Situational method engineering for governance, risk and compliance information systems

Proceedings of the 4th International Conference on Design Science Research in Information Systems and Technology, DESRIST '09

Volumn , Issue , 2009, Pages

  Gericke, Anke ^a   Fill, Hans Georg ^b   Karagiannis, Dimitris ^b   Winter, Robert ^a  

^a UNIVERSITY OF ST GALLEN   (Switzerland)

^b UNIVERSITY OF VIENNA   (Austria)

Author keywords

Governance; Method engineering; Organizational design; Risk and compliance

Indexed keywords

FINANCIAL CRISIS; GOVERNANCE; METHOD ENGINEERING; ORGANIZATIONAL DESIGN; PROJECT MANAGERS; SITUATIONAL METHOD ENGINEERING; SOLUTION COMPONENTS;

CONCEPTUAL DESIGN; GOVERNMENT DATA PROCESSING; INFORMATION SYSTEMS; PROJECT MANAGEMENT; RESEARCH; RISK ANALYSIS; RISK MANAGEMENT;

DECISION MAKING;

EID: 70350680750     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1555619.1555651     Document Type: Conference Paper

References (63)

1. 80-20 Software (Ed.) 2004. Governance, Risk Management and Compliance: The Value of Integrated GRC in Highly Regulated Industries. http://www.80-20. com/products/leaders-online-delete/80-20-HRI-GRC.pdf, Last Accessed 2009-01-21.
2. Ad Hoc News (ed.) 2008. Credit Crisis Produces Increased Demand for Sound Governance, Risk and Compliance Solutions. http://www.ad-hoc-news.de/Credit- Crisis-Produces-Increased-Demand-for-Sound--/de/Unternehmensnachrichten/ 19789384, Last Accessed 2008-12-20.
3. Ågerfalk, P. J. et al. 2007. Modularization Constructs in Method Engineering: Towards Common Ground? In: Ralyté, J., Brinkkemper, S., and Henderson-Sellers, B. (Eds.): Situational Method Engineering Fundamentals and Experiences. Springer, Boston, 359-368.
4. Arnold, G. and Davies, M. (Eds.) 2000. Value-based Management: Context and Application. Wiley, Chichester et al.
5. Bamberg, A. and Kaven, A. 2006. Deutsche Telekom: Von einem konzernweiten S-OX404-Projekt zur Compliance Organisation (transl. Deutsche Telekom: From a Corporation-Wide S-OX404 Project to a Compliant Organization). In: Menzies, C. (Ed.) Sarbanes-Oxley und Corporate Compliance: Nachhaltigkeit, Optimierung, Integration (transl. Sarbanes-Oxley and Corporate Compliance: Sustainability, Improvement, Integration). Schäffer-Poeschel, Stuttgart, 432-441.
6. Bowman, E. H. and Kogut, B. 1995. Introduction: Redesigning the Firm. In: Bowman, E. H. and Kogut, B. (Eds.): Redesigning the Firm. Oxford University Press, Oxford et al., 3-17.
7. Brinkkemper, S. 1996. Method engineering: engineering of information systems development methods and tools. Information and Software Technology. 38, 4 (1996), 275-280.
8. Brühwiler, B. 2003. Risk-Management als Führungsaufgabe (transl. Risk Management as Executive Functions). Haupt, Bern et al.
9. Bucher, T. et al. 2007. Situational Method Engineering - On the Differentiation of "Context" and "Project Type". In: Ralyté, J., Brinkkemper, S., and Henderson-Sellers, B. (Eds.): IFIP WG8.1 Working Conference on Situational Method Engineering (ME07), Geneva, 33-48.
10. Bucher, T. and Winter, R. 2008. Dissemination and Importance of the "Method" Artifact in the Context of Design Research for Information Systems. In: Vaishnavi, V. K. and Baskerville, R. (Eds.): Proceedings of the Third International Conference on Design Science Research in Information Systems and Technology (DESRIST 2008), Atlanta, 39-59.
11. Cao, J. et al. 2006. Interactions Between System Evaluation and Theory Testing: A Demonstration of the Power of a Multifaceted Approach to Information Systems Research. Journal of Management Information Systems. 22, 4 (2006), 207-235.
