Business process compliance checking – Applying and evaluating a generic pattern matching approach for conceptual models in the financial sector

Information Systems Frontiers

Volumn 18, Issue 2, 2016, Pages 359-405

  Becker, Jörg ^a   Delfmann, Patrick ^a   Dietrich, Hanns Alexander ^a   Steinhorst, Matthias ^a,b   Eggert, Mathias ^a  

^a UNIVERSITY OF MÜNSTER   (Germany)

^b UNIVERSITÉ DE STRASBOURG   (France)

Author keywords

Business process compliance management; Business process modeling; Conceptual modeling; Model checking; Model querying; Patternmatching compliance checking

Indexed keywords

DATA MINING; DECISION SUPPORT SYSTEMS; GRAPHIC METHODS; MANAGEMENT SCIENCE; MODEL CHECKING; PATTERN MATCHING; PROJECT MANAGEMENT; QUERY LANGUAGES; REGULATORY COMPLIANCE; SYSTEMS ENGINEERING;

BUSINESS PROCESS COMPLIANCES; BUSINESS PROCESS MODEL; COMPLIANCE CHECKING; COMPLIANCE MANAGEMENT; CONCEPTUAL MODEL; CONCEPTUAL MODELING LANGUAGES; FINANCIAL INDUSTRY; REGULATORY REQUIREMENTS;

COMPLIANCE CONTROL;

EID: 84916917411     PISSN: 13873326     EISSN: 15729419     Source Type: Journal    
DOI: 10.1007/s10796-014-9529-y     Document Type: Article

References (85)

