Business Process and Regulations Compliance Management Technology

Abstract

Organisations are more and more under pressure to comply with an increasing number of external and internal regulations for business governance and must ensure that their processes are running accordingly to requirements of regulations. Therefore business process and regulations compliance analysis, audit and management tasks take very important role in daily operational activities of each organisation. Due to high complexity and weak support of IT tools this task can become challenging. During my Phd studies I want to develop business process and regulations compliance management technology. To reach this goal current activity in progress is to develop software prototype to link business processes to regulations.

Keywords

• business process
• compliance
• regulations

Research question

Usually business processes in organisation are affected by requirements of regulations. Many organisations use business process management to model, simulate, execute, change, monitor and optimize business processes. Business process management can also serve as a proof that organisation is running accordingly to regulations. To ensure such proof organisation must form and manage linkage between regulations and business processes.

In many cases organisations have their business processes specified independently or not specifically linked with regulations, even if business processes are directly impacted by regulations. Reasons for such situation can be lack of widely known and applicable methodologies and weak business process management suite support to link business processes to regulations. Currently no business process management suite supports business process linkage specifically to regulations and relevant change management of regulations and impacted business processes.

Goal of doctoral work is to develop business process and regulations compliance management technology. As a result developed technology should address and have solutions for the following main topics: (1) management of regulations (approach and solution for retrieval, storing, updating, and versioning of regulations), (2) extraction of requirements from regulations (approach and solution for capturing requirements from regulations which are affecting business processes), (3) linkage of business processes and regulations (prototype of technical solution to ensure linkage), (4) business process and regulations mutual change management and ontime compliance monitoring (methodology and prototype of technical solution).

To reach these goals current activity in progress is to develop solution prototype to link business process activities to the structural parts of regulation. Solution will use in most of the business process management suits existing business process and document linkage functionality.

Users of business process and regulation linkage and management solution would be: (1) leadership and compliance auditors will gain real time transparency and proof that business processes are running accordingly to regulations, (2) process executors will gain visible processes thus facilitating process execution, re-engineering and optimisation, (3) lawyers will gain illustration of regulations as a running business processes which will allow to identify gaps in regulations and optimize requirements made in regulations as well as any changes in regulations will allow to see impacted business processes, (4) software engineers will gain documented processes with specified regulatory requirements according to which processes are executed, thus facilitating and speeding-up development of new systems or maintenance of existing systems to make sure that systems are fulfilling requirements of regulations. 2

Significant problems in the field of research

From organisations’ point of view challenge is traditional approach of treating regulations separately from business processes. Usually organisations ensure business processes compliance with regulations through audits. Due to the need to provide regular updates on compliance, a more strategic approach to compliance management is needed. This implies a shift from regular reviews to continual assurance and introduces a need for advanced compliance management systems that reflect and ensure real time compliance management [ 2, 10 ].

Currently there are not many specific researches available with focus on business process and regulations compliance management in order to provide solutions for existing challenges: lack of methodologies and IT tool support. However in publications of the latest years, topics on business processes and regulations provide insight in wider researches in these domains. Lack of specific researches leads to lack of tested and applicable guidelines and specific IT tool solutions to support linkage of business processes to regulations. 3

Current knowledge of the

existing solutions problem domain and state of

There are number of researches available which propose approaches for analysing regulations [ 1, 6, 9, 10, 15 ], capturing requirements from regulation [ 13, 14, 19, 20, 21 ], facilitating understanding of regulations by graphical representation [ 12 ] and managing compliance with requirements and business processes [ 2, 3, 4, 5, 7, 16, 17 ]. Also researches made in document engineering domain [ 1, 8, 11, 18 ] are applicable since regulations basically are documents with specific content – regulatory requirements.

Regarding requirement engineering authors [ 19 ] present their survey of researches in handling regulations for information system development. Summarised approaches [ 19 ] can be used in practical case studies to identify which methods can be expanded and be applicable to extract requirements from regulations for business process management.

Authors [ 13 ] have proposed method for extracting rights and obligations from regulations and further [ 14 ] have examined tool support for this by applying Cerno framework for textual semantic annotation and proposed tool for semi-automatic semantic annotation of concepts. In theses researches authors have focused on limited scope on alignment of information system requirements with regulations. Output of these researches can be analysed and expanded with focus to align requirements with business processes since approach has already proved itself in a practice and is supported by the tool.

