Enterprises require mechanisms to ensure that their business processes implement and fulfill internal controls in context of regulatory compliance such as Sarbanes Oxley Act. In this paper we propose an approach for the modeling and implementation of internal controls in business processes. The approach is based on the formal modeling of internal controls, thus it can serve as the basis for usage of logic mechanisms in the compliance verification process. The advent of regulatory compliance requirements such as Sarbanes Oxley Act 2002 (SOX)1 requires the implementation of an effective internal controls system in enterprises. COSO2 defines the internal controls as a process designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations. We focus on the Application Controls (AC) controlling business processes and propose the introduction of an abstraction layer above a business process, in which these controls are formally modeled and evaluated against existing process models and instances. We see several advantages of such an approach: - It enables usage of formal methods for the verification of a business process's compliance. - Consequently the compliance can be performed automatically based on the current state of a process - The changes of the controls will not affect the design and execution of the original business processes - Non-experts can built on top of the domain model provided to design controls for business processes The internal controls compliance of a purchase ordering process (PO) depends on enterprise specific risk assessment carried out by auditing consultants (see Table 1)
Control Objective Prevent unauthorized use of PO Process
Double Approvals of POs higher than $5000 (Double-CheckControl).
The design of a control should control the way a business process is executed. A (re)design of a business process causes an update of risk assessment on a business process, which may lead to a new or updated set of the controls incl. new tests. The business process monitoring and verification techniques may be used to assess the design of controls and serve as an input to the compliance certification (See Figure 1). The main entities for the process of internal controls compliance is described in following and illustrated in Figure 2a: Identify all significant accounts in the company. Identify for those accounts all business processes affecting them. Define for each relevant business process a set of control objectives specific to the enterprise. Assess the risks for the enterprise by their identification for each control objective. Design and implement based on the risk assessment a set of controls in order to prevent or detect the occurrence of the identified risks.
An Application Control (AC) controls different dimensions of the way a business process is enacted, namely the execution of its activities, the Business Documents involved and the agents performing an activity including their authorities (See Figure 2b).
For each AC at least one Recovery Action must have been designed, which reacts on the violation of a control. It does not change the designed business process logic; it rather blocks the transaction and may send a notification to an assigned responsible agent.
2a Figure 2a - The upper domain model of the Internal Controls Compliance Figure 2b - Relationship between an Application Control and a Business Process
An Application Control Strategy defines the way a control monitors the behavior of one or more
activities inside a business process (Figure 3). In order to become active an AC requires to be
triggered according to the state of the process parameters in a scope. We define further two elements
of an AC strategy: scope and pattern based conceptually on the work done by Dwyer et al [
SemanticMirror represents a semantic layer placed on the top of the (usual) syntactical description of a business process (i.e. workflow). In this phase a model of the business process according to Figure 2b will be stored in the SemanticMirror. It will be used later during the phase 2 and 3 to infer whether the process is designed and executed according to a set of declaratively designed ACs in phase 2.
In the following we present a set of formalizations needed for the automatic evaluation of ACs. Control statement CS is a logical statement that describes how to carry out an AC ac in a business process bp:
O(ct) ∧ V(bp, ac(x, cp), GS(bp, scope)) CS(ct, bp, ac(x, cp),GS(bp, scope(M)), action R ) :=
Activity(bp, action R ), where the formula for CS expresses that if a violation V for the given ac occurs (is true) after occurrence O of a ControlTrigger ct on a Guarded Sequence GS, then the corresponding recovery action action R will be instantiated and executed on current instance of bp (the instance that generated the violation). We describe the parameters mentioned above: Guarded Sequence is a sequence of activities, which are along the scope of the AC strategy of an ac in a bp. The values for the violation of a control are calculated by evaluating the statement ac on the SemanticMirror, i.e. if the statement ac can be inferred from the set of facts contained in the SemanticMirror.
An AC ac expresses that a control pattern cp (See Figure 3) must hold if the logical condition on an entity x holds:
ac(x, cp) := condition(x) cp, x ∈ {BusinessDocument, Agent)
We show the formalization of the control pattern (cp) BoundedExistence of n (see Figure 3) for an activity C in the scope of activities defined by GS(bp,scope):
BoundedExistence(n, C, GS (bp,scope) := ( ∧ i=0,..,n n ∃Ci | InstanceOf(Ci , C)) ∧ (i, j=∀0,..,n Ci , C j | Ci!= C j ) ∧ (i=0∀,..,n Ci | Ci ∈ GS (bp,scope))
Example: Applied on the Double-check control in the PO-Process (see scenario) the statement ac looks as follows: ∀PO | BusinssDocument(PO) ∧ Amount(PO,amount) ∧ greater(amout,5000) → BoundedExistence(2, ApprovePO,GSDoubleCheck (P2P, Between(SelectSupplier,SendPO)))
This phase enables the bidirectional interaction between BPM and internal controls management (see Figure 1): The SemanticMirror will be updated by information about the current instance of the business process enacted and if an AC is violated, the recovery action defined in the control statement will be executed. KBAs represent conceptual abstraction of a log channel, which maybe used to update the SemanticMirror.
In this paper we introduced a semantic based approach for conceptual modeling of internal
controls required by regulations such as SOX. The controls are captured declaratively and checked
during execution-time of business processes. On a conceptual level our work is related to [