Across this course, Lesson 5.1 set access rights, Lesson 5.2 added an audit trail, Lesson 5.3 scored a spreadsheet's control risk, and Lesson 5.4 checked whether data and working methods are ready for a move. Each of those checks answers a separate question. None of them alone tells Omar, the owner of Cedar & Co., what to actually decide about the spreadsheet his business now runs on for both its standing forecast and its occasional capsule orders.
This lesson brings the previous four together into one decision tool: a risk score compared with a threshold, combined with a migration-readiness check, producing one of three recommendations — keep and monitor, improve the current spreadsheet, or prepare and replace it. The point of combining them is to remove the moment where a business owner is left guessing which single fact should decide.
You need: Lessons 5.1 through 5.4 on access rights, audit trails, risk scoring and migration readiness.
By the end of this lesson you can:
Not covered here: how to configure or select the replacement system itself; this course stops at the business decision of whether and when to prepare for one.
| Term | Meaning |
|---|---|
| Control risk | The chance that a working method can no longer reliably prevent, detect or correct an error before it causes loss. |
| Data migration | Moving existing records from an old working method into a new one, cleaned and checked before they are trusted there. |
| Shared business system | A controlled, generic business application used by more than one department or company at the same time, instead of separate personal files. |
| Change control | The agreed process for approving, recording and communicating a change to controlled business information before it takes effect. |
| Audit trail | A record of who did what and when, kept so a decision or change can be checked and reviewed later. |
A high risk score without migration readiness does not mean replace immediately; it means prepare first, because Lesson 5.4 showed that moving uncleaned data or unagreed habits into a new system does not remove the risk, it relocates it. A high risk score with migration readiness confirmed means move now, because the preparation that would otherwise justify waiting has already been done. A risk score below the agreed threshold means the spreadsheet can still be kept, with the improvements Lesson 5.1 and 5.2's access rights and audit trail already provide, and monitored on the same schedule Lesson 5.3 established.
The combined rule, not the risk score by itself, is what should drive the recommendation a business owner actually acts on.
| What can differ | The shapes you will meet | Why it matters to you |
|---|---|---|
| Export order under Make to Order | A single confirmed order's data is usually well-bounded, so a high risk score here often comes with faster migration readiness. | The recommendation can move from high-risk to ready-to-move quickly, since there is less data to cleanse per order. |
| Domestic replenishment under Make to Stock | A standing forecast accumulates risk gradually, as Lesson 5.3 showed, and often needs more cleansing time before readiness is confirmed. | The improve/prepare recommendation may last longer here, and that is not a sign of delay; it reflects the genuinely larger cleansing task. |
| Hybrid mix of standing forecast and capsule orders | A hybrid business runs both patterns at once, so its overall risk score and readiness should be assessed for the combined working method, not for one order type alone. | Treating only the capsule-order side as ready while the standing-forecast side is not still leaves the business exposed through its larger, riskier data set. |
| A business owner acting alone versus with an agent or partner | Cedar & Co.'s own decision affects only its own working method; a factory or agent's decision can affect several buyers who share the same system. | The more parties depend on the same shared record, the more the readiness half of the recommendation matters, since an unready move now affects more than one business. |
| Different product families | Socks, knit-to-garment, terry and bedding programmes each score and prepare differently in detail, but the same combined recommendation logic applies to every one. | The inputs differ by product family; the decision rule that combines them does not. |
Cedar & Co. runs a hybrid business: a standing forecast replenishment programme with Delta Garments on 60-day open account, plus occasional capsule orders using Order A's own fixed shape (15,000 T-shirts, agreed FOB USD 3.20 per piece) as the reference transaction. Lesson 5.3 already scored Cedar & Co.'s standing-forecast spreadsheet at 5 out of 5 against a threshold of 3 out of 5, well above the level at which Omar agreed a control risk is worth acting on.
Before deciding what to do next, Omar checks migration readiness the way Lesson 5.4 describes: has the data been cleansed of duplicates and inconsistent formats, and has a working method been agreed with everyone who will use a replacement. Cedar & Co. has not yet started either check. With a high risk score and readiness not yet confirmed, the combined tool does not recommend an immediate move; it recommends starting the preparation Lesson 5.4 sets out, on a clear timetable, rather than either ignoring the risk or attempting a rushed migration before the business is actually ready.
The worked numberWith the risk score at 5, above the threshold of 3, and readiness at 0, the combined tool's recommendation is: prepare now, using Lesson 5.4's method, before setting a migration date. If Cedar & Co. instead completed both readiness checks (data cleansing and a working method agreement) before revisiting the tool, the same 5-out-of-5 risk score would then produce a "move now" recommendation instead, because the condition that was missing would be resolved.
