6 Ways Independent Verification and Validation (IV&V) Helps Protect Your IT Investments

 

By Danny Harris, Ph.D., PMP                                                              Co- Author, Dimitri Dizna 

While the Project Management Institute’s Project Management Book of Knowledge (PMBOK) provides a detailed and robust methodology and tools to manage business projects, it does not address a key project component that can literally make or break a project, particularly a large IT initiative: Independent Verification and Validation.  

In Fiscal Year 2021, the federal government’s IT spend was nearly $91 billion. And while estimates vary by source and year, it is widely acknowledged that only a fraction of large IT projects in both the federal and private sectors are completed on time, on budget, and/or adequately meet desired end user needs. Some estimates have put the partial or complete failure rate at nearly 85 percent. The U.S. General Services Administration’s Technology Transformation Services stated recently that “only 13% of large government software projects are successful.”

In any case, there can be no doubt that the federal government continues to waste billions of dollars annually due to failed systems implementations and other IT projects. Some of the reasons for this are outlined in the image.

Many of these impediments can be (and often are) at least somewhat mitigated through high-quality project management. Others, however, fall outside traditional project management boundaries, necessitating the need for Independent Verification and Validation to mitigate serious project risks.

Too often, project management and Independent Verification and Validation (often referred to as "IV&V") are mistaken as the same discipline, but it is important to understand the distinction. While project management professionals focus on foundational elements of the project (e.g. cost, schedule, etc.), IV&V professionals operate at a much more granular level.

IV&V may be described as an independent assessment of the real-time and ongoing health of a systems implementation effort or other critical information systems project. Beyond merely monitoring project schedules, costs, and risks, IV&V professionals evaluate the quality and efficacy of the various deliverables generated during each phase of the project.

 

Here are 6 ways Independent Verification and Validation (IV&V) helps protect your IT investments:

1. Validate and Reconcile the Requirements Traceability Matrix

Validating and reconciling a Requirements Traceability Matrix (RTM) is one of the most critical activities in the information systems lifecycle. It ensures that every requirement included in a Request for Proposal (RFP) and/or contract is accounted for and tracked all the way to system go-live. Further, it ensures proper unit, integration, and acceptance testing, including documentation showing what data was used in testing, when the testing was performed, and whether the testing was successful. Only through this process can you be sure that the system presented to end users contains all the system requirements and capabilities. Again, while a Project Management Office (PMO) can execute this task, only Subject Matter Experts (SMEs) can effectively look at the test data and ascertain the quality of the task. IV&V simply provides more stringent validation measures than a PMO.

Another example where traditional project management may prove insufficient is having a systems integration partner performing a complex cloud migration while experiencing a high staff turnover rate that begins to negatively impact the quality of the work. A “second opinion” from an IV&V expert with systems integration knowledge can provide an in-depth analysis of the technical project components to help your organization reduce costs and protect your reputation by ensuring a sound technical approach. Even a top-notch project manager may not pick up on this risk until it is too late.

2. Review and Evaluate Project Deliverables

The value of this capability may seem obvious but cannot be overstated. Only SMEs can review technical deliverables and adequately attest to their quality in the eyes of business owners. Having this done early and throughout the implementation cycle is a major benefit to the client and significantly reduces risk. This is vital for business owners to identify problems and take remedial action (e.g. Corrective Action Plans) to get a project back on track.

3. Provide Technical Approach Expertise

Typically, agencies hire system integrators because they do not have the technical know-how to build the system themselves. Similarly, they often do not have the expertise to even evaluate the general technical approach or methodologies used by the contractor. This is where the Independent Verification and Validation vendor shines. The SMEs on the IV&V team are adept at evaluating whether the approach used by the integration vendor is likely to achieve the implementation goal.  

