Contributed 8/29/00 by Carolann Lazurus (Clazarus@business.buffalo.edu) Librarian/Panapt Audit Program Objective: Evaluate the controls over the program source and load libraries which ensure the programs in production, and all changes to the programs, are properly controlled, protected, and authorized by management. a. Evaluate the policy and procedures for program change control and assure they use all available authorization and library management control facilities to limit changes to those that have been tested and authorized. b. Test the compliance with procedures and the reasonableness of program source code changes. c. Evaluate the security over program libraries and the use of control facilities in the authorization and library management software. d. Evaluate the parameters and processing options selected for the authorization and library management software and assure they are correctly implemented. e. Determine if user exits from the authorization and library management software are in use and assure they do not weaken or eliminate controls. f. Determine if adequate software documentation and documentation of the change control process exists to support the change process. g. Determine if adequate backup of the Librarian/Panapt software and source/load code program libraries are in place to ensure recovery of applications. I. ADMINISTRATION A. Report B. PAC'S and Exit C. Prior Report D. Audit Administration E. Audit Program F. Pre-Audit II. PROGRAM CHANGE REVIEW Objective: Evaluate the adequacy of the policy and procedures for program change control, and test the compliance with the procedures. A. Determine the normal procedures in place for the movement of programs into production. Do these procedures provide: 1. documentation of the request and reason for change; 2. user and EDP management authorization for the change; 3. segregation of duties between the individual requesting the change, the programmer making the modifications and testing the change, management review and approval of the change, and the individual moving the change into production; 4. an audit trail of the change (ie., who made the change, when, and what was changed); and 5. is there reporting back to appropriate management on changes that were made. B. Determine the procedures in place for the movement of programs into production in an emergency. Do these procedures provide the same level of control as in normal changes? C. Select a sample of changed programs, review the source code, compare changed code to change request forms and review supporting project and turnover documentation. note: This audit step is normally performed in the quarterly change control reviews. Depending on current audit scope and timing, testing can also be performed in this audit. Refer to the Program Change Review audit program C-118 for more information on this step. III. PANAPT/LIBRARIAN FILES AND INTERFACES Objective: To identify the sources of input to Panapt and Librarian processing and to evaluate controls over the input. A. Obtain or develop a list of files used in Panapt processing including: - input files, files containing Panapt programs, control parameters, and tables, files used to store change requests/ status/ approval/history/ and; - files output from Panapt processing (for input to Librarian) B. Obtain or develop a list of files used in Librarian processing including: - files input to Librarian (should be from Panapt only),files containing Librarian programs, control parameters, and tables, files used to store program source code under Librarian control, and files output from Librarian processing. C. Obtain or develop a list of automated interfaces with Panapt. - online interactive processing (TSO) - online batch submissions - scheduled job processing D. Evaluate the controls for input to Panapt processing. Confirm that access to online and batch facilities are properly restricted and that proper control features are in place. E. Obtain or develop a list of automated interfaces with Librarian. - online interactive processing (TSO) - online batch submissions (CLISTS) - scheduled job processing F. Evaluate the controls for input to Librarian processing. Confirm that access to online and batch facilities are properly restricted and that proper control features are in place. IV. PANAPT/LIBRARIAN PROCESSING Objective: To identify the key control features in processing and evaluate controls over processing. A. Identify and evaluate the control parameters for Panapt processing. 1. Obtain the Panapt control file report "Control File - Activities/Sys Info/Userids" (APCS51O3- 01) and review the parameters set up. This report will detail the Panapt activities (add a move request, delete a request, etc.) allowed users/groups and the approvals users/groups are allowed to give. note: Refer to the Panapt reference manual for more information. Also, the following reports may also be used to aid in the review and can be requested to be accessible online. "Approval Category Cross Reference" (APCS51O4-01) and "Group Cross Reference (APCS51O5-01). 