That shortcut feels decisive, because a high risk score is easy to see and easy to act on immediately. It becomes expensive when the migration itself carries uncleaned data or unagreed habits into the new system, which Lesson 5.4 already showed does not remove the original risk; it only moves the same risk into a system more people now trust.
The better rule is simple: treat a high risk score as a signal to check readiness, not as permission to migrate before readiness is actually confirmed.
Think of the risk score as a smoke alarm and the readiness check as knowing where the fire exit is. A loud alarm tells you there is a real problem; it does not by itself tell you it is safe to run for a door you have not checked. If the exit is clear, go now. If it is not, the alarm still matters, but the right first action is to clear the way, not to run blindly.
A spreadsheet's risk score tells you a problem is real. Migration readiness tells you whether moving right now would actually fix it or simply carry it somewhere else. Read both together before deciding what to do next.
Excited by the tool's clear risk score of 5 out of 5, Omar tells his team he wants to announce a firm migration date this week, before the data-cleansing check from Lesson 5.4 has actually been completed on the standing-forecast spreadsheet.
Should Omar announce a firm migration date this week? Decide before opening the answer.
No. Omar shares the risk score with his team to explain why preparation matters, but sets the migration date only once both readiness checks are complete.
1. The combined tool's logic is explicit: a high risk score with readiness at 0 recommends preparing first, not announcing a date before the preparation is finished. 2. Announcing a date now would create pressure to migrate on schedule even if cleansing and the working method agreement are still incomplete, which is exactly the shortcut Lesson 5.4 warned against. 3. The risk score itself is still useful today, as the reason preparation is worth prioritising, even though it should not be read as permission to skip the readiness checks.
The tool is designed to separate two decisions that feel like one: recognising the risk is worth acting on, and knowing the business is actually ready to act on it. Omar can announce the former this week without announcing the latter until it is true.
Order A's fixed figures show the reference transaction shape behind Cedar & Co.'s own capsule orders.
A high risk score correctly identifies that Cedar & Co.'s spreadsheet is a control risk; the worked number does not change that fact. What changes with readiness is what should be done about it right now. Migrating before readiness is confirmed does not remove the USD 5-factor risk Lesson 5.3 measured; it relocates duplicate and inconsistent records into a system more people will trust, which costs more to untangle later than completing the readiness checks would have cost today.
Use the T17-C05 Data governance decision tool workbook. On the Keep, improve or replace sheet, enter the risk score from the Spreadsheet risk score sheet, the agreed threshold, and the two readiness entries from Lesson 5.4. Read the combined recommendation the sheet calculates. Apply it first to Cedar & Co.'s own hybrid business, then to a spreadsheet process you manage at work.
[Download the Data governance decision tool workbook](../../templates/T17-C05-data-governance-decision-tool.xlsx)
1. Cedar & Co.'s spreadsheet scores 5 out of 5 on risk, above the threshold of 3, but neither data cleansing nor a working method agreement is complete. What does the combined decision tool recommend?
2. A different factory's shared order-tracking spreadsheet scores 2 out of 5 on risk, below its own agreed threshold of 3 out of 5. Data cleansing and a working method agreement have not been discussed. What does the combined tool recommend?
| EN | AR | FR | TR | Meaning |
|---|---|---|---|---|
| Control risk | مخاطرة رقابية | Risque de contrôle | Kontrol riski | The chance that a working method can no longer reliably prevent, detect or correct an error before it causes loss. |
| Data migration | ترحيل البيانات | Migration des données | Veri taşıma | Moving existing records from an old working method into a new one, cleaned and checked before they are trusted there. |
| Shared business system | نظام عمل مشترك | Système d'affaires partagé | Paylaşılan iş sistemi | A controlled, generic business application used by more than one department or company at the same time, instead of separate personal files. |
| Change control | ضبط التغيير | Contrôle des changements | Değişiklik kontrolü | The agreed process for approving, recording and communicating a change to controlled business information before it takes effect. |
| Audit trail | سجل التدقيق | Piste d'audit | Denetim izi | A record of who did what and when, kept so a decision or change can be checked and reviewed later. |
This is the last lesson of Course 5 and of Track 17, Systems and Data. There is no lesson 5.6 to move to; instead, revisit any of the five lessons in this course whenever a real spreadsheet decision at your own workplace needs the access-rights, audit-trail, risk-scoring or migration-readiness method they each teach. Back to the course map