A Petri Net Specification of the REA Business Ontology 1 2 2 Hans Weigand , Paul Johannesson , Birger Andersson 1 University of Tilburg, Tilburg, The Netherlands {H.Weigand}@uvt.nl 2 Stockholm University Department of Computer and Systems Sciences, Sweden {pajo,ba}@dsv.su.se Abstract. Current auditing procedures struggle with the incorporation of new data-driven techniques such as Process Mining. Although Process Mining has been applied experimentally on micro-level workflow processes, it is not so easy to apply on the level of the value cycle that is at the core of accounting databases. A more general problem is that the new smart approaches lack a well-developed accounting ontology. The REA business ontology does offer such an ontology but so far, its main focus has been on accounting database design. In this paper, a Petri Net specification of REA is proposed for ontology- based process analysis. This specification makes it possible to express more than the traditional static specification. The paper also describes how REA Petri Nets can be developed using Process Mining and how they can be applied in a Continuous Auditing framework. Keywords: REA business ontology, Continuous Auditing, Process Mining, Coloured Petri Net 1 Introduction The Resource-Event-Agent (REA) ontology was first formulated in [14] as a basis for developing Accounting Information Systems and has been developed further, e.g. in [5, 7]. It has been shown recently that REA structures also provide a basis for auditing [17]. The REA axioms express fundamental integrity constraints that can be used for both the design of control mechanisms (preventive) and for the detection of deviating behavior (detective) that may indicate errors or fraud. In the original REA paper, REA was introduced as an accounting framework for use in a shared data environment and developed on top of Entity Relationship modeling, so with a clear focus on database design. However, events play a key role as atomic data units and so a dynamic interpretation is quite natural. In this paper, we discuss how REA models can be specified as Petri Nets. This is not a completely original idea; in particular, Laurier and Poels [13] show a mapping from REA to Petri Nets and how these Petri Nets can support useful business simulations in the Expect tool. Others have combined REA with dynamic models (e.g. state machines, DEMO transaction models) in order to model the business processes or transactions in which REA events are coordinated from which the REA ontology as such is abstracting. Copyright © by the paper’s authors. Copying permitted only for private and academic purposes. In: S. España, M. Ivanović, M. Savić (eds.): Proceedings of the CAiSE’16 Forum at the 28th International Conference on Advanced Information Systems Engineering, Ljubljana, Slovenia, 13-17.6.2016, published at http://ceur-ws.org CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings 50 Hans Weigand et al. The goal of this paper is to give a dynamic interpretation to REA itself, a Petri Net specification of REA, and investigate applications that come into the picture with this specification. One interesting application is the combination with process mining [1,2]. Process mining can be used to induce a process model from event logs, not only conceptually, but including empirical coefficients on the process flow. So far, process mining has been applied mainly on workflows such as a payment process. In this case, process mining can help auditors to evaluate the effectiveness of built-in controls [8,10]. Process discovery and visualization perform well in the context of open-minded risk analyses and process walkthroughs [3]. From an accounting point of view, these workflows are micro-processes within the top value cycle that is of primary importance to the assurance the auditor should give. The relationship between process mining and accounting information systems has become a subject of research, e.g. in [6], but typically on a local level, like the payment process. One reason for this workflow focus may be that it is not immediately clear how to interpret the value cycle as a process. In workflow models, there is a “case” that starts somewhere and that can be mapped to the token assignment in the Petri Net. In the value cycle, the primary flow is a resource flow. The resource perspective is not totally absent but secondary in the process modeling world [16]. In [18] suggestions are made to expand the scope from local to global and interrelate different data sets of the company. However, these suggestions are not worked out and present the problem as a data quality problem, rather than the problem of identifying and assessing the value cycle. Continuous Monitoring [11] has advocated the use of real-time or near real-time data to support the monitoring and perhaps auditing of business processes. This can include the use of data mining techniques to find continuity equations and, subsequently, apply these equations to signal anomalies in the business data flow on a low aggregation level [12]. Continuous monitoring is becoming more and more relevant the more we enter a real-time economy. However, so far it lacks a process perspective as well as an ontological foundation. Our research objective is to improve the application of state-of-the-art process analysis to the field of auditing by working out a Petri Net specification of the REA business ontology. Within the constraints of this short paper, we focus on the REA value cycle (not the transaction and agent cycle) and show –on a conceptual level - how it can be modeled in Petri Nets. We show also that it is possible to mine REA Petri Nets from accounting databases and that the REA Petri Net can be applied in the auditing process at several points; one application is for detecting anomalies in the value cycle (section 3). 