Independent Verification & Validation
WHEN/HOW/WHY TO APPLY IT:
Independent Verification & Validation (IV&V) is a project health check, or an overall project risk assessment, performed by an independent third party, to help ensure that a project is being executed according to established project plans. The IV&V can help to verify and validate that a project is on track to meet its established goals, budget, and schedule.
The primary purpose of the IV&V is to add value to the project and to contribute to its success. IV&Vs also help to ensure that Internal Audit is connected appropriately from a risk and internal control standpoint and as an extra assurance to point to for parties holding the University accountable for project success.
When performed, IV&Vs should be conducted for all phases of a project – from conception to just prior to launch.
WHO DOES IT AND WHO APPROVES THE IV&V DECISION?
- If a technology project exceeds $1 million in total project costs, the Project Manager, along with the primary Project Sponsor, should complete the IV&V Assessment Tool for Technology Projects. Any project that receives an IV&V Assessment Tool score of 15 or more will be required to have an IV&V assessment. If determined using the IV&V Assessment Tool that IV&V is needed, a Project Risk Assessment will be conducted by Internal Audit (IA) with the project manager and sponsor(s), which will recommend internal vs. external review and scope of the review. Default is for IA to do IV&V, given they are objective and have a direct line to the Board of Visitors. Factors influencing internal/external recommendation include:
- Whether IA has capacity (skillset/resources) to perform IV&V (Project Health Check)
- If there are separate entities or vendors involved that need assurance about the project and could perceive IA as part of UVa and not as objective as external 3rd party
- If there are other (political/conflict of interest/other) circumstances that make an external party a better choice
- If external, IA will recommend how they will be connected/involved throughout the project.
- IA and project sponsor(s) make recommendation on internal vs. external and scoping to appropriate EVP(s), who ultimately decide on the approach for IV&V.
- The project's budget is responsible for all costs associated with IV&V services.
WHO IS INVOLVED/CONSULTED/INFORMED DURING IV&V WORK?
- IA should either be doing the work, co-sourcing, or informed/engaged with external 3rd party work.
- Where do reports go and under what circumstances:
- To the PM/Project Sponsor
- To the EVPS/President as applicable
- To Internal Audit
- To Board of Visitors Audit Committee Chair as applicable
Commonwealth of Virginia IT Project Reporting
All IT projects (except those involving research projects, research initiatives, or instructional programs) that exceed $1 million are subject to quarterly state reporting and must be reviewed with the University VP-CIO.
IT project managers are responsible for scheduling a project review session with the University VP-CIO and project sponsor to discuss IV&V Assessment Tool scores and potential Commonwealth of Virginia reporting requirements.