4. Review, Evaluate, and Support the Risk Mitigation Plan

The number of projects that fail to create, monitor, and utilize a Risk Mitigation Plan (RMP) is alarming. Very few critical projects run smoothly from beginning to end, and the RMP is the one tool that can literally make the difference between complete success and utter failure. Without planning for the numerous glitches that are likely to occur with almost every project, progress can be severely impeded for days, weeks, or even months—with corresponding budget overruns.

The RMP describes in detail what can go wrong and what action will be taken to quickly remediate the problem. And while PMO professionals are generally quite skilled at creating an RMP, IV&V SMEs are needed to identify the technical components needed for a documented remediation solution.

 

5. Support User Acceptance Testing

Like the RTM, User Acceptance Testing (UAT) is one of the more critical steps in the information systems lifecycle. In fact, UAT could be considered the “last line of defense.” If a system owner does not thoroughly test every capability in the system before it goes live, users may receive a system that simply does not work. This not only affects the services the system owner needs to deliver to stakeholders; it can further cause irreparable damage to a company’s reputation and brand. IV&V vendors are skilled at supporting UAT, making sure all test scripts are adequate and that the test reports provide detailed information about the success or failure of all capabilities. The IV&V vendor can also review performance test results to ensure that the system will perform well under increased loads and sudden spikes in usage.

6. Prepare a Post-Implementation Assessment and Report

This critical step often does not receive the attention it deserves or is simply ignored. The documentation that results from a post-implementation assessment and report can prove invaluable when it comes to deciphering future system problems. Being able to quickly go back to documentation that addresses requirements, approaches, remediation, test results, and other data can quickly help business owners identify solutions to solve mission-critical problems. Such assessments and reports should be included as part of a robust PMO task order. Even so, having an IV&V vendor that can insert technical findings will make the document that much more valuable for vendors who ultimately maintain and/or modify the system.

The Value Proposition of Independent Verification and Validation

While it is often difficult for business leaders to secure funding for some of these mission-critical IT project components, IV&V serves as sort of an insurance policy on whatever funding can be obtained. While IV&V cannot guarantee that projects will succeed, it does alert business owners of anomalies in the project approach and identify poor deliverables and products in real time, which dramatically improves the odds of success and which is extremely difficult to achieve otherwise. While the PMO team typically consists of experts managing the various phases of an IT project, the IV&V team are made up of SMEs who are uniquely qualified to evaluate the quality of the approach and of the work performed.

It is not unheard of for an IV&V team to find so many problems with a project that it recommends that the entire operation be shut down. While this may sound extreme, shutting down a failing project can be far better than spending millions of dollars on a venture doomed to failure. IV&V affords business owners the opportunity to make an informed decision and “cut their losses” if necessary. And given that IV&V typically constitutes less than 15 percent of total project costs, the benefits clearly justify the investment.

How to Hire and Utilize an IV&V Vendor

Employing an Independent Verification and Validation vendor has shown to significantly decrease IT project risk—but only if the vendor is properly tasked and utilized. Your IV&V contractor should work in close collaboration with your project manager but report directly and independently to agency leadership. This is important because sometimes the project management team is the source of the deficiency. Also, the IV&V team should not be perceived or treated as an auditor. Whereas auditors report on activities after the fact (sometimes with a “gotcha” mentality), IV&V vendors raise issues/concerns—and offer potential solutions—in real time, before mission-critical operations fail.

The BINARC IV&V Approach

Historically, many large IT projects fall flat due to insufficiencies in one or both of the two critical initial phases: discovery and design. Information missed or incorrectly documented in either of these two phases can spell disaster for a project and, without IV&V, the problems may not be identified until well after project launch and the expenditure of substantial resources that cannot be recovered.

BINARC’s Independent Verification and Validation practice is comprised of Microsoft-Certified SMEs adept at evaluating the approach, schedule, data, and other key elements of federal and private sector transitions. We can help boost your chances of success and bring you peace of mind.

For more information, contact Dimitri Dizna at 202-681-7787 or visit our website.