# Gate 5: Can our team operate the first release without the project team?

**Make operational handover part of acceptance, not an activity left until after launch.** Require both a working workflow and evidence that the buyer’s team can support it.

The IIA’s technology standard explicitly includes training and collaboration with IT and information security. An employer example reinforces the range of continuing responsibilities: Relay’s GRC Administrator posting includes platform administration, control mapping, evidence workflows and control-owner adoption. That is a role example—not a staffing benchmark for enterprise GRC. ([theiia.org](https://www.theiia.org/globalassets/site/standards/editable-versions/globalinternalauditstandards_2024january9_editable.pdf))

### What should the go-live checklist contain?

- [ ] Complete a migration rehearsal and reconcile records, relationships, files and historical retrieval.
- [ ] Define the final data freeze or delta migration, cutover responsibilities and rollback decision.
- [ ] Pass first-release mandatory tests, including access and integration failure scenarios.
- [ ] Have representative occasional users complete tasks without a consultant operating the interface.
- [ ] Have the buyer’s administrator perform agreed maintenance and troubleshooting tasks.
- [ ] Assign primary and backup ownership for administration, content, integrations, access and supplier support.
- [ ] Deliver configuration records, runbooks, known limitations and support escalation details.
- [ ] Agree who approves launch, who accepts residual risks and who may stop cutover.
- [ ] Retain legacy access until agreed reconciliation and historical-access conditions are satisfied.

For the first operating reviews, track task completion without chasing, evidence rejection, reporting reconciliation, integration failures, administrator hours and unresolved support issues. Use the baseline from Gate 1; do not substitute login counts for workflow outcomes.

**Output:** signed acceptance record, operating plan and prioritised improvement backlog.

**Proceed to wider rollout when:** the first workflow is supportable and its results can be trusted.

**Hold expansion when:** administration, access defects or off-platform work remain unresolved. Avoid multiplying an unproven operating model across more entities.