Authors [ 20 ] have pointed out ontological differences between legal concepts and requirements, and have set decision making process about requirements from regulations for law compliant information systems. Like previous research also here authors are focusing on requirements for information system, thus showing that some statements are limited and not applicable in case where requirement engineering is used to model business processes. Newertheless this approach can be used as a basis to distinguish between legal concepts and requirements.

Authors [ 15 ] introduce a method to prioritize legal requirements to determinate order in which requirements should be implemented in information systems. Research is not applicable in a direct way as in business processes all requirements from regulations should be implemented and presented at the moment when regulations come in force, however research is applicable and gives base to prioritize requirements to denote requirements which have the highest impact level; and such prioritization can be used for handling contradictory requirements.

Authors [ 2 ] specifically present a method for validating business processes with respect to business rules which are captured from regulations. Method does not address challenges of extracting requirements from regulations, however it is practical and applicable approach to trace and visualize basic compliance.

Authors [ 4 ] introduce approach to help achieve business process flexibility with business rules and workflow patterns. Research do not cover compliance issues directly, however it is applicable as it provides approach based on assumption that changes in a business process can be confined to the variable isolated parts of the processes. This assumption is important since ordinary or regular changes of some regulations most likely will impact some parts of the process not a whole process itself.

Author [ 7 ] validates business processes with business contracts by providing logic based formalism for describing both the semantics of contract and the semantics of compliance checking procedures. Results described in the paper are promising, therefore this approach is valid in scope of author’s research and will be applied in further case studies by testing it to regulations as both, regulations and contracts, contain requirements for business processes. 4

Preliminary ideas

Following domains are selected for further investigations in order to address business process and regulations compliance management: (1) management of regulations (main topics: extraction of regulatory requirements; development of regulatory document generation and update algorithm, solutions for versioning of regulations (and requirements of regulations)), (2) management of business processes (main topics: solutions to link business processes with regulations and representation capabilities), (3) management of compliance (main topics: existing solutions for compliance governance in business process management suites).

Research is not limited to listed research domains and can be expanded to other domains.

Proposed approach

Since requirements under which organisation must operate are expressed in regulations and business processes represent procedure how these requirements should be executed [ 5, 7 ], it is rational need to find a way to link these two concepts. Characteristics of regulations make them challenging to use and directly apply in business processes, therefore captured requirements (perhaps, in a form of business rules) can be a link to link regulatory document with business process model [ 5, 7 ].

To run approach to represent requirements of regulations in the business process model the following scenario (general steps) should be performed: (1) determinate applicable regulations, (2) classify and structure regulation, (3) ensure traceability regulations,

within regulation itself and other applicable (4) extract (capture) requirements from applicable regulations, (5) ensure traceability between requirement and regulation and its sections, (6) handle inconsistencies between requirement, (7) model business process incorporating requirements, (8) ensure traceability between business process and its steps with requirements, to ensure that all applicable requirements are present, (9) link business process model and steps with regulatory document, (10) provide real time compliance monitoring.

IT tool support is highly needed to execute above mentioned scenario.

Sketch of the research methodology 6 7

Primary research methodologies are collation, summary and synthesis of existing researches and information, and constructive research to develop solutions for identified problems through creating and validating new approaches and prototyping of technology.

Contributions of the author to the solution of the problem

Currently ongoing work is to develop approach and technology prototype to link business processes and regulatory documents using existing capabilities of business process management suits. Developed approach will be tested also in SAP Composition Environment. This work has been supported by Accenture Latvia and Riga Technical University in the context of research project No ZP-2010/7 “Development of linkage technology prototype for business process and normative documents bond”.

References

1. Amato F. , Mazzeo A. , Penta A. , Picariello A . Building RDF Ontologies from semistructured legal documents . International Conference on Complex, Intelligent and Software Intensive System . p. 997 - 1002 ( 2008 )

2. Araujo B.M. , Schmitz E.A , Correa A.L. , Alencar A.J. A method for Validating the Compliance of Business Processes to Business Rules . Proceedings of the ACM Symposium on Applied Computing SAC'10 ( 2010 )

3. Breaux T.D. , Powers C . Early Studies in Acquiring Evidentiary, Reusable Business Process Models for Legal Compliance . 6th International Conference on Information Technology: New Generations . p. 272 - 277 ( 2009 )

4. Eijndhoven T. , Iacob M.E. , Ponisio M.L. Achieving business process flexibility with business rules . Proceedings of the 12th International IEEE Enterprise Distributed Object Computing Conference EDOC'08 ( 2008 )