2 REA Petri Nets The Resource-Event-Agent (REA) ontology was first formulated in [14]. The following is a short overview of the core concepts. A resource is any object that is under the control of an agent and regarded as valuable by some agent. This includes goods and services. Resources are converted or exchanged in processes. An agent is an individual or organization capable of having control over economic resources, and transferring or receiving the control to or from other agents. The constituents of A Petri Net Specification of the REA Business Ontology 51 processes are called economic events. An economic event represents a stock flow, either an inflow or an outflow. REA recognizes two kinds of duality axioms between events: conversion duality and exchange duality. They express that in order to acquire a resource the agent has to give up some other resource Fig. 1. Sample model for a REA conversion process Let us start with a REA conversion process. The example in Fig. 1 shows two decrement events (outflow) for two kinds of raw material (resource). It contains one produce event (inflow) that produces the finished product (resource). The duality (white diamond) links N outflow to M inflow events. Each event has a providing and receiving agent. There are two ways in which this process can be mapped to Petri Nets. It depends on whether we emphasize the stock flows or the processes. The most compact mapping that highlights the process is given in Fig. 2a. Once there is a token (black dot) in place1 and place2, the transition can fire and an event is executed. The tokens in place1 and place2 are consumed and a token in place P is produced. The two consumptions in the Petri Net correspond with the outflow events in the REA model, and the token production corresponds with the inflow event. The transition itself corresponds with the duality in REA. The place corresponds to a REA agent, that is, the organizational role controlling the resource instances. This is in line with the definition of REA agent as “some entity transferring or receiving the control of economic resources”; this is what places do with respect to tokens. We say that a token T in a place P corresponds to agent A (P) controlling resource R (T).In the REA ontology, an agent is not a role like Production Manager, but a human subject with some role. In practice, the REA model is modeling the role only. In that case, the allocation of REA agents to subjects in the organization is not included in the model as such. If needed – for instance, for analyzing Segregation of Duties – we can annotate the model with agent allocation in the form of a function P  Subjects. 52 Hans Weigand et al. Fig. 2. (a) Compact Petri Net representation (b) Alternative representation In Fig. 1 there are four agents, whereas there are only three in the compact Petri Net (Fig. 2a). The Production Manager receiving the raw material and providing the product is not included because he is only an intermediary. The role is represented by a place in Fig. 2b – this representation corresponds directly to the event template of [13]. In this case, the transitions correspond to stock flows, whereas in Fig. 2a, the transition corresponds to the conversion process. Formally, the two are equivalent in the sense that one can be mapped to the other (with appropriate transition rules to achieve the same process synchronization). In the following, we will use the compact process-oriented version of Fig. 2a. In our interpretation, the intermediary role gets a place at the transaction level. Now let us look at the exchange duality in REA like sales of goods. There is an outflow of goods and an inflow of money, and these two events stand in duality. A compact Petri Net interpretation is given in Fig. 3(a). Fig. 3. (a) Exchange pattern (b) Value cycle Revenue (money) is produced in a transition in which goods are consumed, or vice versa. One cannot be done without the other. The exchange may have more input and output places, for instance, there can be a delivery service input, or a bad debt “waste” output. This exchange duality pattern does not take into account a time delay between the inflow and outflow and the uncertainty that is introduced by the involvement of an external agent (the customer). For that reason, some versions of REA include claims. We do not include claims at the value cycle level and represent them in the transaction cycle because they have to do with the coordination of economic events. Conversion dualities and exchange dualities combine into (top-level) value cycles (Fig. 2b). Typically value is created in this cycle (value jump) as sales price is higher than cost price – this is the profitability constraint on any sustainable organization. As profitability is not a REA axiom, we do not work it out in this paper. The REA conversion duality states that production and consumption are in balance – again, you cannot have one without the other. On a conceptual level this means that A Petri Net Specification of the REA Business Ontology 53 each transition in the Petri Net must have input and output places (at least one of each). As such, this is a rather weak