Compliance Checking of Organizational Interactions

Abstract

In business environments, different sorts of regulations are imposed to restrict the behavior of both public and private organizations, ranging from legal regulations to internal policies. Regulatory compliance is important for the safety of individual actors as well as the overall business environment. However, complexity derives from not only the contents of the regulations but also their interdependencies. As such, the verification of whether actors are able to comply with the combined regulations cannot be done by checking each regulation separately. To these ends, we introduce a normative structure Norm Nets (NNs) for modeling sets of interrelated regulations and setting a basis for compliance checking of organizational interactions against interrelated regulations. NNs support a modular design by providing the constructs to represent regulations and the relationships between them. Additionally, we propose a computational mechanism to reason about regulatory compliance by mapping NNs to Colored Petri Nets (CPNs). We show that compliance checking of both individual actors’ behavior and the collective behavior of the business environment can be achieved automatically using state space analysis techniques of CPNs. The approach is illustrated with a case study from the domain of international trade.

A Norm Compliance Approach for Open and Goal‐Directed Intelligent Systems

“…Typically, new plans/actions have been created to comply with new norms [14][15][16]. In [17], Jiang et al propose a normative structure, named Norm Nets (NNs) for modeling sets of interrelated regulations. NNs are aimed at verifying whether executions of business processes complied with process regulations.…”

Model Checking Based Approach for Compliance Checking

“…Event i does not correspond to a communication and it is called the unobservable event. The operational semantics of a process P is a labeled transition system, denoted as S(P), i.e., an automaton whose states correspond to processes (the initial state corresponds to P) and whose transitions (arcs) are labeled by events in E. Reader unfamiliar with Lotos process syntax can refer to [11].…”

“…The first comprehensive compliance checking approach based on Petri net patterns and alignments was proposed in [25] by Ramezani, Fahland, and van der Aalst. Colored Petri Nets have been used in [11] to perform a backward compliance checking to verify whether executions of business processes are complying with certain normative constraints. They principally focused on the formal theories of normative systems.…”

Reading agendas between the lines, an exercise

“…For this reason, they share a perspective similar to works on checking non-compliance at regulatory level, e.g. (Governatori 2013;Jiang et al 2014): system (normative) requirements are literally taken as the reference against which to test compliance of business processes. Unfortunately, in doing this, we are not able to scope behaviours that superficially look compliant, but, for those who know the 'game', are not.…”