Independent verification of UI systems for Year 2000

U.S. DEPARTMENT OF LABOR
Employment and Training Administration
Washington, D.C. 20210

Classification: UI
Correspondence Symbol: TEUT
Issue Date: August 6, 1998
Rescissions: None
Expiration Date: August 6, 1999

DIRECTIVE: UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 38-98
TO: ALL STATE EMPLOYMENT SECURITY AGENCIES
FROM: GRACE A. KILBANE, Director, Unemployment Insurance Service
SUBJECT: Independent Verification and Validation of Year 2000 Compliance

1. Purpose. To advise State Employment Security Agencies (SESAs) of the Department's policy concerning independent verification and validation (IV&V) of year 2000 compliance of SESAs' unemployment insurance (UI) automated benefit and tax systems; to provide guidelines for use in performing IV&V; and to require the submission of IV&V plans.

2. Reference. ETA Handbook 336, 15^TH^ Edition

3. Background. IV&V is a process that is defined formally in the Institute of Electrical and Electronic Engineers Standards (IEEE Std-1012). The relevant section of this standard states that IV&V is verification and validation processes performed by an organization with a specified degree of technical, managerial, and financial independence from the development organization. Verification is defined as confirmation by examination and provision of objective evidence that specified requirements have been fulfilled. Validation is defined as the confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use are fulfilled. The working definition used by the Department of Labor is that validation asks and answers the question, "Are we doing the right thing?" while verification asks and answers the question, "Are we doing the thing right?"

4. Departmental IV&V Policies. SESAs must ensure the integrity of their year 2000 compliance efforts by conducting IV&V of their mission critical UI automated systems. Mission critical UI systems include benefit and tax systems and other automated systems which may affect the operation of the benefit and tax systems.

   The SESAs' IV&V process must include reviewing the results of point-to-point testing, i.e., test all systems which interface with the UI systems, a full clock advance test, and tests to check that the automated system will accurately process dates, including the recommended testing date validations listed in the attachment. SESAs are required to certify to the respective Regional Office that this complete testing process has been accomplished, that testing indicates that the automated systems are year 2000 compliant and that an IV&V process was conducted to corroborate the testing results.

   The IV&V review consists of the following major parts: (a) examination of the SESA's remediation effort, including configuration management and change control mechanisms; and (b) review of the year 2000 test plans, testing procedures and test results, including the date validations included in the attachment. An IV&V report should be provided to the SESA which provides the findings of the IV& V team. If the IV&V team cannot state that "after completing the IV&V process, the system has a high degree of likelihood that it is year 2000 compliant" then the report must address specific areas of concern and make recommendations to the SESA to improve its process.

   SESAs can meet the independence criteria through a variety of ways. These include:

   • Contract with an IV&V Agent - There are no independence issues if the SESA contracts with an IV&V agent. However, if the IV&V agent is hired by a SESA contractor who is the developer/renovator of the system, then the IV&V agent must be independent, using technical judgement independent of the project contractor, must have a management structure that reports to both the contractor and the SESA, and must have a contractual arrangement that separates the financial consideration for the IV&V effort from the elements of the project.

   • Use of existing SESA resources - A SESA may use an existing agency resource if it is a truly separate and independent facility that is capable of performing IV&V on a technical basis. The facility must be immune to political and organizational pressures. The performing agency must have documented policy statements and organizational mission and function statements that show that the facility operates in an independent manner. The Regional Office must approve the use of existing SESA resources for IV&V purposes.

   • Other resources - SESAs may use other resources for IV&V only with the express consent of the Regional Office.

5. IV& V Plans. SESAs must develop plans for the conduct of the IV&V process. The plan should include who will conduct the IV&V, what areas will be covered during the IV&V process, when the IV&V process will start and end, and when the IV&V report will be submitted. The plan must include the Regional Office's approval if use of other than a contract IV&V agent is contemplated.

6. Action Required. Administrators are to provide this information to appropriate staff for action. SESAs are requested to: (a) develop and provide their IV&V plans to their Regional Office by September 30, 1998; (b) provide their Regional Office with the certification of year 2000 compliance for their UI benefits system by December 1, 1998, and for their UI tax system by July 1, 1999. Year 2000 compliance certifications must include a copy of the IV&V review report.

7. Inquiries. Inquiries should be directed to the appropriate Regional Office.

Attachment (https://oui.doleta.gov/dmstree/uipl/uipl98/uipl_3898a.htm)

Date Specific Y2K System Compliance

Background

Validating Y2K compliance requires demonstration that all date sensitive requirements have been satisfied. Attached are lists of various dates, intervals, and days of the year that should be used to help validate SESAs' systems for Year 2000 compliancy. The lists have been compiled from industry best practices sources.

Discussion

To achieve minimum compliance, it is strongly suggested that all application software and associated operating systems be able to accurately process the Y2K date sensitive requirements. The requirements have been separated into four lists to highlight the particular Y2K sensitivity.

Special Dates to Test for Y2K Compliance

LIST I — Special Dates

LIST II — Date Intervals

This list identifies suggested from/to date combinations for which correct and successful "time rollover" needs to occur. For the "from" time it is suggested to be 23:55:00; the "to" time should be 00:05:00.

LIST III — Days of the Year

If the system processes and produces 'day of the year' values then it is necessary to ensure that the correct day of the year for all days in 2000 and beyond 02/28/2000 are correct. Examples include:

Day-of-year (02/29/2000) = 60

Day-of-year (03/01/2000) = 61

Day-of-year (12/31/2000) = 366

LIST IV — Miscellaneous Dates

Develop an offset value to insure that the date/day coordination is handled properly (e.g., adding 28 years to 1996 dates ensures that 2024 dates fall on the same day).

Verify that all date offset formulas are synchronized with unique industry requirements (e.g., cannot have a bank posting date on Sunday).

Special firsts or lasts or system critical dates (i.e. Fiscal years, etc.) should be tested, such as first Pay Period, first Billing Period, First/ Last day of Accounting Period, first end of month, first end of quarter, etc., to assure that system will function successfully past 1/1/2000.