constraint. It would make almost any Petri Net a REA model. For a stronger representation of the economic principle behind the duality axioms, we require that the duality takes the form of a conservation law, for instance, mass in (kg) = mass out (kg) or value in ($) = value out ($). To represent the conservation laws, we need a Coloured Petri Net (CPN) and valuation functions (formally, a measure function) V as token properties (the CPN is not worked out in this paper). Each token must have at least one valuation function. For physical resources there must be more, one economic in monetary terms and one or more physical (like weight, volume, items, time). The conservation laws can be expressed in any valuation, and different dualities can have different valuations (and will have, in the typical economic organization). For the physical conversion processes, the valuation is usually weight in kg. For exchange processes, the valuation is economic in some money currency. For services, the valuation can be time, or for instance distance (transport services). We distinguish conservation laws from duality equations, e.g. 1.P  A.RM1 + B.RM2, that says, that for the production of one P element you need A RM1 and B RM2 elements, where A and B are coefficients. The former are a priori axioms, the latter express empirically determined ratios that are used in auditing for analytical procedures. The duality equation can be represented in CPN as a guard expression. Fig. 4 depicts a simple value cycle with coefficients. 20 3.5 2 1 1 5 Fig. 4. Value cycle with transition coefficients The numbers in the schema indicate the transition coefficients (represented by arc inscriptions in a CPN) in the SOLL (de jure) model. For 20 money units 2 material units are purchased. From each material unit, 5 products can be produced, and each product unit is sold for 3.5 money units. 20 money units in the start state lead to 10 products and 35 money units produced. No resources are left in the other places in this scenario and the value jump is 15 (money units). In this simple example, the only costs are the purchasing costs of the material. Other costs like human resource hours can be added. They are first purchased and then consumed in the manufacturing. Next to transition coefficients, we add place coefficients for the empirical distribution of the outflows and of the inflows. In Fig. 4, all places have only one outflow that gets 100% and one inflow, also 100%. If there are two products and the 54 Hans Weigand et al. raw goods are used for two manufacturing processes, then the outflow distribution for the raw material could by 70% and 30%. The transition coefficients have a normative meaning, expressing an optimal resource use (optimal for the company in question). Material deviations need an explanation. The place coefficients do not have the same normative weight, but as experience data they can be used for prediction and simulation. Transition coefficients are included in our REA Petri Net definition, the place coefficients are not. 3 Data-driven auditing In this section, we sketch a process in which dynamic Petri Nets can be applied in Continuous Monitoring or Auditing. The process is summarized in Fig. 5. The Accounting Information System is assumed to contain all the information needed for the value cycle as well as the transaction and agent cycle (cf. [16]). Fig. 5. Data-driven auditing process Data capturing. Murthy & Groomer [15] coined the term CAWS (Continuous Auditing Web Services) to describe how continuous auditing would operate in an XML-enhanced business processing environment in a non-intrusive way. The intrusiveness can be reduced even more when we assume that the client adopts an Enterprise Service Bus (ESB) architecture on which services publish all public events. The ESB should not only support the communication, but also the safe logging of all published events [4]. The ESB is not a product but an architecture that defines end-to- end connectivity between distributed services, typically broadcasting and event-driven (publish/subscribe). Data Transformation. In current Information Systems, accounting data are usually not represented in REA format. Extracting event logs from ERP systems is not trivial [9]. Werner et al [18] have shown how processes can be mined from ERP financial databases. Financial transactions in ERP systems create journal entries when they are executed. Journal entries consist of an accounting document and at least two entry items that are posted as credits and debits. When open-item-accounting is enabled each cleared item has a reference to the accounting document that cleared it. So it is A Petri Net Specification of the REA Business Ontology 55 possible to start with an arbitrary journal entry and to reconstruct the links between journal entries that cleared each other. Although temporal information is available, the process mining is based only on the logical structure. The Petri Net that is created in this way identifies the transactions (identified by document number) with transitions, and places with accounts. The arcs between the transitions and places correspond to journal entries. REA process mining. The structure of the REA Petri Net can be derived by the same process mining technique described in [18] applied to historical data in the Accounting Information System of the company itself or benchmarks. One problem is that the ERP journal entries may only contain monetary value and no physical metrics. In many cases, these