Verification and validation
Verification and validation (also abbreviated as V&V) are independent procedures that are used together for checking that a product, service, or system meets requirements and specifications and that it fulfills its intended purpose. These are critical components of a quality management system such as ISO 9000. The words "verification" and "validation" are sometimes preceded with "independent", indicating that the verification and validation is to be performed by a disinterested third party. "Independent verification and validation" can be abbreviated as "IV&V".
In reality, as quality management terms, the definitions of verification and validation can be inconsistent. Sometimes they are even used interchangeably.
However, the PMBOK guide, a standard adopted by the Institute of Electrical and Electronics Engineers (IEEE), defines them as follows in its 4th edition:
- "Validation. The assurance that a product, service, or system meets the needs of the customer and other identified stakeholders. It often involves acceptance and suitability with external customers. Contrast with verification."
- "Verification. The evaluation of whether or not a product, service, or system complies with a regulation, requirement, specification, or imposed condition. It is often an internal process. Contrast with validation."
Similarly, for a Medical device, the FDA (21 CFR) defines Validation and Verification as procedures that ensures that the device fulfil their intended purpose.
- Validation: Ensuring that the device meets the needs and requirements of its intended users and the intended use environment.
- Verification: Ensuring that the device meets its specified design requirements
ISO 9001:2015 (Quality management systems requirements) makes the following distinction between the two activities, when describing design and development controls:
- Validation activities are conducted to ensure that the resulting products and services meet the requirements for the specified application or intended use.
- Verification activities are conducted to ensure that the design and development outputs meet the input requirements.
It also notes that verification and validation have distinct purposes but can be conducted separately or in any combination, as is suitable for the products and services of the organization.
FAA defines Validation and Verification as follows:
- Validation. Confirmation that a product or end product component will fulfill its intended purpose and user needs when placed in its intended environment. The methods employed to accomplish validation are applied to selected work products and the product and product components. The work products should be selected based on which are the best predictors of how well the product and product components will satisfy the intended purpose and user needs. Validation can apply to all aspects of a product in its intended environments, such as operation, training, manufacturing, maintenance, or support services.
- Verification. Confirmation that selected work products meet their specified requirements. This includes verification of the product (system, service, enterprise capability, or operational change) and intermediate work products against all applicable requirements. Verification is inherently an incremental process since it occurs throughout the development lifecycle of the work products, beginning with initial requirements, progressing through subsequent changes, and culminating in the verification of the completed product.
The National Institute of Standards and Technology Information Technology Laboratory Computer Security Resource Center has a variety of definitions for both validation and verification
- Validation - The first definition indicates confirmation (through the provision of strong, sound, objective evidence) that requirements for a specific intended use or application have been fulfilled. However, within the family of definitions, it is frequently used in a manner synonymous with verification.
- Verification - often used to indicate a persona or identity has been verified against a database, such as a PIN-protected identify certificate matches a controlled access list.