Compliance checking of integrated business processes

I. A. Letia,Adrian Groza

DOI: https://doi.org/10.1016/j.datak.2013.03.002

IF: 1.5

2013-09-01

Data & Knowledge Engineering

Abstract:

What problem does this paper attempt to address?

Compliance Management in Business Processes

Sridevi Saralaya,Vishwas Saralaya,Rio D’Souza

DOI: https://doi.org/10.1007/978-3-319-93940-7_3

2018-07-27

Digital Business

Abstract:Business Process Compliance refers to the act of conformance of a business process with policies, regulations and rules that govern the organization. An imperative requirement of business processes in various fields such as Health care, Insurance, Finance and Online Trade is adherence to a large number of compliance requirements, constraints and quality policies from various sources. Lack of compliance may result in huge compensations and loss of customers and reputation. Compliance issues can be handled either retrospectively i.e. after non-complaint situations are observed or they can be handled proactively i.e. anticipation of possibilities leading to non-compliant circumstances during process execution which may prevent occurrence of deviations and thus save upon compensation effects. Hence compliance management tasks need to be incorporated into each phase of the life-cycle of a business process. In this article we discuss contemporary activities related to lifecycle of compliance management in business processes which involve compliance elicitation, compliance formalization, compliance implementation, compliance verification and compliance improvement based on existing literature. Compliance Monitoring Functionalities (CMFs) which may be used to categorize and also assess existing compliance management approaches and frameworks are also discussed.
An Automatic Compliance Checking Approach for Software Processes

Xiaoyang He,Jingang Guo,Yasha Wang,Ying Guo

DOI: https://doi.org/10.1109/apsec.2009.48

2009-01-01

Abstract:A lot of knowledge has been accumulated and documented in the form of process models, standards, best practices, etc. The knowledge tells how a high quality software process should look like, in other words, which constrains should be fulfilled by a software process to assure high quality software products. Compliance checking for a predefined process against proper constrains is helpful to quality assurance. Checking the compliance of an actual performed process against some constrains is also helpful to process improvement. Manual compliance checking is time-consuming and error-prone, especially for large and complex processes. In this paper, we record the process knowledge by means of process pattern. We provide an automatic compliance checking approach for process models against constrains defined in process patterns. Checking results indicate where and which constrains are violated, and therefore suggests the focuses of future process improvement. We have applied this approach in three real projects and the experimental results are also presented.
Business Process Compliance Using Reference Models of Law

Hugo A. López,Søren Debois,Tijs Slaats,Thomas T. Hildebrandt

DOI: https://doi.org/10.1007/978-3-030-45234-6_19

2020-01-01

Abstract:Legal compliance is an important part of certifying the correct behaviour of a business process. To be compliant, organizations might hard-wire regulations into processes, limiting the discretion that workers have when choosing what activities should be executed in a case. Worse, hard-wired compliant processes are difficult to change when laws change, and this occurs very often. This paper proposes a model-driven approach to process compliance and combines a) reference models from laws, and b) business process models. Both reference and process models are expressed in a declarative process language, The Dynamic Condition Response (DCR) graphs. They are subject to testing and verification, allowing law practitioners to check consistency against the intent of the law. Compliance checking is a combination of alignments between events in laws and events in a process model. In this way, a reference model can be used to check different process variants. Moreover, changes in the reference model due to law changes do not necessarily invalidate existing processes, allowing their reuse and adaptation. We exemplify the framework via the alignment of laws and business rules and a real contract change management process, Finally, we show how compliance checking for declarative processes is decidable, and provide a polynomial time approximation that contrasts NP complexity algorithms used in compliance checking for imperative business processes. All-together, this paper presents technical and methodological steps that are being used by legal practitioners in municipal governments in their efforts towards digitalization of work practices in the public sector.
Verifying Compliance in Process Choreographies: Foundations, Algorithms, and Implementation

Walid Fdhila,David Knuplesch,Stefanie Rinderle-Ma,Manfred Reichert

DOI: https://doi.org/10.48550/arXiv.2110.09399

2021-12-17

Abstract:The current push towards interoperability drives companies to collaborate through process choreographies. At the same time, they face a jungle of continuously changing regulations, e.g., due to the pandemic and developments such as the BREXIT, which strongly affect cross-organizational collaborations. Think of, for example, supply chains spanning several countries with different and maybe even conflicting COVID19 traveling restrictions. Hence, providing automatic compliance verification in process choreographies is crucial for any cross-organizational business process. A particular challenge concerns the restricted visibility of the partner processes at the presence of global compliance rules (GCR), i.e., rules that span across the process of several partners. This work deals with the question how to verify global compliance if affected tasks are not fully visible. Our idea is to decompose GCRs into so called assertions that can be checked by each affected partner whereby the decomposition is both correct and lossless. The algorithm exploits transitivity properties of the underlying rule specification, and its correctness and complexity are proven, considering advanced aspects such as loops. The algorithm is implemented in a proof-of-concept prototype, including a model checker for verifying compliance. The applicability of the approach is further demonstrated on a real-world manufacturing use case.