12. Deloitte 2005. Der Weg zum wirkungsvollen Zusammenspiel: Performance Management Studie 2005 (transl. To Be on the Right Way to an Effective Interplay: Performance Management Survey 2005). http://www.lznet. de/studien/pdf/85.pdf, Last Accessed 2008-11-27.
13. Drew, C. 2006. Implementing an integrated system for risk management, planning, performance. Accountancy Ireland. 38, 4 (2006), 18-20.
14. Eckert, S., Lamparter, G., and Möller, K. 2004. Konzept und Umsetzung eines Risikomanagementsystems bei der DÜRR AG (transl. Conception and Implementation of a Risk Management System at DÜRR AG). Zeitschrift für Controlling und Management. 48, Special Issue 3 (2004), 26-36.
15. Faisst, U. and Buhl, H. U. 2005. Integrated Enterprise Balancing mit integrierten Ertrags-und Risikodatenbanken (transl. Integrated Enterprise Balancing Using Integrated Return and Risk Databases). Wirtschaftsinformatik. 47, 6 (2005), 403-412.
16. Fiedler, F. E. 1964. A Contingency Model of Leadership Effectiveness. Advances in Experimental Social Psychology. 1 (1964), 149-190.
17. Fill, H.-G. et al. 2007. Modellierung für Integrated Enterprise Balancing (transl. Modeling for Integrated Enterprise Balancing). Wirtschaftsinformatik. 49, 6 (2007), 419-429.
18. Gericke, A. et al. 2009. Method Engineering for Integrated Enterprise Balancing. In: Second International Workshop on Governance, Risk and Compliance - Applications in Information Systems (GRCIS'09), In conjunction with CAiSE'09, Amsterdam, The Netherlands, 8-12th June, 2009 (forthcoming), Amsterdam.
19. Gill, S. and Purushottam, U. 2008. Integrated GRC - Is your Organization Ready to Move? SETLabs Briefings. 6, 3 (2008), http://www.infosys.com/research/ publications/SETLabsbriefings-governance-compliance.pdf, 37-46.
20. Gonzales-Perez, C. 2007. Supporting Situational Method Engineering with ISO/IEC 24744 and the Work Product Pool Approach. In: Ralyté, J., Brinkkemper, S., and Henderson-Sellers, B. (Eds.): Situational Method Engineering - Fundamentals and Experiences. Springer, Boston, 7-18.
21. Gutzwiller, T. A. 1994. Das CC-RIM Referenzmodell für den Entwurf von betrieblichen, transaktionsorientierten Informationssystemen (transl. Development of Operational, Transaction-Oriented Information Systems Using the CCRIM Reference Model). Physica, Heidelberg.
22. Harmsen, F. 1997. Situational Method Engineering. Doctoral Thesis. Utrecht.
23. Haux, R. et al. 1998. Management von Informationssystemen (transl. Management of Information Systems). Teubner, Stuttgart.
24. Hevner, A. R. et al. 2004. Design Science in Information Systems Research. MIS Quarterly. 28, 1 (2004), 75-105.
25. Innerhofer-Oberperfler, F. and Breu, R. 2006. Using an Enterprise Architecture for IT Risk Management. In: Venter, H. S. et al. (Eds.): Proceedings of the ISSA 2006 from Insight to Foresight Conference, Sandton, http://icsa.cs.up.ac.za/issa/2006/Proceedings/Full/115-Paper.pdf.
26. Jallow, A. K. et al. 2007. Operational risk analysis in business processes. BT Technology Journal. 25, 1 (2007), 168-177.
27. Karagiannis, D., Mylopoulos, J., and Schwab, M. 2007. Business Process-Based Regulation Compliance: The Case of the Sarbanes-Oxley Act. In: 15th IEEE International Requirements Engineering Conference (RE '07), Delhi, 315-321.
28. Karlsson, F. and Ågerfalk, P. J. 2004. Method configuration: adapting to situational characteristics while creating reusable assets. Information and Software Technology. 46 (2004), 619-633.
29. Karlsson, F. and Wistrand, K. 2006. Combining method engineering with activity theory: theoretical grounding of the method component concept. European Journal of Information Systems. 15, 1 (2006), 82-90.