2. Obtain the following Panapt reports and on a sample basis review the library codes set up. "Library Code File - Abbreviated listing" (AIPCS51O2-01) and "Library Code File - Detail Listing (APCS51O2-2) note: Library Codes within the Panapt system are primarily used to indicate what type of move is being performed (JCL, programs, etc.) and the approval levels required to move it to a QA or production status. B. Evaluate the method used to select and change the parameter values and their effectiveness. C. Review any exits taken with Panapt for its control significance. D. Identify the control parameters for Librarian datasets and programs and evaluate the method used to select the parameter values and their effectiveness. - Dataset parameters - Librarian utilities - Librarian based JCL procedures E. Determine if LIBAUDIT and the SLATS variables are in use and confirm they implement an adequate audit trail. F. Determine that ELIPSE / online TSQ processing makes proper use of Librarian controls. G. Determine that CLISTS / online job setup and submission make proper use of Librarian controls. H. Confirm that archiving is in place and that adequate prior versions of programs are maintained. I. Review any exits taken with Librarian for its control significance. V. PANAPT/LIBRARIAN OUTPUT Objective: To identify the destination of output from processing and to evaluate controls over the output. A. Identify reports produced automatically by Panapt and determine that who receives the reports is appropriate. B. Review for adequacy, the process of Production Control selecting (flagging) move requests to be moved to QA or production libraries (job DSPFRO1O), and dynamic creation of the of the move JCL/control cards for the actual move to QA or production libraries (starting with job DSPFRO2O). For more information see the perm file 1. For moves to Librarian, determine how the management code (Password needed by Librarian that works with the status of the module. PROD1 modules that should all be production, cannot be updated or deleted without tnis management code.) is passed from Panapt to Librarian. Note: In the security section of the audit program the protection of this code is reviewed. 2. For moves to Librarian, determine how the parameters for Slat variable checking is passed from Panapt to Librarian. C. Identify reports produced automatically by Librarian and determine that who receives the reports is appropriate. This includes reports from UCC7 scheduled Librarian processing, and reports from CLIST and batch processing. E. For critical control reports for Panapt and Librarian, confirm that management review is occurring. VI. PANAPT/LIBRARIAN SECURITY Objective: To determine that access to Panapt and Librarian files and facilities is restricted to authorized individuals. A. Confirm that ACF2 access controls are in place: 1. Obtain the ACF2 rules for access to Panapt and Librarian software datasets, and the Librarian source and corresponding production libraries. Review the restrictions in force. 3. Consider testing the ACF2 restrictions for updating production programs by attempting both online and batch additions to Librarian and Panapt datasets. B. Confirm that Librarian's own access controls are in use and have been correctly implemented: 1. Attempt to obtain the Management Code for Librarian by examining output from Librarian and Panapt jobs and members in the systems software. Test the control by attempting to execute restricted functions without the code. 2. Identify the status codes in use and confirm: a. all production modules are "PRODl" b. codes used in test libraries are appropriate. 3. Determine if the module password is used for a control purpose and evaluate its' use. VII. PANAPT/LIBRARIAN DOCUMENTATION Objective: To determine documentation of Librarian/Panapt and FSC procedures (System and Programming and Production Control) built around Librarian/Panapt facilities are adequate. A. Obtain copies of Panapt and Librarian documentation and evaluate it for completeness and clarity. B. Review the Systems and Programming procedures manual for change control and evaluate the adequacy of controls in the procedures. C. Review the Production Control procedures manual for change control and evaluate the adequacy of controls in the procedures. VIII. PANAPT/LIBRARIAN BACKUP Objective: To ensure that backup for Librarian and Panapt programs and datasets are made and are rotated off site in compliance with standards. A. Determine that the critical Librarian and Panapt datasets identified in the security section of the program (section VI, step A. 1.) are copied to tape and rotated to of f site storage. B. Determine that testing has been performed to restore Librarian and Panapt software and datasets.