Situation: Finance escalates a $200k month-end discrepancy, suspecting ETL outputs. Time is tight—closing window is 24–48 hours.Immediate clarifying questions- Which report/table and accounting period? Which metric/column sums to the $200k gap?- Has this been increasing or a sudden delta? Any recent deployments, config or schema changes?Triage steps (prioritized for speed)1) Reproduce the discrepancy- Pull the same aggregated query Finance used and compare to warehouse source.- Run a lightweight reconciliation: current report vs previous month's run and vs source-of-truth extracts.Example SQL checks:sql
-- compare sum at different pipeline stages
SELECT SUM(amount) AS total, COUNT(*) FROM raw.transactions WHERE period='2025-11';
SELECT SUM(amount) FROM staging.transactions_clean WHERE period='2025-11';
SELECT SUM(amount) FROM marts.finance_ledger WHERE period='2025-11';
2) Narrow scope- Delta between stages identifies where the loss/gain occurs.- Run partitioned diffs (by date, account, vendor) to localize affected slice:sql
SELECT account_id, SUM(amount) FROM staging.transactions_clean
WHERE period='2025-11'
GROUP BY account_id
ORDER BY SUM(amount) DESC
LIMIT 20;
3) Quick integrity checks- Row count changes, NULLs, out-of-range values, duplicate keys, late-arriving data.- Check job run logs, failure/skip counts, and watermark/timestamps in orchestration (Airflow/Prefect).- Inspect recent code commits or config changes (git, CI/CD) and infra changes (schema migrations).4) Tooling & runtime checks- Use monitoring dashboards: dbt logs/tests, Great Expectations, DataDog, CloudWatch, or Spark/YARN UI for skew/failures.- Re-run failing or suspect jobs in dry-run on a small partition to observe behavior.- Use hash or checksum diffs to compare source and target partitions.5) Cross-team communication- Immediately notify Finance with current status, expected timeline, and next checkpoint.- Page owners: ETL developer on-call, data steward for source system, and DevOps if infra suspected.- Share reproducible queries and findings in a shared doc and Slack channel; set a 1-hour stand-up if needed.Isolation strategy under time pressure- Binary search approach: compare data at N major pipeline checkpoints (raw → staging → modeled → mart). If discrepancy appears between stage i and i+1, bisect within that stage by partition (date/account) to find minimal failing subset.- Prioritize fixes that restore Finance’s reporting (e.g., backfill missing partitions or reprocess failed tasks) while continuing full root-cause analysis.Root-cause validation & remediation- Once isolated (e.g., transformation bug that filtered negative invoices), create a targeted reprocessing job, run tests (unit/integration), and backfill with audit logs.- Create post-mortem with timeline, cause, impact, fix, and preventive measures: assertions, dbt tests, alerts on deltas, and automated reconciliation jobs.Result communication- Tell Finance what changed, confirm corrected numbers, document rollback/backfill actions, and give ETA for permanent fix. Propose preventive controls and SLA for future incidents.This approach balances fast mitigation with thorough isolation: reproduce, localize via stage diffs, use tooling/logs, coordinate cross-team, then fix and prevent.