In many industries, we must comply with state or federal statutes, government regulations, and other legal standards. The Sarbanes-Oxley Act (SOX) has brought a new awareness to these issues within testing. So, how do you incorporate legal compliance into your QA and test efforts, and how do you get the information you need to do the job well? Elle Ringham, who deals with these important issues every day at Fidelity National Financial, shares her knowledge and experiences. First, she helps you understand the types of legal compliance bodies that can affect applications and offers research methods for industry specific areas of legal compliance, including internal sources, websites, and search strategies. Then, she discusses the artifacts and metrics needed to be maintained

With billions of dollars changing hands every day, financial trading systems demand extremely high accuracy and reliability. So, how do you improve test process performance in the areas of time to market and efficiency and at the same time reduce failures? Over the last three years, using process and project measurement data as a guide, SIAC has focused on doing exactly that. Steve Boycan highlights the key elements of the process changes that have led to SIAC's current performance: the use of a rigorous requirements engineering process; controlled parallel and iterative work flows; changes to the level of abstraction in test documentation; emphasis on test planning, analysis, and design; causal analysis; and improving the test team's skills.

Structuring test designs and prioritizing your test effort for large and complex software systems are daunting tasks, ones that have beaten many, very good test engineers. If you add concurrency issues and a distributed system architecture to the mix, some would simply throw up their hands. At Microsoft, where Keith Stobie plies his trade, that is not an option. Keith and others have reengineered their testing, employing dependency analysis for test design, model property static checking, "all pairs" configuration testing, robust unit testing, and more. They employ coverage to successfully help select and prioritize tests and make effective use of random testing including fuzz testing security. Finally, models of their systems help them generate good stochastic tests and act as test oracles for automation.

• Test checklists for large, complex, distributed systems

Acceptance testing is a vital and specific form of testing whether you are tasked with rolling out an enterprise application package, releasing a major system enhancement, or developing acceptance tests in an agile development project. In addition, acceptance tests can give some teeth to service level agreements and software acquisition contracts. However, most treat acceptance testing as the same activity as system testing-but done by different staff. That is wrong! Because acceptance testing is not about bug hunting and breaking the software, you need a different strategy. With over 25 years of experience covering acceptance testing for all types of systems from safety critical control systems to standard financial applications, Geoff Quentin shares his views on how to do acceptance testing correctly.