Beat the Clock
Second opinion. The number of civilian and Defense Department agencies seeking a second opinion about their year 2000 readiness is likely to rise sharply, judging by the fact that several large agencies have already hired compliance auditors. The IRS and Postal Service have brought in year 2000 auditors from SRA International Inc. of Fairfax, Va., to check their readiness. The Health Care Financing Administration also has hired SRA to do independent verification and validation that will
Second
opinion. The number of civilian and Defense Department agencies seeking a second
opinion about their year 2000 readiness is likely to rise sharply, judging by the fact
that several large agencies have already hired compliance auditors.
The IRS and Postal Service have brought in year 2000 auditors from SRA International
Inc. of Fairfax, Va., to check their readiness. The Health Care Financing Administration
also has hired SRA to do independent verification and validation that will take a year to
complete and cost HCFA about $3.3 million.
The Army Logistics Systems Support Command in St. Louis and other central design
agencies within Defense are under a mandate to submit their systems fixes to IV&V.
On the other hand, commands with local applications that merely pull data from DOD
standard systems are skipping that process, said Pete Cornman, 2000 project manager for
logistics business for the Armys Tank-Automotive and Armaments Command. The only
system that TACOM had independently validated was for a howitzer, Cornman said.
May I look over your shoulder? In recent weeks, DC Information Systems
Inc. of Silver Spring, Md., and Viasoft Inc. of Phoenix, Primeon Inc. of Burlington,
Mass., have joined SRA International in offering year 2000 audit services.
As you might imagine, relations between an IV&V vendor and the primary year 2000
team require a fine blend of candor and diplomacy. Its done collegially,
said Patrick Burke, director of year 2000 services for SRA.
The IV&V vendor must have open access to all source code, test plans, test case
matrices, test inputs, test scripts and test output results.
At a minimum, IV&V provides a kind of desk check, Burke said. At the other extreme,
it can mean independently retesting critical system functions.
DC Information Systems specializes in a rigorous form of IV&V that employs a
specialized disk utility to identify every system file that could affect readiness.
A validated baseline is your lifeline, said Hank ONeill, a DC
Information Systems subcontractor.
No place to hide. Sometimes auditors come in after an agency thinks it
is finished with year 2000 work. That is hardly the ideal time to schedule IV&V,
according to Burke of SRA International.
What we do with most of our clients now is concurrent or inline
verification, Burke said, which means doing IV&V at key milestones in the
assessment, planning, modification, testing and implementation processes.
Dave Powner, an assistant director at the General Accounting Office, said GAO has no
plans to expand its year 2000 guidelines to include IV&V. But he did not rule out the
possibility that GAO might audit specific systems if Congress asks it to.
Florence Olsen
folsen@gcn.com