1. Abdullah, N. S., Indulska, M., & Shazia, S. (2009). A study of compliance management in information systems research. In Proc. of the European Conference on Information Systems (ECIS).
2. Abdullah, N. S., Sadiq, S., & Indulska, M. (2010). Emerging Challenges in Information Systems Research for Regulatory Compliance Management. In B. Pernici (Ed.), Advanced Information Systems Engineering (Vol. 6051, pp. 251–265). Springer Berlin Heidelberg. doi:10.1007/978-3-642-13094-6_21.
3. Accorsi, R., Lowis, L., & Sato, Y. (2011). Automated certification for compliant cloud-based business processes. Business and Information Systems Engineering, 3(3), 145–154. doi:10.1007/s12599-011-0155-7.
4. Arbab, F., Kokash, N., & Meng, S. (2009). Towards Using Reo for Compliance-Aware Business Process Modeling. In T. Margaria & B. Steffen (Eds.), Leveraging Applications of Formal Methods, Verification and Validation (Vol. 17, pp. 108–123). Springer Berlin Heidelberg. doi:10.1007/978-3-540-88479-8_9.
5. Awad, A. (2007). BPMN-Q: A Language to Query Business Processes (Enterprise Modelling and Information Systems Architectures Concepts and Applications Proceedings of the 2nd Int’l Workshop EMISA 2007 (Vol. 119, pp. 115–128)). Germany: St. Goar.
6. Awad, A., Decker, G., & Weske, M. (2008). Efficient Compliance Checking Using BPMN-Q and Temporal Logic. In M. Dumas, M. Reichert, &M.-C. Shan (Eds.), Business Process Management (Vol. 5240, pp. 326–341). Milan: Springer Berlin Heidelberg. doi:10.1007/978-3-540-85758-7_24.
7. Awad, A., & Sakr, S. (2010). Querying Graph-Based Repositories of Business Process Models. In M. Yoshikawa, X. Meng, T. Yumoto, Q. Ma, L. Sun, & C. Watanabe (Eds.), Database Systems for Advanced Applications (Vol. 6193, pp. 33–44). Tsukuba: Springer Berlin Heidelberg.
8. Awad, A., Smirnov, S., & Weske, M. (2009). Towards Resolving Compliance Violations in Business Process Models (In S. Sadiq, M. Indulska, M. zur Muehlen, E. Dubois, & P. Johannesson (Eds.), Proceedings of the 2nd International Workshop on Governance, Risk and Compliance (GRCIS’09)). Amsterdam: The Netherlands.
9. Awad, A., & Weske, M. (2009). Visualization of compliance violation in business process models. In S. Rinderle-Ma, S. Sadiq, & F. Leymann (Eds.), Business Process Management Workshops (Vol. 43, pp. 182–193).Ulm: Springer Berlin Heidelberg. doi:10.1007/ 978-3-642-12186-9_17.
10. Becker, J., Bergener, P., Delfmann, P., & Weiß, B. (2011). Modeling and Checking Business Process Compliance Rules in the Financial Sector. In D. F. Galletta & T.-P. Liang (Eds.), Proc. of the International Conference on Information Systems (ICIS).
11. Becker, J., Breuker, D., Weiß, B., & Winkelmann, A. (2010). Exploring the Status Quo of Business Process Modelling Languages in the Banking Sector – An Empirical Insight into The Usage of Methods in Banks (In Proc. of the Australasian Conference on Information Systems (ACIS)). Australia: Brisbane.
12. Becker, J., Delfmann, P., Eggert, M., & Schwittay, S. (2012a). Generalizability and applicability of model-based business process compliance-checking approaches – A state-of-the-art analysis and research roadmap. Business Research, 5(2), 221–247.
13. Becker, J., Delfmann, P., Herwig, S., & Lis, L. (2009). A Generic Set Theory-based Pattern Matching Approach for the Analysis of Conceptual Models. In A. H. F. Laender, S. Castano, U. Dayal, F. Casati, & J. P. M. de Oliverira (Eds.), Conceptual Modeling - ER 2009 (Vol. 5829, pp. 41–54). Berlin: Springer Verlag. doi:10.1007/978-3-642-04840-1_6.
14. Becker, J., Eggert, M., & Schwittay, S. (2012). How to Evaluate the Practical Relevance of Business Process Compliance Checking Approaches? In D. C. Mattfeld & S. Robra-Bissantz (Eds.), Multikonferenz Wirtschaftsinformatik 2012 - Tagungsband der MKWI 2012 (pp. 849–861).
15. Becker, A., Gruber, W., & Wohlert, D. (2006). Handbuch Marisk: Mindestanforderungen an Das Risiko-Management in Der Bankpraxis. Frankfurt: Knapp.
