An Accounting Migration With No Downtime

Legacy account codes were not treated as self-explanatory. The same code could receive subledger postings, direct journals and imported adjustments, each with different dimensions and evidence. Workshops therefore started with representative events and their intended financial meaning. The target chart kept natural accounts restrained and moved changing management analysis into governed dimensions. Posting rules specified required and prohibited combinations, permitted sources and period behaviour. Control accounts accepted only authorised subledger events except through an explicit correction route. This design prevented a superficially complete code-to-code mapping from carrying forward ambiguous usage and made every unmapped population a decision for finance rather than a convenient suspense posting.

The posting engine enforced balanced journals within the relevant entity and currency context. Entries became immutable after posting; reversal and adjustment linked back to the original event. Exchange rates retained source, effective date and type, while rounding was handled consistently at the journal boundary. Closed periods rejected ordinary events and exposed a separate authorised adjustment process. These controls were tested through complete scenarios including invoice correction, partial settlement, refund, write-off and late receipt. The objective was not simply to reproduce a trial balance. It was to show that future transactions would reach the correct accounts, carry the required dimensions and remain explainable after correction.

A receivables balance alone cannot support allocation, dispute handling or customer enquiry. Open invoices were therefore converted with their document identifiers, dates, currency, outstanding components, tax treatment and links to available source evidence. Receipts on account, partial allocations and credits retained their relationships. The same approach applied to supplier items and unposted operational events near the boundary. Transformation rules distinguished a malformed source value from an absent optional value, and rejected records stayed visible with an assigned resolution. Nothing was made loadable by replacing uncertainty with a plausible default. Once corrected, the entire pipeline could be rerun from the same source snapshot.

Historical transactions followed a different policy. The target received the detail required for comparative reporting and current operations, but the migration did not manufacture target-system workflows for events completed under the legacy application. A read-only archive preserved original journals, documents and approvals with controlled access. Cross-reference keys connected converted openings to their source population and stored the transformation version. Reports identified records represented as opening detail separately from transactions genuinely posted in the target. That distinction protected audit interpretation: a converted entry could be traced and reconciled without implying that the new approval workflow had existed when the original transaction was authorised.

Continuous processing required a precise boundary for each inbound source. Depending on the integration, that boundary was a durable event identifier, source sequence or accepted timestamp paired with an identifier. Initial loads established state up to the agreed watermark. Events after it entered a delta path with the same validation and idempotency controls used by live interfaces. Producers retained their own identifiers, allowing retries to return the original result rather than post again. Where a source could amend an earlier event, the contract represented that change explicitly instead of relying on file replacement. This made the overlap between migration and live operation deterministic.

Interfaces were run in shadow before authority transferred. The new platform consumed representative traffic and generated proposed postings without releasing them to the ledger. Comparison operated at event and journal-line level, not only on aggregate debits and credits, because equal totals can conceal account, dimension or date errors. Timing differences were classified separately from mapping defects. Operational acknowledgements were also tested: a source needed to know whether an event was accepted, rejected or already processed, and support staff needed the same answer without querying database tables. At transfer, routes changed according to the recorded watermark, with queues drained and reconciled rather than discarded.

Every rehearsal produced a migration control pack from the pipeline itself. It compared extracted, transformed, rejected and loaded populations; bridged the legacy trial balance to target openings; reconciled subledger open items to their control accounts; and listed mappings or documents that needed review. Reports used stable record identifiers and linked to transformation diagnostics. Finance sign-off therefore referred to a reproducible run rather than emailed workbooks amended after extraction. When a rule changed, the next run exposed its effect across all affected records. This shortened investigation and avoided the familiar problem in which the final migration succeeds only because nobody can reproduce the manual repairs made to it.

The first target close used the same controls intended for ordinary operation. Subledger reports reconciled to ledger control accounts under a shared cut-off definition, posting batches connected back to accepted source events and manual journals carried preparation and approval history. Comparative reports were traced through target dimensions and legacy archive links. Access to migration staging data was reduced after acceptance, while the evidence bundle and immutable source snapshots followed the agreed retention policy. Decommissioning was conditional on evidence and retrieval, not merely on successful login to the new application. The organisation could continue processing throughout because the transition had been engineered as a sequence of owned states, not compressed into an unexplained outage window.