Compliance means to adhere to laws, regulations and guidelines. It has become an integral part of business process management since the financial crisis revealed the dimension of legal offences and violated business rules. Even though Business Process Compliance (BPC) has reached a mature state, studies imply that practice still struggles with the documentation and automated control of compliance requirements. Moreover, due to the plethora of approaches, it is hard to gain an overview on existing works. This paper thus gives a short overview on BPC approaches. The work summarized in this extended abstract has been published in [FZ14].
As enterprises increasingly rely on business process models and execution environments to manage and automate their business processes, approaches to ensure compliance in business process modelling and execution are of utmost importance [Aw08, RW12]. Research can contribute to these efforts by addressing the needs of enterprises to automate compliance checks and enhance visibility of operational risks [Mi15]. However, due to the plethora of approaches, it is hard to compare and select from among them. In [FZ14], we therefore provide an overview guided by the following research questions: RQ1: What is the scope of compliance approaches? RQ2: Which phases of the process lifecycle are targeted by compliance approaches? RQ3: What kind of research dominates compliance research? RQ4: What is the contribution of compliance research works? RQ5: What are trends regarding compliance research? The review is based on the suggestions from Webster and Watson [WW02] and vom Brocke et al. [Vb09] who describe best practices of a systematic literature review. It included five scientific databases. The literature search revealed 430 hits from which 84 were considered relevant for the classification (cf. [FZ14] for a detailed description). The remainder of the paper is structured as follows. Section 2 introduces our classification of compliance approaches that is also used to answer RQ1–4 in the original paper. In Section 3, we apply the classification to important research works. In Section 4, research trends are sketched (RQ5) and Section 5 provides a conclusion.
In the original paper [FZ14], a faceted classification is developed and subsequently applied to characterize research works. The classification contains the four dimensions (facets) Scope, Lifecycle phase, Formality and Contribution type of compliance approaches along with their attributes (cf. Figure 1). For example, the attribute Order and occurrence of the Scope dimension refers to the fact that every process is determined by events which trigger subsequent process steps. The execution of processes in turn requires detailed Information, which has to be either extracted from regulations or can be defined by the company as indicated by the attributes Resource, Time or Location. In our original paper, we selected the top 20 articles (a complete list can be found here: http://tinyurl.com/compliance-list) according to the citation rate measured with Google Scholar (as of 2013, when the original article was written). We then provided a visual map (cf. Figure 2) where approaches are classified according to three dimensions of our classification: Formality, Scope and Contribution type. Regarding formality (y-axis), we slightly extended this dimension to comprise additional levels of formality in order to provide for a more suitable graphical representation. The extended levels are: Highly formal (e.g. using mathematical analyses), Formalized approaches with end-user orientation (e.g. presenting an algorithm with a user interface), Management-oriented partly formal approaches (e.g. descriptions of tools or procedures) and ManagementState-of-the-Art of Compliance Approaches 17 oriented frameworks or methods (e.g. architectures or strategies). Regarding the Scope (x-axis), we used the attributes of our classification. Regarding Contribution type, we extended the criteria Other and replaced it by the two more specific attributes No specific contribution type and Technical artefact and method. With these extensions, we can provide the map that is shown in Figure 2 (references to the articles in the map are contained in the original publication [FZ14]). Regarding the subject of research, it can be noticed that compliance research has been driven by the increasing requirements of businesses to comply with given laws, regulations, best practices and contracts that have been existent since the beginning of the century. Research on the topic reached its climax (regarding the publication rates) in 2009. Many of the research works propose formal methods or frameworks to approach compliance. Future research may thus be concerned with the applicability of the developed approaches in terms of intuitive tool support, cognitive efficient user interfaces and ergonomic and usable languages for compliance rule specification or generation from natural language text as well as with organizational aspects and “the human in the loop”. 5
With our review that we summarized here and that is presented in detail in [FZ14], we want to serve the research community by showing the landscape of research in terms of what the literature is focused on (scope), which phase of the process lifecycle are addressed (design, execution, after execution), from which perspective (business-oriented or more formal, computer-science-related work) as well as which contribution type (technical artefact, method or other) is provided. We hope that our contribution is useful and may both serve as a starting point for new researchers and as an overview of the work for more experienced researchers in the business process compliance field. [Aw08] [FZ14] [Mi15] [RW12] [Vb09] [WW02] Miles, D.: Managing Governance, Risk and Compliance with ECM and BPM. White Paper. AIIM and OpenText, 2015.