Designing the handover, not just the system

Handover is usually the last line on a programme plan. A folder is assembled in the final week, a meeting is held, the project closes. The operations team inherits an estate it has never seen documented, and finds out what was recorded on the first night something breaks.

The record set is not a by-product of the work. It is a deliverable, and it has to be specified like one.

What an undocumented system costs at the first fault

A fault on an undocumented system is not diagnosed. It is re-surveyed. Nobody can say what changed until someone establishes what exists.

An unlabelled patch field means the first task is finding the port, not fixing the fault. A link still passing traffic can often be traced from the switch MAC address table. Anything silent comes down to a tone generator at one end of the building and a probe at the other. A device whose administrator password left with the installing engineer needs the manufacturer's recovery procedure, or a factory reset where none exists. The reset clears the configuration nobody holds a copy of. An outage you were managing becomes one you have chosen.

None of this appears in the project cost. All of it appears in the operating cost, at the least convenient hour.

Records are made during the work, not after it

Documentation requested at completion is written from memory by people who have moved to the next site. It also sits outside the agreed scope, so it is priced as a variation.

Specify it at design time and the sequence changes. The labelling convention is agreed before the first cable is terminated, so labels are applied once rather than retro-fitted. As-built drawings are corrected when a route changes, which is the only point at which anyone still knows why. Credentials become an architecture decision: the identity model, the break-glass account and the custody of passwords are settled before commissioning, not improvised after it. Commissioning results are kept as a baseline, so a later complaint about performance is tested against a known state rather than argued over.

Acceptance criteria matter most. "The system works" cannot be failed. Criteria written after installation are written by the party being tested. Draft them with the design, state the conditions each test runs under, and include the record set itself.

What an operations team should refuse to accept

Whoever will own the estate needs the authority to reject:

• construction drawings offered as the as-built record;
• an asset register with no serial numbers, firmware versions, licence expiry dates or support contract references;
• screenshots of a configuration in place of the exportable file;
• credentials emailed to one named individual;
• records held on the supplier's system rather than yours;
• an escalation route that is a project manager's mobile number rather than a service desk with agreed hours;
• sign-off before the environment has run through a genuine busy period.

Name that person at tender stage, ask for the index of the handover pack rather than the pack itself, and hold retention against its acceptance. A supplier who cannot describe what the record set will contain before the work starts is unlikely to assemble one after it.