Organizations today are required to adhere to a number of compliance concerns from laws, regulations and policies. Compliance is achieved through defining and implementing so-called controls in the organizations' business processes. Organizations that build their systems based on the process-driven SOA paradigm realize business processes through orchestration of services to handle the process' business activities. These business activities or groups of business activities in some cases realize the compliance controls. We propose an approach for implementing event-based compliance monitoring infrastructure that observes such business processes to verify that compliance is indeed adhered to. Our approach is essentially a model-driven technique for realizing this infrastructure. We implement a domainspecific language for specification of compliance directives, and we include code generation templates to generate compliance monitoring code, which is leveraged by complex event processing components to monitor for compliance. We evaluate the impact of our approach on the effort and productivity of a developer who is specifying compliance directives.

No abstract

No abstract

Business processes today are supported by process-driven service oriented architectures. Due to the increasing importance of compliance of an organization with regulatory requirements and internal policies, there is a need for appropriate techniques to monitor organizational information systems as they execute business processes. Event-based monitoring of processes is one of the ways to provide runtime process-state information. This type of monitoring, however, has limitations mostly related to the type and amount of information available in events and process engines. We propose a novel approach -model-aware monitoring of business processes -to address these limitations. Emitted events contain unique identifiers of models that can be retrieved dynamically during runtime from a model-aware repository and service environment (MORSE). The size of the events is kept small and patterns of events that signify interesting occurrences are identified through complex event processing and are signaled to interesting components such as a business intelligence. To illustrate our approach we present an industry case study where we have applied this generic infrastructure for the compliance monitoring of business processes.