Logic in Computer Science
Efficient Checking of Temporal Compliance Rules Over Business Process Event Logs

Adriano Augusto,Ahmed Awad,Marlon Dumas

DOI: https://doi.org/10.48550/arXiv.2112.04623

2021-12-10

Abstract:Verifying temporal compliance rules, such as a rule stating that an inquiry must be answered within a time limit, is a recurrent operation in the realm of business process compliance. In this setting, a typical use case is one where a manager seeks to retrieve all cases where a temporal rule is violated, given an event log recording the execution of a process over a time period. Existing approaches for checking temporal rules require a full scan of the log. Such approaches are unsuitable for interactive use when the log is large and the set of compliance rules is evolving. This paper proposes an approach to evaluate temporal compliance rules in sublinear time by pre-computing a data structure that summarizes the temporal relations between activities in a log. The approach caters for a wide range of temporal compliance patterns and supports incremental updates. Our evaluation on twenty real-life logs shows that our data structure allows for real-time checking of a large set of compliance rules.

Data Structures and Algorithms,Software Engineering
ICT Support for Regulatory Compliance of Business Processes

Guido Governatori

DOI: https://doi.org/10.48550/arXiv.1403.6865

2014-03-27

Abstract:In this paper we propose an ITC (Information and Communication Technology) approach to support regulatory compliance for business processes, and we report on the development and evaluation of a business process compliance checker called Regorous, based on the compliance-by-design methodology proposed by Governatori and Sadiq

Software Engineering,Computers and Society
A Taxonomy of Compliance Processes for Business Process Compliance

Tobias Seyffarth,Stephan Kühnel,Stefan Sackmann

DOI: https://doi.org/10.1007/978-3-319-65015-9_5

2017-01-01

Abstract:Dynamic markets and new technology developments lead to an increasing number of compliance requirements. Thus, affected business processes must be flexible and adaptable. Ensuring business processes compliance (BPC) is traditionally operationalized by means of controls, which can be described as simple target-performance comparisons. Since such controls are not always suitable for achieving BPC, the view is extended by so-called compliance processes. However, the definition and design of appropriate compliance processes for effective BPC depend on a multitude of process characteristics. To address this issue on a general level, we developed a taxonomy for compliance processes consisting of 9 dimensions and 37 characteristics. As a result, the taxonomy allows researchers and practitioners to classify compliance processes according to the state of the art in a formal way. Furthermore, it provides a systematic fundament for greater flexibility, i.e. an ad hoc integration of compliance processes into ongoing business processes to ensure BPC during runtime.
Efficient Semantics-Based Compliance Checking Using LTL Formulae and Unfolding.

Liang Song,Jianmin Wang,Lijie Wen,Hui Kong

DOI: https://doi.org/10.1155/2013/962765

2013-01-01

Journal of Applied Mathematics

Abstract:Business process models are required to be in line with frequently changing regulations, policies, and environments. In the field of intelligent modeling, organisations concern automated business process compliance checking as the manual verification is a time-consuming and inefficient work. There exist two key issues for business process compliance checking. One is the definition of a business process retrieval language that can be employed to capture the compliance rules, the other concerns efficient evaluation of these rules. Traditional syntax-based retrieval approaches cannot deal with various important requirements of compliance checking in practice. Although a retrieval language that is based on semantics can overcome the drawback of syntax-based ones, it suffers from the well-known state space explosion. In this paper, we define a semantics-based process model query language through simplifying a property specification pattern system without affecting its expressiveness. We use this language to capture semantics-based compliance rules and constraints. We also propose a feasible approach in such a way that the compliance checking will not suffer from the state space explosion as much as possible. A tool is implemented to evaluate the efficiency. An experiment conducted on three model collections illustrates that our technology is very efficient.
Fuzzy Multi-Perspective Conformance Checking for Business Processes

