited the wrong retention period. The failure occurred at the interface between legal responsibility, metadata and system design. Transition governance must preserve trustworthy records from both legacy and destination environments.
01Begin with obligations and the transaction boundary
Mergers and reorganizations may change the legal entity that holds records without changing the reasons they must be retained. Identify which entity owns each series, where it was created, relevant jurisdictions, contract restrictions and whether transfer is permitted. Include records managed by suppliers and retired applications. A clean inventory should distinguish physical custody from the legal right or duty to preserve.
Build a migration scope that identifies key business processes and their evidence, not just application names. Define what stays with the seller, what transfers, what can be accessed under a transitional service agreement and who resolves disputes over shared records. Corporate counsel should confirm sensitive transfer conditions before IT copies entire directories.
02Protect metadata that makes historical evidence intelligible
A technical export may preserve document content while losing revision history, event dates, approver identity, original access classification and links to supporting records. Identify the minimum metadata required to understand authenticity and business context. ISO 23081-1 provides principles for records metadata that apply across systems and organizations.
Prepare a mapping between legacy and destination data fields. Record incompatible classifications instead of silently forcing them into a new category. Keep a crosswalk for old identifiers, account names and system timestamps. When historic user accounts cannot be recreated, preserve a trustworthy mapping to their former responsibilities.
03Manage retention and legal holds during the handover
The receiving organization should not automatically apply its own retention schedule to every inherited series. Examine pre-existing legal requirements, contractual warranties, investigative holds and sector obligations. A sale or relocation may trigger a new start event for some records but will not necessarily reset every retention clock.
For records subject to litigation preservation, document how restrictions move between systems and who can release the hold. Prevent decommissioning or deduplication processes from deleting material that still must be retained. Confirm that the archive and production systems agree on the status of exceptional record groups.
04Design migration tests around retrieval and completeness
Migration acceptance should test a representative range of records: old and new, high and low sensitivity, attachments, scanned pages, electronic signatures and linked transactions. Verify content integrity, relevant metadata, permissions and retrieval by a legitimate user. A raw file-count comparison is useful but insufficient when attachments or context are missing.
Document exceptions such as unreadable legacy formats, broken references or records that require special handling. Determine which ones block operational cutover and which can remain in a read-only archive with a controlled access process. A successful test proves that a future decision-maker can retrieve and interpret the migrated record.
05Control physical relocation as carefully as system migration
Physical moves introduce separate hazards: mislabelled cartons, moisture damage, mixed classifications and lost custody handoffs. Use a box-level inventory tied to record-series identifiers, destination location and accountable handlers. Apply tamper-evident transport for sensitive material when justified, and verify arrival against dispatch records.
Do not rely solely on the moving contractor’s receipt. Sample contents after arrival, check environmental conditions and confirm who now grants access. Where original records must cross borders, obtain legal and contractual advice before transfer. An office move should not quietly convert an active evidence store into an unmanaged basement archive.
06Define the cutover and rollback authority
Agree on the point at which the source system becomes read-only, the destination becomes authoritative and exceptions are escalated. Specify business owners who can approve cutover based on evidence rather than on technical completion alone. Maintain a rollback or fallback capability proportionate to the impact of missing records.
Access to the legacy environment may need to continue for defined classes of evidence. Set a decommissioning condition based on verified retrieval, custody and retention status, not just the project go-live date. Document the decision to retire old infrastructure so future investigators can trace where original information went.
07Illustrative scenario: two service businesses consolidate
Illustrative scenario: two inspection providers merge and migrate field reports into one records platform. One company labels records by customer number; the other uses asset identifier and inspection date. A crosswalk links both identifiers while the records team samples historical reports with supporting photographs and signatures.
The sample reveals that some archived images lack original timestamps. Those records are placed in an exception register while supporting metadata is sought from the old platform. The acquiring business delays final decommissioning for affected series rather than claiming all records complete based on a successful folder copy.
08Maintain evidence governance after the project team leaves
Ownership should transfer to standing roles with clear processes for retrieval requests, hold updates, retention reviews and metadata corrections. Record every significant exception and its eventual resolution. The successor custodian needs a usable inventory of what was moved, what remained, and how to reconstruct an older transaction.
After one operating cycle, commission a sample retrieval by staff who did not perform the migration. Examine whether access permissions are appropriate and whether customers or auditors can still obtain evidence on time. The real measure is dependable business continuity of records after transitional experts depart.
| Control area | Required decision or record | Evidence test |
|---|---|---|
| Legacy record inventory | Source application and business owner | Custody and retention authority |
| Metadata mapping | Origin identifier, approver and dates | Retrievable context in destination |
| Hold transfer | Legal case and affected record series | Deletion suspended where required |
| Cutover sample | Attached files and version history | Owner-approved retrieval test |
Practical Verification Checklist
- Are source and destination records mapped by business series and accountable owner?
- Have retention rules, legal holds and cross-border restrictions survived the transition?
- Do sampled files preserve readable content, attachments, timestamps and original identifiers?
- Is source-system retirement contingent on independently observed retrieval success?
Pre-cutover evidence sampling
Select records from each major legacy business process and document the exact metadata and attachment chain that supports their evidential meaning. Use that sample to shape the mapping specification.
Repeat retrieval after cutover using a different employee and a different endpoint. Hold final legacy-system retirement until the unresolved exceptions have owners and an accepted preservation route.
Closing Perspective
A merger or platform migration succeeds when an authorized future user can explain, retrieve and rely on the historical evidence. Preservation of provenance must be part of the transaction plan, not an afterthought.
Technical reading: The source descriptions for ISO 15489-1:2016 and ISO 23081-1:2017 provide the applicable terminology and guidance. Determine requirements from your organization’s actual risks, obligations and scope.
References & Further Reading
The following authoritative publications provide relevant management-system, information-security and records-management guidance. Applicability depends on business context and jurisdiction.
- ISO 15489-1:2016 — Records management concepts and principles
- ISO 23081-1:2017 — Metadata for records, principles
- ISO 16175-1:2020 — Software for managing digital records
- ISO/IEC 27001:2022 — Information security management requirements
- U.S. National Archives — Universal Electronic Records Management Requirements