16. Becker, J., & Schütte, R. (2004). Handelsinformationssysteme. Frankfurt: Redline Wirtschaft.
17. Boella, G., Janssen, M., Hulstijn, J., Humphreys, L., & van der Torre, L. (2013). Managing legal interpretation in regulatory compliance. In Proceedings of the Fourteenth International Conference on Artificial Intelligence and Law - ICAIL’13 (pp. 23–32). New York: ACM Press. doi:10.1145/2514601.2514605.
18. Bräuer, S., Delfmann, P., Dietrich, H.-A., & Steinhorst, M. (2013). Using a Generic Model Query Approach to Allow for Process Model Compliance Checking–An Algorithmic Perspective. In R. Alt & B. Franczyk (Eds.), Proceedings of the 11th International Conference on Wirtschaftsinformatik (WI) 2013 (pp. 1245–1259). Leipzig: Universität Leipzig.
19. Buhl, H. U., Fridgen, G., Müller, G., & Röglinger, M. (2012). Business and information systems engineering: A complementary approach to information systems – what we can learn from the past and may conclude from present reflection on the future. Journal of the Association for Information Systems, 13, 236–253.
20. Cabanillas, C., Resinas, M., & Ruiz-Cortés, A. (2010). Hints on how to face business process compliance. Ac-tas de los Talleres de las Jornadas de Ingeniería del Software y Bases de Datos, 4(4), 26–32.
21. Caldwell, F. (2009). The Worldwide Economic Crisis Will Bring Real- Time Reporting for Risk Management. Stamford: Gartner Research, Gartner, Inc.
22. Caldwell, F., Bace, J., & Lotto, R. (2009). U.S. Financial System Regulatory Overhaul Brings More Scrutiny. Stamford: Gartner Research, Gartner, Inc.
23. Davis, A. M. (1993). Software Requirements: Objects, Functions, and States. Upper Saddle River: Prentice-Hall, Inc.
24. Davis, F. D., Bagozzi, R. P., & Warshaw, P. R. (1989). User acceptance of computer technology: A comparison of two theoretical models. Management Science, 35(8), 982–1003. doi:10.1287/mnsc.35.8.982.
25. Delfmann, P., Herwig, S., & Lis, Ł. (2009). Unified Enterprise Knowledge Representation with Conceptual Models - Capturing Corporate Language in Naming Conventions (Proc. of the International Conference on Information Systems (ICIS)). Arizona: Phoenix.
26. Delfmann, P., Steinhorst, M., Dietrich, H.-A., & Becker, J. (2014). The generic model query language GMQL - conceptual specification, implementation, and runtime evaluation. Information Systems. doi: 10.1016/j.is.2014.06.003.
27. Diestel, R. (2010). Graph Theory. Springer.
28. Dietrich, H.-A., Breuker, D., Steinhorst, M., Delfmann, P., & Becker, J. (2013). Developing graphical model editors for meta-modelling tools – requirements, conceptualisation, and implementation. Enterprise Modelling and Information Systems Architectures, 8(2), 42–78.
29. Dietrich, H.-A., Steinhorst, M., Becker, J., & Delfmann, P. (2011). Fast Pattern Matching in Conceptual Models - Evaluating and Extending a Generic Approach. In M. Nüttgens, O. Thomas, & B. Weber (Eds.), Enterprise Modelling and Information Systems Architectures (EMISA 2011) (Vol. 190, pp. 79–92).GI.
30. Dijkman, R. M., La Rosa, M., & Reijers, H. A. (2012). Managing large collections of business process models - current techniques and challenges. Computers in Industry, 63(2), 91–97. doi:10.1016/j.compind.2011.12.003.
31. El Kharbili, M., de Medeiros, A. K. A., Stein, S., & van der Aalst, W. M. P. (2008). Business Process Compliance Checking: Current State and Future Challenges. In P. Loos, M. Nüttgens, K. Turowsk, & D. Werth (Eds.), MobIS 2008 (Vol. 141, pp. 107–113). Saarbrücken, Germany: GI.
32. Elgammal, A., Türetken, O., van den Heuvel, W.-J., & Papazoglou, M. P. (2010). Root-Cause Analysis of Design-Time Compliance Violations on the Basis of Property Patterns. In P. P. Maglio,M.Weske, J. Yang, & M. Fantinato (Eds.), ICSOC (Vol. 6470, pp. 17–31).