30. Knight, J. A. 1997. Value-based management: developing a systematic approach to creating shareholder value. McGraw-Hill, New York.
31. Krantz, M. 2008. Survival in the Age of Risk. http://www.cfo.com/article. cfm/11917608/1/c-2984351?f=related, Last Accessed 2008-12-20.
32. Kückelhaus, M. and Wohlthat, A. 2004. Praxisstatement (transl. Practical Experiences). In: Weber, J. et al. (Eds.): Wertorientierte Unternehmenssteuerung: Konzepte - Implementierung - Praxisstatements (transl. Value-Based Management: Concepts - Implementation - Practical Experiences). Gabler, Wiesbaden, 350-358.
33. Lam, J. 2003. Enterprise Risk Management: From Incentives to Controls. Wiley, Hoboken.
34. Lang-Koetz, C. 2006. Ein Vorgehensmodell zur Einführung eines integrativen Umweltcontrollings auf Basis eines ERPSystems (transl. A Procedure Model for the Implementation of an Integrated, ERP-Based Environment Controlling). Doctoral Thesis. University of Stuttgart, Stuttgart.
35. March, S. T. and Smith, G. F. 1995. Design and Natural Science Research on Information Technology. Decision Support Systems. 15, 4 (1995), 251-266.
36. TM: Enterprise Governance, Risk, And Compliance Platforms, Q4 2007. http://www.mega.com/wp/active/document/company/MEGA-Forrester-Wave-GRC- Platforms-Q4-2007.pdf, Last Accessed 2009-01-21.
37. Menzies, C. (Ed.) 2006. Sarbanes-Oxley und Corporate Compliance: Nachhaltigkeit, Optimierung, Integration (transl. Sarbanes-Oxley and Corporate Compliance: Sustainability, Improvement, Integration). Schäffer-Poeschel, Stuttgart.
38. Menzies, C. et al. 2006. Das GRC-Stufenmodell - Nachhaltigkeit, Optimierung und Integration von Governance, Risikomanagement und Compliance (transl. The GRC Stage Model - Sustainability, Improvement and Integration of Governance, Risk Management and Compliance). In: Menzies, C. (Ed.) Sarbanes-Oxley und Corporate Compliance: Nachhaltigkeit, Optimierung, Integration (transl. Sarbanes-Oxley and Corporate Compliance: Sustainability, Improvement, Integration). Schäffer-Poeschel, Stuttgart, 63-424.
39. Mirbel, I. and Ralyté, J. 2006. Situational method engineering: combining assembly-based and roadmap-driven approaches. Requirements Engineering. 11, 1 (2006), 58-78.
40. Murphy, R. L. et al. 1996. Continuous Risk Management Guidebook. Software Engineering Institute, Carnegie Mellon University, Pittsburgh.
41. Parisini, E. and Wächter, O. 1971. Organisations-Handbuch für die Einführung von ADV-Systemen: Systemplanung, Systemanalyse, Systemeinführung (transl. Organizational Handbook for the Implementation of ADV Systems: System Planning, System Analysis, System Implementation). de Gruyter, Berlin.
42. Pfeiffer, D. and Niehaves, B. 2005. Evaluation of conceptual models - a structuralist approach. In: Bartmann, D. et al. (Eds.): 13th European Conference on Information Systems, Information Systems in a Rapidly Changing Economy (ECIS 2005), Regensburg.
43. Proctor, P. E. 2005. Select and Implement Appropriate Controls for Regulatory Compliance. Gartner Research.
44. Punter, T. and Lemmen, K. 1996. The MEMA-model: towards a new approach for Method Engineering. Information and Software Technology. 38 (1996), 295-305.
45. Raghupathi, W. R. 2007. Corporate Governance of IT: A Framework for Development. Communications of the ACM. 50, 8 (2007), 94-99.
46. Ralyté, J. 1999. Reusing Scenario Based Approaches in Requirement Engineering Methods: CREWS Method Base. In: Proceedings of the 10th International Workshop on Database and Expert Systems Applications (DEXA'99), 1st International Workshop on the Requirements Engineering Process (REP'99), Florenz, 305-309.
