The aim of process compliance is to ensure that processes are executed according to a prescribed set of rules determined by an organization's policies and legal obligations. Evidence suggests that achieving this goal is complex and elusive. For instance, US banks alone have been fined more than US$243bn for non-compliance since 2008. Although business process compliance is a mature field of research, there has been limited success in translating the research outputs into industry-ready solutions. In this paper, we present our Compliance Center tool, a comprehensive, end-to-end, “no-code" solution that aims to streamline process compliance by simplifying and integrating: the storage and management of risks, obligations, and controls; the validation and real-time checking of controls; and the reporting of detected violations. Our solution was built and integrated within Apromore, a process intelligence platform, and it was validated with a set of Apromore's largest customers.
Source code repository Screencast video Value
The aim of business process compliance (BPC) is to ensure that business processes are executed
in accordance with a prescribed set of rules or norms [
Despite the extent of the academic research and a technology sector targeting regulatory
monitoring, reporting, and compliance problems, a comprehensive solution is yet to be developed [
Our compliance center integrates all the systems in one while simplifying the interaction between the stakeholders and the tool by leveraging a no-code solution. In the following, we describe the main features of our tool and their innovation.
Our compliance center allows users to either i) import an existing risks, obligations, and controls register or ii) create from scratch any risk, obligation, or control.
In the first scenario, it is suficient to prepare and upload a CSV-format register (usually available for download from existing risk management systems) containing at least four columns: ID, type, name, and description of the item (risk, obligation, control). In addition, any number of fields can be processed and loaded automatically. For example, the register in Fig. 1 contains two risks, one obligation, and three controls and each item has three additional fields: category, sub-category, and linked control (determining what control is assigned to a risk or obligation).
Alternatively, the user can create (or edit) one compliance item at a time by filling in all its data, as shown in Fig. 2. Once a risk or obligation is created or imported into the tool, controls can be assigned to it – to document the purpose of the control (i.e., prevent a risk or ensure an 1Source: Apromore’s customer base. obligation is met). Controls can be assigned manually (via the risk/obligation edit window) or automatically (if documented in the imported register – as in Fig. 1, Column G).
As compliance registers are constantly changing, the tool allows the user not only to manually edit items in the register, but also to perform a bulk update by re-importing the register (this will automatically overwrite existing items and/or create new ones).
Once the controls documentation is in place, the next step is to operationalize the controls (i.e., apply controls to processes). There exists a variety of commercial solutions to do so from BPM systems that can assess process execution rules to sophisticated ad-hoc software bots. Our solution is based on the concept of control templates. A control template is an abstract set of compliance patterns that, after being instantiated on a process, must be checked through the process data during (or post) process execution.
This allows the user to instantiate a control on many diferent processes by filling the control templates on a process-by-process basis – maximizing reuse-ability and minimizing time to instantiate controls.
A user can assign to a control a range of templates (derived from traditional compliance
patterns [
When a control is operationalized, it is immediately and automatically checked on the available process data. Subsequently, at every new ingestion of process data, all operational controls assigned to the process are automatically checked.
Any detected violation during control checks is permanently recorded in the database. All the recorded violations are available for analysis via a configurable dashboard which allows the user to report on: total non-compliant and compliant cases; total, median, average, max and min violations per case by control. These statistics can be captured via a range of graphical and numerical dashboard widgets: tiles; charts; and tables – all of them automatically updated at every new data ingestion, providing a real-time compliance monitoring experience to the user. Fig. 4 shows an example of compliance monitoring dashboard.
Screencast. A demo video of the features mentioned in this section is available at the link on Page 1, alongside the risks, obligations, and controls register shown in Fig. 1.
Our Compliance Center went through a range of assessment cycles. During the prototyping phase, we have evaluated the tool through a combination of focus groups and executive interviews. We ran two focus groups comprising senior managers from one of the four major banks in Australia, each with at least ten years’ banking experience in risk management, operations, process excellence or technology. The first group was part of a project team focused on re-imagining and designing new processes. The second group was an operations team working with existing, mature processes. We also conducted three 30-minute interviews with senior banking executives including a Chief Operating Oficer, a Chief Compliance Oficer, and a Divisional Chief Risk Oficer, as well as two interviews with consulting Principals (each with more than ten years’ experience, one in process excellence, the other in technology).
The feedback received validated the underlying challenges and the broad applicability of the solution. Specifically, participants emphasized the importance of supporting non-technical users with a no-code solution, the potentially lower cost of operating the solution (being end-to-end), the benefit of compliance checking the full transaction population and not just a sample, and the opportunity for control standardization.
As a mature process intelligence platform, Apromore has already been commercialized and is licensed by clients in the banking industry around the world. The Compliance Center is an add-on module to the process intelligence platform and, at the time of writing, two Australian banks are already using our tool on their process data.
Having our Compliance Center integrated into a mature process intelligence platform will allow us to rapidly expand our tool and integrate further process compliance functionalities, which will serve a vast range of organizational needs sourced from the customers and the regulatory environment. These include root-cause analysis and prediction of compliance violations; realtime violation notifications; and assessment of compliance at design time by assigning controls to a process model, simulating it, and checking the controls on the simulated data.
Given the role of process compliance in a range of industries and the consequences of violating it, we are confident that our tool has the potential to become an extremely valuable solution for a range of organizations.