33. Foerster, A., Engels, G., Schattkowsky, T., Van Der Straeten, R., & Forster, A. (2007). Verification of Business Process Quality Constraints Based on Visual Process Patterns. In First Joint IEEE/ IFIP Symposium on Theoretical Aspects of Software Engineering (TASE’07) (pp. 197–208). Washington: IEEE. doi:10.1109/TASE.2007.56.
34. Foerster, A., Engels, G., & Schattkowsky, T. (2005). Activity Diagram Patterns for Modeling Quality Constraints in Business Processes. In L. Briand & C. Williams (Eds.), Model Driven Engineering Languages and Systems (Vol. 3713, pp. 2–16). Springer Berlin Heidelberg. doi:10.1007/11557432_2.
35. Gamma, E., Helm, R., Johnson, R., & Vlissides, J. (1994). Design Patterns: Elements of Reusable Object-Oriented Software. Amsterdam: Addison-Wesley Professional.
36. Ghose, A., & Koliadis, G. (2007). Auditing Business Process Compliance. In B. Krämer, K.-J. Lin, & P. Narasimhan (Eds.), Service-Oriented Computing – ICSOC 2007 (Vol. 4749, pp. 169–180). Vienna: Springer Berlin Heidelberg. doi:10.1007/978-3-540- 74974-5.
37. Goedertier, S., & Vanthienen, J. (2006). Designing Compliant Business Processes with Obligations and Permissions. In J. Eder & S. Dustdar (Eds.), Business Process ManagementWorkshops (Vol. 4103, pp. 5–14). Vienna: Springer Berlin Heidelberg. doi:10.1007/11837862_2.
38. Governatori, G., & Milosevic, Z. (2006). A formal analysis of a business contract language. International Journal of Cooperative Informat ion Systems, 15(4), 659–685. doi:10.1142/S0218843006001529.
39. Governatori, G., Milosevic, Z., & Sadiq, S. (2006). Compliance Checking Between Business Processes and Business Contracts. In Proceedings of the 10th IEEE International Enterprise Distributed Object Computing Conference (pp. 221–232). Washington: IEEE Computer Society. doi:10.1109/EDOC.2006.22.
40. Governatori, G., & Rotolo, A. (2010). A Conceptually Rich Model of Business Process Compliance. In Proceedings of the Seventh Asia- Pacific Conference on Conceptual Modelling (pp. 3–12). Darlinghurst: Australian Computer Society, Inc.
41. Hevner, A. R., March, S. T., Park, J.,& Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105.
42. Höfferer, P. (2007). Achieving business process model interoperability using metamodels and ontologies. In H. Österle, J. Schelp, & R. Winter (Eds.), Proc. of the European Conference on Information Systems (ECIS) (pp. 1620–1631). St. Gallen, Switzerland: University of St. Gallen.
43. Hoffmann, J., Weber, I., & Governatori, G. (2009). On compliance checking for clausal constraints in annotated process models. Information Systems Frontiers, 14(2), 155–177. doi:10.1007/s10796-009-9179-7.
44. Knuplesch, D., Ly, L. T., Rinderle-Ma, S., Pfeifer, H., & Dadam, P. (2010). On Enabling Data-Aware Compliance Checking of Business Process Models. In Conceptual Modeling – ER 2010 (Vol. 6412, pp. 332–346). Vancouver: Springer Berlin Heidelberg. doi:10.1007/978-3-642-16373-9_24.
45. Kokash, N., & Arbab, F. (2009). Formal Behavioral Modeling and Compliance Analysis for Service-Oriented Systems. In F. S. Boer, M. M. Bonsangue, & E. Madelaine (Eds.), Formal Methods for Components and Objects (Vol. 5751, pp. 21–41). Sophia Antipolis: Springer Berlin Heidelberg. doi:10.1007/978-3-642-04167-9_2.
46. Kotonya, G., & Sommerville, I. (1998). Requirements Engineering - Processes and Techniques. John Wiley & Sons. Kumar, A., & Liu, R. (2008). A Rule-Based Framework Using Role Patterns for Business Process Compliance. In N. Bassiliades, G. Governatori, & A. Paschke (Eds.), Rule Representation, Interchange and Reasoning on the Web (Vol. 5321, pp. 58–72). Springer Berlin Heidelberg. doi:10.1007/978-3-540-88808-6_9.
47. Küster, J. M., Ryndina, K., & Gall, H. (2007). Generation of Business Process Models for Object Life Cycle Compliance. In G. Alonso, P. Dadam, & M. Rosemann (Eds.), Business Process Management (Vol. 4714, pp. 165–181). Brisbane: Springer Berlin Heidelberg. doi:10.1007/978-3-540-75183-0_13.
48. Liu, Y., Müller, S., & Xu, K. (2007). A static compliance-checking framework for business process models. IBM Systems Journal, 46(2), 335–361. doi:10.1147/sj.462.0335.
