1

Use the Fixed and Modified LPA Display (3.5) to prepare a work paper that documents the modules loaded in each, because both FLPA and MLPA are considered APF‑authorized. The presence of either type of LPA extension usually indicates that the data center customized the LPA.

2

Determine from the display if any of the modules appear in both FLPA and MLPA.

z/OS use only the FLPA version if duplication occurs. FLPA takes precedence over MLPA.

Browse the logical Parmlib to ensure that none of the modules are listed in both IEAFIXxx (the FLPA member) and IEALPAxx (the MLPA member).

z/OS create certain MLPA entries internally.

3

Note any modules that have corresponding modules in PLPA. Investigate why the module exists in both places. Often, this is for testing purposes. However, you should determine why PLPA modules are overridden.

Investigate the purpose, use, and function of any module in FLPA or MLPA that does not exist in PLPA.

4

Next, determine if any new modules were added to FLPA or MLPA since IPL. To determine this, look for a nonstandard storage residency for the modules.

If the residency is CSA or ECSA, a dynamic system update occurred. CA Auditor flags this condition for review. Some APF‑authorized program products introduce modules in this way. Review these modules as described in the next step.

5

Select each module marked for review by the asterisk (*) and press Enter. On the detail screen that appears, review the description of the module. This detail screen shows the relationship between LPA‑resident modules and the versions that supercede them.

Check the detailed analysis for information that explains why CA Auditor indicated this module for review. The length of the module and its address can be useful in further investigation. Keep in mind the message that appears on the first screen in the Attributes and Comments field. Look at the module in the context of this message.

6

Use the Program Statistics (5.2) and Program Origin (5.1) displays to gather additional documentation about modules recommended for additional review.

Use the File History Search (6.5) for information about updates that were made to any library that can supply modifications to the standard LPA library, SYS1.LPALIB. This includes SVCLIB and all linklist libraries.

7

Use the Parmlib Member Status display (2.1.2) to determine if any changes occurred to the IEAFIXxx or IEALPAxx members of the logical Parmlib since the last review. Verify that any changes agree with change control procedures and records.

8

If changes were detected in Step 8, use the File History Search (6.5) for the period preceding the change to determine who made the change. Many data centers use ISPF/PDF that can supply library update statistics. These statistics can provide clues to the identity of the user who made the change. The statistics are part of the standard ISPF/PDF Browse member list.

9

If an archived or backup copy of logical Parmlib data sets is available, use the File Compare display (6.4) to review the exact changes to the IEAFIXxx and IEALPAxx members of the logical Parmlib.

10

Use the Catalog File Scan (6.2) or your access control software to verify that the logical Parmlib data sets are not subject to unauthorized access or modification.