DIRECTIVE	:	UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 38-98
TO	:	ALL STATE EMPLOYMENT SECURITY AGENCIES
FROM	:	GRACE A. KILBANE Director Unemployment Insurance Service
SUBJECT	:	Independent Verification and Validation of Year 2000 Compliance

1. Purpose. To advise State Employment Security Agencies (SESAs) of the Department's policy concerning independent verification and validation (IV&V) of year 2000 compliance of SESAs' unemployment insurance (UI) automated benefit and tax systems; to provide guidelines for use in performing IV&V; and to require the submission of IV&V plans.

2. Reference. ETA Handbook 336, 15^TH Edition

3. Background. IV&V is a process that is defined formally in the Institute of Electrical and Electronic Engineers Standards (IEEE Std-1012). The relevant section of this standard states that IV&V is verification and validation processes performed by an organization with a specified degree of technical, managerial, and financial independence from the development organization. Verification is defined as confirmation by examination and provision of objective evidence that specified requirements have been fulfilled. Validation is defined as the confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use are fulfilled. The working definition used by the Department of Labor is that validation asks and answers the question, "Are we doing the right thing?" while verification asks and answers the question, "Are we doing the thing right?"

4. Departmental IV&V Policies. SESAs must ensure the integrity of their year 2000 compliance efforts by conducting IV&V of their mission critical UI automated systems. Mission critical UI systems include benefit and tax systems and other automated systems which may affect the operation of the benefit and tax systems.

   The SESAs' IV&V process must include reviewing the results of point-to-point testing, i.e., test all systems which interface with the UI systems, a full clock advance test, and tests to check that the automated system will accurately process dates, including the recommended testing date validations listed in the attachment. SESAs are required to certify to the respective Regional Office that this complete testing process has been accomplished, that testing indicates that the automated systems are year 2000 compliant and that an IV&V process was conducted to corroborate the testing results.

   The IV&V review consists of the following major parts: (a) examination of the SESA's remediation effort, including configuration management and change control mechanisms; and (b) review of the year 2000 test plans, testing procedures and test results, including the date validations included in the attachment. An IV&V report should be provided to the SESA which provides the findings of the IV& V team. If the IV&V team cannot state that "after completing the IV&V process, the system has a high degree of likelihood that it is year 2000 compliant" then the report must address specific areas of concern and make recommendations to the SESA to improve its process.

   SESAs can meet the independence criteria through a variety of ways. These include:

   • Contract with an IV&V Agent - There are no independence issues if the SESA contracts with an IV&V agent. However, if the IV&V agent is hired by a SESA contractor who is the developer/renovator of the system, then the IV&V agent must be independent, using technical judgement independent of the project contractor, must have a management structure that reports to both the contractor and the SESA, and must have a contractual arrangement that separates the financial consideration for the IV&V effort from the elements of the project.

   • Use of existing SESA resources - A SESA may use an existing agency resource if it is a truly separate and independent facility that is capable of performing IV&V on a technical basis. The facility must be immune to political and organizational pressures. The performing agency must have documented policy statements and organizational mission and function statements that show that the facility operates in an independent manner. The Regional Office must approve the use of existing SESA resources for IV&V purposes.

   • Other resources - SESAs may use other resources for IV&V only with the express consent of the Regional Office.

5. IV& V Plans. SESAs must develop plans for the conduct of the IV&V process. The plan should include who will conduct the IV&V, what areas will be covered during the IV&V process, when the IV&V process will start and end, and when the IV&V report will be submitted. The plan must include the Regional Office's approval if use of other than a contract IV&V agent is contemplated.

6. Action Required. Administrators are to provide this information to appropriate staff for action. SESAs are requested to: (a) develop and provide their IV&V plans to their Regional Office by September 30, 1998; (b) provide their Regional Office with the certification of year 2000 compliance for their UI benefits system by December 1, 1998, and for their UI tax system by July 1, 1999. Year 2000 compliance certifications must include a copy of the IV&V review report.

7. Inquiries. Inquiries should be directed to the appropriate Regional Office.

Attachment