49. Lu, R., Sadiq, S., & Governatori, G. (2008a). Measurement of compliance distance in business processes. Information Systems Management, 25(4), 344–355. doi:10.1080/10580530802384613.
50. Lu, R., Sadiq, S., & Governatori, G. (2008b). Compliance Aware Business Process Design. In A. ter Hofstede, B. Benatallah, & H.- Y. Paik (Eds.), Business Process Management Workshops (Vol. 4928, pp. 120–131). Brisbane: Springer Berlin Heidelberg. doi:10.1007/978-3-540-78238-4_14.
51. Ly, L. T., Göser, K., Rinderle-Ma, S., & Dadam, P. (2008a). Compliance of Semantic Constraints - A Requirements Analysis for Process Management Systems. In Proc. 1st Int’l Workshop on Governance, Risk and Compliance - Applications in Information Systems (GRCIS’08).
52. Ly, L. T., Rinderle, S., & Dadam, P. (2008b). Integration and verification of semantic constraints in adaptive process management systems. Data and Knowledge Engineering, 64(1), 3–23. doi:10.1016/j.datak.2007.06.007.
53. Ly, L. T., Rinderle, S., & Dadam, P. (2006). Semantic Correctness in Adaptive Process Management Systems. In S. Dustdar, J. L. Fiadeiro, & A. P. Sheth (Eds.), Business Process Management (Vol. 4102, pp. 193–208). Vienna: Springer Berlin Heidelberg. doi:10.1007/11841760_14.
54. Ly, L. T., Rinderle-Ma, S., Göser, K., & Dadam, P. (2012). On enabling integrated process compliance with semantic constraints in process management systems. Information Systems Frontiers, 14(2), 195–219. doi:10.1007/s10796-009-9185-9.
55. Ly, L. T., Rinderle-Ma, S., & Dadam, P. (2010). Design and Verification of Instantiable Compliance Rule Graphs in Process-Aware Information Systems. In B. Pernici (Ed.), Advanced Information Systems Engineering (Vol. 6051, pp. 9–23). Hammamet: Springer Berlin Heidelberg. doi:10.1007/978-3-642-13094-6_3.
56. Mendling, J. (2007). Detection and Prediction of Errors in EPC Business Process Models (Doctoral dissertation). WU Vienna University of Economics and Business Administration.
57. Monakova, G., Kopp, O., Leymann, F., Moser, S., & Schäfers, K. (2009). Verifying Business Rules Using an SMT Solver for BPEL Processes. In W. Abramowicz, L. Maciaszek, R. Kowalczyk, & A. Speck (Eds.), Business process, servicescomputing and intelligent service management (Vol. 147, pp. 81–94). Gesellschaft für Informatik e.V. (GI).
58. Müller, J. (2010). Strukturbasierte Verifikation von BPMN-Modellen (Doctoral dissertation). Eberhard-Karls-Universität Tübingen.
59. OASIS. (2007). Web Services Business Process Execution Language Version 2.0. Retrieved April 10, 2012, from http://docs.oasis-open.org/wsbpel/2.0/wsbpel-v2.0.pdf
60. Object Management Group. (2005). Unified Modeling Language Infrastructure. Retrieved April 10, 2012, from http://www.omg.org/spec/UML/2.0/Infrastructure/PDF/
61. Object Management Group. (2011). Business Process Model and Notation (BPMN). Retrieved April 30, 2013, from http://www.omg.org/spec/BPMN/2.0/PDF
62. Opromolla, G. (2009). Facing the financial crisis: Bank of Italy’s implementing regulation on hedge funds. Journal of Investment Compliance, 10(2), 41–44. doi:10.1108/15285810910971274.
63. Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of Management Information System, 24(3), 45–77. doi:10.2753/MIS0742-1222240302.
64. Peterson, J. L. (1977). Petri nets. ACM Computing Surveys, 9(3), 223–252. doi:10.1145/356698.356702.
65. Raduescu, C., Tan, H. M., Jayaganesh, M., Bandara, W., zur Muehlen, M., & Lippe, S. (2006). A framework of issues in large process modeling projects. In Proc. of the European Conference on Information Systems (ECIS). Göteborg, Sweden.
66. Rinderle-Ma, S., Ly, L. T., & Dadam, P. (2008). Business process compliance. EMISA Forum, 28(2), 24–29.
67. Rosemann, M., & Vessey, I. (2008). Toward improving the relevance of information systems research to practice: The role of applicability checks. MIS Quarterly, 32(1), 1–22.
