Business Process Compliance through Reusable Units of Compliant Processes

Abstract

Compliance management is essential for ensuring that organizational business processes and supporting information systems are in accordance with a set of prescribed requirements originating from laws, regulations, and various legislative or technical documents such as Sarbanes-Oxley Act or ISO 17799. As the violation of such requirements may lead to significant punishment for an organization, compliance management should be supported at the very early stages of business process development. In this paper, we present an integrated approach to compliance management that helps process designers to adhere to compliance requirements relevant for their processes. Firstly, we introduce a conceptual model for specifying compliance requirements originating from various compliance sources. Secondly, we propose a framework for augmenting business processes with reusable fragments to ensure process compliance to certain requirements by design. Furthermore, we discuss the formalization of compliance requirements using mathematical logics and integrate the framework for process reuse with automated software verification tools.

Modeling Concepts for Internal Controls in Business Processes – An Empirically Grounded Extension of BPMN

“…Sadiq et al [24] use the concepts control objective, internal control, risk, process control flow, process task, and property to ontologically align the compliance domain with process modeling. Schumm et al [25] and Turetken et al [26] present a conceptual model that focuses on compliance requirements. A compliance requirement stems from a compliance source, is associated to a compliance risk and can be assessed by a compliance request.…”

An approach to combine data-related and control-flow-related compliance rules

“…The interrelation of reusable process artifacts implementing compliance requirements on one side, and the compliance patterns approach by Turetken et al has been explored in [14].…”

Business process compliance checking – applying and evaluating a generic pattern matching approach for conceptual models in the financial sector

“…More elaborative approaches can additionally handle business objects Elgammal et al 2010;Kokash and Arbab 2009;Schumm et al 2010) (№ 12). The approach of Accorsi et al (2011) (№ 13) focuses on data security annotations, while the PENELOPE approach (Goedertier and Vanthienen 2006) (№ 16) supports the definition and check of activity operators.…”