data are available in other parts of the ERP (Production Planning, Material Management) and can be combined, with some effort. The next step is to mine the coefficients that are needed for the duality equations, for instance, by means of Linear Regression. If the variation in the process is very big, we should try to refine the transitions to more specific and homogeneous one. The next step is to derive audit assertions from these equations. Not all correlations are equally strong and some resources are easier to measure than others. The audit assertions are typically a subset of all the correlations in the duality equation. Continuous monitoring. Kogan et al [12] describe how continuity equations on audit data can be used to detect errors or anomalies in a Continuous Monitoring framework. Real-time data are aggregated on a low level. The time interval should not be too small, because it may be that the necessary data is not available yet. On the other hand, when the aggregation level is very high, e.g. per quarter, the analysis is less effective, as is well-known from traditional auditing. In some cases, the aggregation level may be the individual transaction, e.g. a single production job, if a transaction instance identifier is available. In an interactive system, aggregation levels are variable (drill-down). The continuity equation is used for prediction and when the actual value in the monitored data set deviates significantly, an anomaly is raised. The same monitoring framework of [12] can be used with the audit assertions as input. The difference with the continuity equations is that the audit assertions are based on the normative model and the REA ontology, whereas continuity equations can be made for any kind of data, e.g. the payment collection time, or rule compliance. 4 Conclusion In [1], a framework in presented for using process mining in auditing. It presents a challenging vision. On the weak side, it can be said that the process mining is not based on an accounting ontology. The emphasis is on monitoring internal controls. The paper also mentions the use of prediction, e.g. expected delivery time, but this is more interesting from an operational than an auditing perspective. Still, the tools and techniques mentioned in [1,2] (and described extensively in other papers) are very powerful. That is why a Petri Net specification of REA allows all kinds of new opportunities, some of which have been indicated in the above. 56 Hans Weigand et al. Acknowledgements: We thank the participants of the VMBO workshop for constructive comments on an early version of this paper. 5 References 1. Aalst, W. van der, Hee, K. van, Werf, J. van der, Verdonk, M.: Auditing 2.0: Using process mining to support tomorrow's auditor. Computer; 43(3): 90-93 (2010) 2. Aalst, W., van der, Hee, K., van der Werf, J.M., Kumar, A., Verdonk, M.: Conceptual model for on line auditing. Decision Support Systems 50, 636–647 (2011) 3. Caron, F., Vanthienen, J.; Applications of Business Process Analytics and Mining for Internal Control, ISACA Journal, USA, vol. 4, (2012) 4. Chuvakin, A., Peterson, G.: Logging in the Age of Web Services. IEEE Security: 82-85 (2009) 5. Geerts, G.L., McCarthy, W.E.: An ontological analysis of the economic primitives of the extended-REA enterprise information architecture. Int. Journal of Accounting Information Systems 3: 1-16 (2002) 6. Gehrke, N. Mueller-Wickop, N.: Basic principles of financial process mining: a journey through financial data in accounting information systems. Proc. AMCIS, Lima, Peru (2010) 7. Hruby P.: Model-driven design of software applications with business patterns. Springer (2006). 8. Hulstijn, J. et al: Continuous Control Monitoring-based Regulation: a case in the meat processing industry. In: Proc. of the CAISE Workshop GRCIS'2011, London (2011) 9. Ingvaldsen, J., Gulla, J.: Preprocessing support for large scale process mining of SAP transactions. In: Proc. Int. Conf on Business Process Management. Springer, pp.30–41 (2007) 10. Jans, M.: The case for process mining in auditing: Sources of value added and areas of application. Int. Journal of Accounting Information Systems 14(1):1-20 (2013) 11. Jans, M., Alles, M.G., Vasarhelyi, M.A: A field study on the use of process mining of event logs as an analytical procedure in auditing. The Accounting Review 89.5 (2014): 1751-1773. 12. Kogan, A. Alles, M., Vasarhelyi, M. Wu. J.:Analytical procedures for continuous data level auditing: continuity equations. Unpublished working paper, Rutgers Business School (2010) 13. Laurier, W., Poels, G.: Invariant conditions in value system simulation models. Decision Support Systems, 56, 275-287 (2013) 14. McCarthy W.E.: The REA Accounting Model: A Generalized Framework for Accounting Systems in a Shared Data Environment. The Accounting Review: 544-577 (1982) 15. Murthy, U, Groomer S.: A continuous auditing web services model for XML-based accounting systems, Int. J. of Accounting Information Systems, Vol. 5(2):139-163 (2003) 16. Sonnenberg, C., vom Brocke, J.: The missing link between BPM and accounting: Using event data for accounting in process-oriented organizations. Business Process Management Journal, 20(2), 213-246 (2014) 17. Weigand, H., Elsas, Ph.: Model-based Auditing Using REA. Int. Journal of Accounting Information Systems (2012) 18. Werner, M., Gehrke, N., and Nüttgens, M.: Business Process Mining and Reconstruction for Financial Audits, In Proc. of the 45th Hawaii Int. Conf. on System Sciences. pp. 5350–5359 (2012)