Our internal auditing team has found fault with our departments use of the ESP.JCL.COPY library for failed job reruns/restarts. Has anyone else been confronted with this from an auditing perspective, and if you have, could you share what type of process/p

[ken.long]

The prevailing thought is that jobs should not be run from the copy library but should go through a change process that involves reviews and approvals, in our case using Endevor to provide that process.

[Jonathan Calloway]

We do not use COPYJCL.  However, we use a library that we call 'TEMPJCL'.  Whenever a job fails that requires a change to the JCL to get it through that particular run, the developer can make a change to the JCL and place the modified JCL in their temporary library.  They can then have the operator(s) run a job that transfers their JCL into TEMPJCL.  The job is then resubmitted and when it completes, the member is removed from TEMPJCL.  If a permanent change to the JCL is required, the developer is required to go through the Change Management process.  This process provides an audit trail, as everything is tracked through the Incident Management process (via the ticket created for the original failure).  Also, this is considered an "override" by our operations staff, which means that developers are required to provide manager or team lead approval. 

 

Hope this is helpful.

Jonathan Callwoay