5. Fiorini S.T. , Sampaio J.C. Integrating Business Processes with Requirements Elicitation . Proceedings of the 5th International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises WET ICE'96 . p. 226 ( 1996 )

6. Ghanavati S. , Amyot D. , Peyton L. Compliance Analysis Based on a Goal-oriented Requirement Language Evaluation Methodology . Proceedings of the 17th International IEEE Requirements Engineering Conference RE'09 . p. 133 - 142 ( 2009 )

7. Governatori G. , Milosevic Z. , Sadiq S. Compliance checking between business processes and business contracts . Proceedings of the 10th International IEEE Enterprise Distributed Object Computing Conference EDOC'06 . p. 221 - 232 ( 2006 )

8. Guo J . Achieving Transparent Integration of Information, Documents and Processes. Proceedings of the International IEEE Conference on e-Business Engineering ICEBE'06 . p. 558 - 562 ( 2006 )

9. Hamdaqa M. , Hamou-Lhadj A . Citation Analysis: An Approach for Facilitating the Understanding and the Analysis of Regulatory Compliance Documents . Proceedings of the 6th International Conference on Information Technology: New Generations . p. 278 - 283 ( 2009 )

10. Hassan W. , Logrippo L. Requirements and compliance in legal systems: a logic approach . Proceedings of the International IEEE Requirements Engineering and Law Conference RELAW'08 . p 40 - 44 ( 2008 )

11. Janiesch C. , Dreiling A. , Greiner U. , Lippe S. Integrated Configuration of Enterprise Systems for Interoperability - Towards Process Model and Business Document Specification Alignment . Proceedings of the International 10th IEEE Enterprise Distributed Object Computing Conference EDOC'06 . p. 445 - 448 ( 2006 )

12. Kirikova M. Facilitating Comprehension of Normative Documents by Graphical Representations . Practical Aspects of Knowledge Management , Springer Verlag, Berlin Heidelberg. p. 369 - 376 ( 2002 )

13. Kiyavitskaya N , Zeni N. , Breaux T.D , Anton A.I. Extracting Rights and Obligations from Regulations: Toward a Tool-Supported Process . Proceedings of the 22nd International IEEE/ACM conference on Automated software engineering ASE'07 . p. 429 - 432 ( 2007 )

14. Kiyavitskaya N. , Zeni N. , Breaux T.D. , Anton A.I. , Cordy J.R. , Mich L. , Mylopouslos J . Towards regulatory compliance: Extracting rights and obligations to align requirements with regulations . Proceedings of the 14t h International IEEE Requirements Engineering Conference RE'06 . p. 49 - 58 ( 2006 )

15. Massey A.K. , Otto P.N , Anton A.I. Prioritizing Legal Requirements . Proceedings of the 2nd International Workshop on Requirements Engineering and Law . p. 27 - 32 ( 2009 )

16. Milosevic Z. , Orlowska M. , Sadiq S. Linking contracts, processes and services: an eventdriven approach . Proceedings of the IEEE International Conference on Services Computing SCC'06 . p. 390 - 397 ( 2006 )

17. Muehlen M. , Indulska M. , Kamp G . Business Process and Business Rule Modeling Languages for Compliance Management: A Representational Analysis . Tutorials, posters, panels and industrial contributions at the 26th international conference on Conceptual modeling ER'07 ( 2007 )

18. Noronha M.A. , Goldstein Golendziner L., Santos C.S. Extending a Structured Document Model with Version Control . Proceedings of the International Database Engineering and Applications Symposium IDEAS'98 . p. 234 - 242 ( 1998 )

19. Otto P.N. , Anton A.I. Addressing Legal Requirements in Requirements Engineering . Proceedings of the 15th International IEEE Requirements Engineering Conference RE'07 . p. 5 - 14 ( 2007 )

20. Siena A. , Mylopoulos J. , Perini A. , Susi A . From Laws to Requirements. Proceedings of the International IEEE Requirements Engineering and Law Conference RELAW'08 . p. 6 - 10 ( 2008 )

21. Siena A. , Perini A. , Susi A. , Mylopoulos J. A Meta-Model for Modelling Law-Compliant Requirements . Proceedings of the 2nd International Workshop on Requirements Engineering and Law RELAW'09 . p. 45 - 51 ( 2009 )

22. Steinke G. , Colleen N. Business rules as the basis of an organisation's information systems . Industrial Management & Data Systems , Vol. 103 Iss: 1, p. 52 - 63 ( 2003 )