68. Sadiq, S., Governatori, G., & Namiri, K. (2007). Modeling Control Objectives for Business Process Compliance. In G. Alonso, P. Dadam, & M. Rosemann (Eds.), Business Process Management (Vol. 4714, pp. 149–164). Springer Berlin Heidelberg. doi:10.1007/ 978-3-540-75183-0_12.
69. Scheer, A.-W. (2000). ARIS - Business Process Modeling (3rd ed.). Berlin: Springer.
70. Schleicher, D., Anstett, T., Leymann, F., & Schumm, D. (2010). Compliant Business Process Design Using Refinement Layers. In R. Meersman, T. Dillon, & P. Herrero (Eds.), On the Move to Meaningful Internet Systems: OTM 2010 (Vol. 6426, pp. 114–131). Springer Berlin Heidelberg. doi:10.1007/978-3-642-16934-2_11.
71. Schumm, D., Turetken, O., Kokash, N., Elgammal, A., Leymann, F., & Van Den Heuvel, W.-J. (2010). Business Process Compliance Through Reusable Units of Compliant Processes. In F. Daniel & F. M. Facca (Eds.), Current Trends inWeb Engineering (Vol. 6385, pp. 325–337). Berlin: Springer Berlin Heidelberg.
72. Simon, H. A. (1996). The Sciences of the Artificial (3rd ed.). Cambridge: MIT Press.
73. Stewart, D.W., Shamdasani, P. N., & Rook, D.W. (2007). Focus groups: Theory and practice (2nd ed.). Sage Publications, Inc.
74. Thomas, O., & Fellmann, M. (2009). Semantic process modeling – design and implementation of an ontology-based representation of business processes. Business and Information Systems Engineering, 1(6), 438–451. doi:10.1007/s12599-009-0078-8.
75. Tosatto, S. C., Governatori, G., Kelsen, P., & van der Torre, L. (2012). Business Process Compliance is Hard (pp. 1–14).
76. Tosatto, S. C., Kharbili, M. El, Governatori, G., Kelsen, P., Ma, Q., & van der Torre, L. (2013). Algorithms for Basic Compliance Problems. In IEEE Sixth International Conference on Software Testing, Verification and Validation Workshops (pp. 2–7). IEEE. doi:10.1109/ICSTW.2013.6.
77. Van der Aalst, W. M. P. (2013). Business process management: A comprehensive survey. ISRN Software Engineering, 2013, 1–37. doi:10.1155/2013/507984.
78. Venkatesh, V., & Bala, H. (2008). Technology acceptance model 3 and a research agenda on interventions. Decision Sciences, 39(2), 273–315. doi:10.1111/j.1540-5915.2008.00192.x.
79. Wang, J., Jin, T., Wong, R. K., & Wen, L. (2013). Querying business process model repositories. World Wide Web, 17(3), 427–454. doi: 10.1007/s11280-013-0210-z.
80. Weiß, B., & Winkelmann, A. (2011). AMetamodel Based Perspective on the Adaptation of a Semantic Business Process Modeling Language to the Financial Sector. In 2011 44th Hawaii International Conference on System Sciences (pp. 1–10). IEEE. doi:10.1109/HICSS.2011.16.
81. Wolter, C., & Meinel, C. (2010). An approach to capture authorisation requirements in business processes. Requirements Engineering, 15(4), 359–373. doi:10.1007/s00766-010-0103-y.
82. Wolter, C., Miseldine, P., & Meinel, C. (2009). Verification of Business Process Entailment Constraints Using SPIN. In F. Massacci, S. Redwine Jr., & N. Zannone (Eds.), Engineering Secure Software and Systems (Vol. 5429, pp. 1–15). Springer Berlin Heidelberg. doi: 10.1007/978-3-642-00199-4_1.
83. Worzberger, R., Kurpick, T., & Heer, T. (2008a). Checking Correctness and Compliance of Integrated Process Models. In Symbolic and Numeric Algorithms for Scientific Computing, 2008. SYNASC’08. 10th International Symposium on (pp. 576–583). doi:10.1109/SYNASC.2008.10.
84. Worzberger, R., Kurpick, T., & Heer, T. (2008b). On Correctness, Compliance and Consistency of Process Models. In Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2008. WETICE’08. IEEE 17th (pp. 251–252). doi:10.1109/WETICE.2008.9.
85. Zoet, M., Welke, R., Versendaal, J., & Ravesteyn, P. (2009). Aligning Risk Management and Compliance Considerations with Business Process Development. In T. Noia & F. Buccafurri (Eds.), ECommerce and Web Technologies (Vol. 5692, pp. 157–168). Springer Berlin Heidelberg. doi:10.1007/978-3-642-03964-5_16