Technology Advisory & Systems Engineering
Independent Verification & Validation
Independent confirmation that a system does what it is supposed to do.
What this covers
Independent verification and validation checks that a system was built correctly and that it meets the agency's needs, performed by a party other than the one that built it. It is common on large state programs and valuable on any high-stakes implementation.
Typical activities
- Review of requirements, design, and test artifacts for completeness and consistency
- Independent test planning and execution
- Code and configuration review against standards
- Data conversion validation
- Security and accessibility verification
- Findings reporting with severity and recommended action
What you receive
Verification and validation plans, findings reports, and a final assessment supporting acceptance decisions.
Considerations for public agencies
State and federal funding for large systems often requires independent verification and validation. HQT structures the work to satisfy those oversight requirements.
When an agency should buy the review
Signals matter more than project size. Consider independent review when any of these is true:
- The project replaces a system of record that other systems and state or federal reporting depend on, with no practical fallback once the old system is turned off.
- Federal funding for the project is tied to an approved planning document. Some federal advance planning document rules condition enhanced funding on independent oversight, and in some programs the requirement attaches when a project misses its approved cost or schedule. Confirm what applies with the federal program office and the state oversight body.
- The implementation vendor wrote the requirements, is building the system, wrote the test cases, and reports the results. Each of those alone is ordinary. Together they leave nobody outside the vendor able to say whether the system works.
- Conversion involves records created under business rules that changed several times, with legacy codes no current employee can explain.
- Milestone dates keep moving while status reporting stays green.
- An earlier attempt at the same replacement was cancelled.
Requirements and design defects are the cheapest to correct, so the useful entry point is before requirements are baselined. Starting after code complete narrows the work to confirming problems that are already expensive to fix.
Keeping independence structural
Independence is a contracting and reporting arrangement, not an assurance in a proposal. The conditions that make it real:
- The reviewer holds a separate contract with the agency, not a subcontract under the integrator being reviewed.
- Findings go to the executive sponsor and the oversight body on a fixed schedule, reaching the project manager and the vendor at the same time rather than through them.
- The vendor may respond to a finding and have that response recorded. It may not edit or withhold the finding.
- No part of the fee depends on go-live dates, milestone approvals, or acceptance decisions.
- The reviewer is barred for a defined period from bidding remediation, operations, or maintenance of the same system. Federal organizational conflict of interest rules are a useful model even where they do not apply directly, and many states carry their own version.
One condition cannot be contracted for: someone with authority has to read the reports and act on them.
What to write into both contracts
Most access problems are created before award, in two contracts that have to work together.
In the solicitation for the review, name the reference standard. IEEE 1012 is the common one for verification and validation processes, and it scales the depth of effort to how much harm a failure would cause, so state which activities apply at which level instead of asking for unspecified services. Define severity categories, response times, and the escalation path up front, before the first serious disagreement makes them negotiable. Require named key personnel with agency approval for substitutions, a fixed reporting cadence, the ability to raise an out of cycle alert without permission, and coverage through a stabilization period after go-live.
In the implementation contract, written before that vendor is selected, require read access to source, configuration, the defect tracker, the traceability matrix, and test results, along with a test environment holding representative data. Require that vendor deliverables reach the reviewer the same day they reach the agency, that vendor staff attend finding reviews, and that acceptance decisions weigh the independent assessment.
Signs the review is not working
Reports that summarize vendor status instead of testing anything. Findings that never rise above medium severity. Review that cites documents but never the running system or converted data. A reviewer who has quietly become the project's test team. Open findings aging with no owner. A final assessment that lands the week acceptance is due.
Afterward, ask what share of findings were closed rather than deferred, whether early production incidents trace to issues that were raised and waived, whether conversion reconciliation was proven before cutover, and whether any finding changed a decision.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
What is the difference between independent verification and validation and the testing our vendor already does?
Vendor testing confirms that the system behaves the way the vendor understood the requirements. Independent verification and validation asks whether those requirements were right in the first place, whether the build matches them, and whether the result works for the agency's actual operations. The difference is structural, because the reviewer has no role in the build and no stake in the go-live date. Both are needed, and neither substitutes for the other.
Does federal funding require independent verification and validation for our system?
It depends on the program and on the rules in force at the time. Some federal funding streams for large state systems condition enhanced funding on independent oversight through their advance planning document processes, and in some programs the requirement attaches when a project misses its approved cost or schedule. Expectations and thresholds change, so confirm the current requirement with the federal program office and your state oversight body before scoping the work.
Can the same firm implement the system and perform the independent review?
No. The reviewer has to be able to report that the builder's work is deficient without reporting on itself, and oversight bodies and funding agencies generally treat the combination as disqualifying. A subcontract under the integrator has the same defect, because the reviewer's scope and payment run through the party being evaluated. Hold the review under a separate contract directly with the agency.
What happens when the reviewer and the vendor disagree about a finding?
The disagreement gets recorded rather than settled privately. The vendor writes its response, the reviewer states whether that response changes the finding, and both go to the executive sponsor, who decides whether to fix it, defer it, or accept the risk. Severity definitions and an escalation path agreed at the start keep that decision from becoming a negotiation over wording. Nothing about the arrangement should let either party remove a finding from the report.
What does our agency have to provide during the engagement?
Access and decisions. The reviewer needs the system access, artifacts, and test environment named in the implementation vendor's contract, which is why those rights belong in that contract before award rather than in a later request. The agency also needs subject matter experts available for requirements and conversion questions, and an executive sponsor who reviews findings on a fixed cadence and decides what must be fixed before go-live.