A Framework and Implementation for Detecting Source Code Faults in COBOL Code

Abstract

Common Business-Oriented Language (COBOL) is a nearly 60-year-old programming language that resides on the majority of mainframe computers that service key industries, such as the banking, healthcare, and insurance industries. Due to its important function in running much of the digital economy, at least one major bank is turning its attention to detecting aberrations in COBOL code. In this paper, we discuss the strengths and weaknesses of the current COBOL/mainframe environment. This brings to bear the critical role COBOL plays in mainframe information technology infrastructure and the risks associated with running decades-old code. We explore various source code analysis techniques and develop a framework for applying one technique to analyze COBOL code for source code faults (SCFs). We implement the framework, test our tool in a real-world banking environment, and are able to detect SCFs in the bank’s COBOL code. According to the internal audit team at the bank, there are many benefits to using the tool. We conclude the paper with a proposal for a modified framework that would allow for more advanced predictive analytics over time.

Keywords: COBOL, Source Code Fraud

JEL Classification: M42