47. Ralyté, J., Brinkkemper, S., and Henderson-Sellers, B. (Eds.) 2007. Proceedings of the IFIP WG8.1 Working Conference on Situational Method Engineering - Fundamentals and Experiences (ME07). Springer/International Federation for Information Processing, Boston.
48. Ralyté, J. and Rolland, C. 2001. An Approach for Method Reengineering. In: Hideko, S. K., Jajodia, S., and Solvberg, A. (Eds.): Proceedings of the 20th International Conference on Conceptual Modeling (ER 2001), Yokohama, 471-484.
49. Ramakrishnan, S. 2008. Eliminate the weak links in your GRC process. OpRisk & Compliance. June (2008), http://www.opriskandcompliance.com/public/ showPage.html?page=799773.
50. Rausch, T. 2006. Holistic business process and compliance management. In: Pour, J. and Vorisek, J. (Eds.): 14th International Conference Systems Integration (SI 2006), Prague, 301-311.
51. Riegler, T. 2001. Wertorientierte Unternehmensführung - Umsetzungserfahrung im DaimlerChrysler Konzern (transl. Value-Based Management: Implementation Experiences at DaimerChrysler Group). Kostenrechnungspraxis. 45, 2 (2001), 89-94.
52. Senior Supervisors Group 2008. Observations on Risk Management Practices during the Recent Market Turbulences. Technical Report, http://www.newyorkfed. org/newsevents/news/banking/2008/SSG-Risk-Mgt-doc-final.pdf.
53. Steinberg, R. M. et al. 2004. Enterprise Risk Management Framework. http://www.coso.org/documents/COSO-ERM-ExecutiveSummary.pdf, Last Accessed 2008-11-27.
54. Strenger, C. 2004. The Corporate Governance Scorecard: a tool for the implementation of corporate governance. Corporate Governance. 12, 1 (2004), 11-15.
55. Teubner, A. and Feller, T. 2008. Informationstechnologie, Governance und Compliance (transl. Information Technology, Governance and Compliance). Wirtschaftsinformatik. 50, 5 (2008), 400-406.
56. Vaishnavi, V. K. and Kuechler, W. L. 2007. Design Science Research Methods and Patterns. Auerbach, Boca Raton, New York.
57. Van Roosmalen, M. W. and Hoppenbrouwers, S. J. B. A. 2008. Supporting Corporate Governance with Enterprise Architecture and Business Rule Management: A Synthesis of Stability and Agility. In: Vanthienen, J. et al. (Eds.): Proceedings of the International Workshop on Regulations Modelling and Deployment (ReMoD'08) held in conjunction with the CAiSE'08 Conference, Montpellier, http://sunsite.informatik.rwth-aachen.de/Publications/CEURWS/Vol- 342/paper2.pdf, 13-24.
58. Velthuis, L. J. and Wesner, P. 2005. Value Based Management: Bewertung, Performancemessung und Managemententlohnung mit ERIC® (transl. Value-Based Management: Evaluation, Performance Measurement and Management Compensation with ERIC®). Schäffer-Poeschel, Stuttgart.
59. Venable, J. R. 2006. A Framework for Design Science Research Activities. In: Information Resources Management Association International Conference (IRMA 2006), Hershey et al., 184-187.
60. Weber, J. et al. 2004. Wertorientierte Unternehmenssteuerung: Konzepte - Implementierung - Praxisstatements (transl. Value-Based Management: Concepts - Implementation - Practical Experiences). Gabler, Wiesbaden.
61. Winter, R., Müller, J., and Gericke, A. 2008. Business Engineering: der St. Galler Ansatz zum Veränderungsmanagement (transl. Business Engineering: The St. Gallen Approach to Change Management). OrganisationsEntwicklung. 27, 2 (2008), 40-47.
62. Young, D. S. and O'Byrne, S. F. 2001. EVA and value-based management: a practical guide to implementation. McGraw-Hill, New York.
63. Zoellick, B. and Frank, T. 2005. Governance, Risk Management, and Compliance: An Operational Approach. Whitepaper, The Compliance Consortium, http://gilbane.com/publications/GRC-Operational-Approach-PD1-0-050512.pdf.