Sicui Zhang,Laura Genga,Lukas Dekker,Hongchao Nie,Xudong Lu,Huilong Duan,Uzay Kaymak

DOI: https://doi.org/10.1016/j.asoc.2022.109710

IF: 8.7

2022-01-01

Applied Soft Computing

Abstract:Conformance checking techniques are widely used to monitor the execution of organization processes and to pinpoint possible violations of the prescribed behavior. State-of-the-art approaches adopt a crisp evaluation of deviations: namely, every step in the execution which is not perfectly compliant with the procedural rules is marked as deviant. However, many real-world processes are driven by decisions taken by human actors, which are often characterized by uncertainty. As a consequence, deviations are often tolerated, within some boundaries. In these contexts, assessing small violations at the same level as significant ones hampers the accuracy of the provided diagnostics. In this work, we propose a novel conformance checking approach which allows to consider actors’ tolerance to violations when assessing the magnitude of detected deviations, taking into account different kinds of deviating behaviors. Experiments conducted on two real-life clinical data sets have shown that taking the extent of deviations into account leads to more fine-grained diagnostics, thus illustrating the value of the approach.
Towards a Formal Framework for Partial Compliance of Business Processes

Ho-Pun Lam,Mustafa Hashmi,Akhil Kumar

DOI: https://doi.org/10.48550/arXiv.2012.13219

2020-12-24

Abstract:Binary "YES-NO" notions of process compliance are not very helpful to managers for assessing the operational performance of their company because a large number of cases fall in the grey area of partial compliance. Hence, it is necessary to have ways to quantify partial compliance in terms of metrics and be able to classify actual cases by assigning a numeric value of compliance to them. In this paper, we formulate an evaluation framework to quantify the level of compliance of business processes across different levels of abstraction (such as task,trace and process level) and across multiple dimensions of each task (such as temporal, monetary, role-, data-, and quality-related) to provide managers more useful information about their operations and to help them improve their decision making processes. Our approach can also add social value by making social services provided by local, state and federal governments more flexible and improving the lives of citizens.

Artificial Intelligence,Logic in Computer Science
Conformance checking: A state-of-the-art literature review

Sebastian Dunzer,Matthias Stierle,Martin Matzner,Stephan Baier

DOI: https://doi.org/10.1145/3329007.3329014

2020-07-21

Abstract:Conformance checking is a set of process mining functions that compare process instances with a given process model. It identifies deviations between the process instances' actual behaviour ("as-is") and its modelled behaviour ("to-be"). Especially in the context of analyzing compliance in organizations, it is currently gaining momentum -- e.g. for auditors. Researchers have proposed a variety of conformance checking techniques that are geared towards certain process model notations or specific applications such as process model evaluation. This article reviews a set of conformance checking techniques described in 37 scholarly publications. It classifies the techniques along the dimensions "modelling language", "algorithm type", "quality metric", and "perspective" using a concept matrix so that the techniques can be better accessed by practitioners and researchers. The matrix highlights the dimensions where extant research concentrates and where blind spots exist. For instance, process miners use declarative process modelling languages often, but applications in conformance checking are rare. Likewise, process mining can investigate process roles or process metrics such as duration, but conformance checking techniques narrow on analyzing control-flow. Future research may construct techniques that support these neglected approaches to conformance checking.

Software Engineering,Information Retrieval
Automated Sustainability Compliance Checking Using Process Mining and Formal Logic

Clemens Schreiber

DOI: https://doi.org/10.1145/3401335.3401355

2020-06-18

Abstract:Business processes need to have certain constraints such that they can lead to sustainable outcomes. These constraints can be manifold and their adherence has to be monitored. In the past compliance checking has been applied in several business domains without considering certain sustainability aspects, such as multi-dimensionality and impact level. With my research I want to contribute to the application of compliance checking techniques for the purpose of sustainability compliance. In order to achieve this, I want to analyse and develop data-driven approaches, which allow to automate the task of compliance checking. The way in which this can be achieved, is be combining methods from process mining with formal languages that can express sustainability rules in a machine-readable manner. The main goal is to develop a compliance engine that can be adapted by ERP systems in order to evaluate sustainability conformance in business processes.

Computers and Society
Three Decades of Formal Methods in Business Process Compliance: A Systematic Literature Review

Hugo A. López,Thomas T. Hildebrandt

2024-10-14

Abstract:Digitalization efforts often face a key challenge: business processes must not only be efficient in achieving their goals but also adhere to legal regulations. Business process compliance refers to aligning processes with these regulations. Numerous frameworks have been developed to address this, with the earliest dating back to 1981. This study focuses on rigorous frameworks using formal methods to verify or ensure compliance. We conducted a systematic literature review (SLR) on process compliance frameworks based on formal models. Our goal was to assess the current state of research on process model compliance and identify gaps and opportunities for future work. Starting with 5018 candidate studies from 1981 to the establishment of GDPR, we selected 46 primary studies. These frameworks were categorized by their phases, the languages used for processes and compliance, and their reasoning techniques. We also examined their practical applicability, the case studies they were tested on, the types of users involved, and the skills needed for compliance. Also, we assessed the maturity of each framework. Our findings reveal strong consensus around verification techniques as central to process compliance, though there is less agreement on the earlier and later phases of compliance. Model checking is the dominant technique, but the compliance and process languages have evolved. Most frameworks are still conceptual with prototype implementations, often failing to account for compliance professionals like legal experts or law changes. In conclusion, there is a need for comprehensive empirical studies to better understand the anatomy and maturity of regulatory compliance frameworks, and for robust evaluation methods to benchmark these frameworks. This review offers valuable insights for researchers and practitioners in process compliance.

Software Engineering
Separating Compliance Management and Business Process Management

Elham Ramezani,Dirk Fahland,Jan Martijn van der Werf,Peter Mattheis

DOI: https://doi.org/10.1007/978-3-642-28115-0_43

2012-01-01

Abstract:The ever growing set of regulations and laws organizations have to comply to, introduces many new challenges. Current approaches that check for compliance by implementing controls in an existing information system (IS) decrease the maintainability of both the set of compliance rules and the IS. In this position paper, we advocate the separation of the compliance process from the organization’s business processes. We introduce a life cycle for the management of compliance rules. A separate compliance engine is used to define and check compliance rules independent from the existing IS within an organization.
VERBUS: A Formal Model for Business Process Verification

Andrés Marín López,C. D. Kloos,J. A. Fisteus

Abstract:Business process management is a key issue in B2B. Different process modelling languages and workflow management tools and frameworks have appeared to aid the development, deployment and management of e-commerce solutions. Nevertheless, there is not yet a framework to compel with tasks such as guaranteeing: safety outcomes of the run of a composition of processes, the eventual execution of processes under some condition, or the soundness of a design with respect to the specification. This is the mission of formal methods, and they have been successfully applied in the fields of real-time software, hardware verification, and a growing list of application areas as the computation costs decrease. In this article we present VERBUS, a formal system for the modelling and verification of business processes. VERBUS allows a designer to specify properties for verification. The Finite State Machine theory is under the hood of VERBUS, providing the designer with a well-known and understandable approach, which offers a set of existing tools for verification or for compiling to other formats for the application of model–checkers.

Computer Science,Business
A Method for Checking Consistency Between Domain Requirements and Business Process

LIU Jin-du,SHEN Li-wei,PENG Xin,ZHAO Wen-yun

DOI: https://doi.org/10.3969/j.issn.1000-1220.2013.06.015

2013-01-01

Abstract:BPMN is a business process modeling standards commonly used in the field of software development.In the software product line with process variability,BPMN process templates support to descript business process from domain requirements,and derive process instance towards particular application requirements effectively.However,there always exist inconsistency between domain requirements and business process templates.For this problem,this paper presents a method for model checking consistency between domain requirements and business process,which descript domain requirements as FLTL properties,translate BPMN instance to FSP expression,and check the inconsistency using an automated model checking tool which will send back the result.
Predictive Compliance Monitoring in Process-Aware Information Systems: State of the Art, Functionalities, Research Directions

Stefanie Rinderle-Ma,Karolin Winter,Janik-Vasily Benzin

DOI: https://doi.org/10.1016/j.is.2023.102210

2023-03-02

Abstract:Business process compliance is a key area of business process management and aims at ensuring that processes obey to compliance constraints such as regulatory constraints or business rules imposed on them. Process compliance can be checked during process design time based on verification of process models and at runtime based on monitoring the compliance states of running process instances. For existing compliance monitoring approaches it remains unclear whether and how compliance violations can be predicted, although predictions are crucial in order to prepare and take countermeasures in time. This work, hence, analyzes existing literature from compliance monitoring as well as predictive process monitoring and provides an updated framework of compliance monitoring functionalities. Moreover, it raises the vision of a comprehensive predictive compliance monitoring system that integrates existing predicate prediction approaches with the idea of employing PPM with different prediction goals such as next activity or remaining time for prediction and subsequent mapping of the prediction results onto the given set of compliance constraints (PCM). For each compliance monitoring functionality we elicit PCM system requirements and assess their coverage by existing approaches. Based on the assessment, open challenges and research directions realizing a comprehensive PCM system are elaborated.

Software Engineering,Artificial Intelligence
Designing Compliant Business Processes with Obligations and Permissions

Stijn Goedertier,Jan Vanthienen

DOI: https://doi.org/10.1007/11837862_2

2006-01-01

Abstract:The sequence and timing constraints on the activities in business processes are an important aspect of business process compliance. To date, these constraints are most often implicitly transcribed into control-flow-based process models. This implicit representation of constraints, however, complicates the verification, validation and reuse in business process design. In this paper, we investigate the use of temporal deontic assignments on activities as a means to declaratively capture the control-flow semantics that reside in business regulations and business policies. In particular, we introduce PENELOPE, a language to express temporal rules about the obligations and permissions in a business interaction, and an algorithm to generate compliant sequence-flow-based process models that can be used in business process design.
Checking Security Policy Compliance

Vaibhav Gowadia,Csilla Farkas,Michiharu Kudo

DOI: https://doi.org/10.48550/arXiv.0809.5266

2008-09-30

Cryptography and Security

Abstract:Ensuring compliance of organizations to federal regulations is a growing concern. This paper presents a framework and methods to verify whether an implemented low-level security policy is compliant to a high-level security policy. Our compliance checking framework is based on organizational and security metadata to support refinement of high-level concepts to implementation specific instances. Our work uses the results of refinement calculus to express valid refinement patterns and their properties. Intuitively, a low-level security policy is compliant to a high-level security policy if there is a valid refinement path from the high-level security policy to the low-level security policy. Our model is capable of detecting violations of security policies, failures to meet obligations, and capability and modal conflicts.
Enabling model checking for collaborative process analysis: from BPMN to ‘Network of Timed Automata’

Sihem Mallek,Nicolas Daclin,Vincent Chapurlat,Bruno Vallespir

DOI: https://doi.org/10.1080/17517575.2013.879211

2014-01-20

Enterprise Information Systems

Abstract:Interoperability is a prerequisite for partners involved in performing collaboration. As a consequence, the lack of interoperability is now considered a major obstacle. The research work presented in this paper aims to develop an approach that allows specifying and verifying a set of interoperability requirements to be satisfied by each partner in the collaborative process prior to process implementation. To enable the verification of these interoperability requirements, it is necessary first and foremost to generate a model of the targeted collaborative process; for this research effort, the standardised language BPMN 2.0 is used. Afterwards, a verification technique must be introduced, and model checking is the preferred option herein. This paper focuses on application of the model checker UPPAAL in order to verify interoperability requirements for the given collaborative process model. At first, this step entails translating the collaborative process model from BPMN into a UPPAAL modelling language called ‘Network of Timed Automata’. Second, it becomes necessary to formalise interoperability requirements into properties with the dedicated UPPAAL language, i.e. the temporal logic TCTL.

computer science, information systems

Compliance checking of integrated business processes

Compliance Management in Business Processes

An Automatic Compliance Checking Approach for Software Processes

Business Process Compliance Using Reference Models of Law

Verifying Compliance in Process Choreographies: Foundations, Algorithms, and Implementation

Efficient Checking of Temporal Compliance Rules Over Business Process Event Logs

ICT Support for Regulatory Compliance of Business Processes

A Taxonomy of Compliance Processes for Business Process Compliance

Efficient Semantics-Based Compliance Checking Using LTL Formulae and Unfolding.

Fuzzy Multi-Perspective Conformance Checking for Business Processes

Towards a Formal Framework for Partial Compliance of Business Processes

Conformance checking: A state-of-the-art literature review

Automated Sustainability Compliance Checking Using Process Mining and Formal Logic

Three Decades of Formal Methods in Business Process Compliance: A Systematic Literature Review

Separating Compliance Management and Business Process Management

VERBUS: A Formal Model for Business Process Verification

A Method for Checking Consistency Between Domain Requirements and Business Process

Predictive Compliance Monitoring in Process-Aware Information Systems: State of the Art, Functionalities, Research Directions

Designing Compliant Business Processes with Obligations and Permissions

Checking Security Policy Compliance

Enabling model checking for collaborative process analysis: from BPMN to ‘Network of Timed Automata’