Compliance monitoring in business processes: Functionalities, application, and tool-support

Information Systems

Volumn 54, Issue , 2015, Pages 209-234

  Ly, Linh Thao ^a   Maggi, Fabrizio Maria ^b   Montali, Marco ^c   Rinderle Ma, Stefanie ^d   Van Der Aalst, Wil M P ^e  

^a UNIVERSITY OF ULM   (Germany)

^b UNIVERSITY OF TARTU   (Estonia)

^c FREE UNIVERSITY OF BOZEN BOLZANO   (Italy)

^d UNIVERSITY OF VIENNA   (Austria)

^e EINDHOVEN UNIVERSITY OF TECHNOLOGY   (Netherlands)

Author keywords

Business process compliance; Compliance monitoring; Operational support

Indexed keywords

PROCESS MONITORING;

BUSINESS PROCESS; BUSINESS PROCESS COMPLIANCES; COMPLIANCE APPROACH; COMPLIANCE MONITORING; COMPLIANCE RULES; FINE GRAINED; NEW APPROACHES; SYSTEMATIC LITERATURE REVIEW;

MONITORING;

EID: 84940793966     PISSN: 03064379     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.is.2015.02.007     Document Type: Article

References (100)

1. S. Sadiq, G. Governatori, K. Naimiri, Modeling control objectives for business process compliance, in: International Conference on Business Process Management, pp. 149-164, 2007.
2. L.T. Ly, S. Rinderle-Ma, K. Göser, and P. Dadam On enabling integrated process compliance with semantic constraints in process management systems Inf. Syst. Front. 14 2 2012 195 219
3. S. Sadiq, A roadmap for research in business process compliance, in: Business Information Systems Workshops, 2011, pp. 1-4.
4. F. Caron, J. Vanthienen, and B. Baesens Comprehensive rule-based compliance checking and risk management with process mining Decis. Support Syst. 54 3 2013 1357 1369
5. M.E. Kharbili, S. Stein, I. Markovic, E. Pulvermüller, Towards a framework for semantic business process compliance management, in: International Workshop on Governance, Risk and Compliance - Applications in Information Systems (GRCIS'08), 2008, pp. 1-15.
6. A. Kogan, E.F. Sudit, and M.A. Vasarhelyi Continuous online auditing: a program of research J. Inf. Syst. 13 2 1999 87 103
7. IEEE Task Force on Process Mining, XES Standard Definition, www.xes-standard.org, 2013.
8. H.M.W. Verbeek, J.C.A.M. Buijs, B.F. van Dongen, W.M.P. van der Aalst, XES, XESame, and ProM 6, Information Systems Evolution, LNBIP, vol. 72, 2011, pp. 60-75.
9. M. Weske Business Process Management: Concepts, Languages, Architectures 2007 Springer Berlin, Heidelberg, New York
10. L.T. Ly, F.M. Maggi, M. Montali, S. Rinderle-Ma, W.M.P. van der Aalst, A framework for the systematic comparison and evaluation of compliance monitoring approaches, in: IEEE Enterprise Distributed Object Computing Conference, 2013, pp. 7-16.
11. 3TU Data Center, BPI Challenge 2011 Event Log, http://dx.doi.org/10.4121/uuid:d9769f3d-0ab0-4fb8-803b-0d1120ffcf54.
12. B. van Dongen, BPI challenge 2012 Event Log, http://dx.doi.org/10.4121/uuid:3926db30-f712-4394-aebc-75976070e91f.
13. B. Weber, M. Reichert, and S. Rinderle-Ma Change patterns and change support features - enhancing flexibility in process-aware information systems Data Knowl. Eng. 66 3 2008 438 466
14. A. Lanz, B. Weber, M. Reichert, Workflow time patterns for process-aware information systems, in: Business Process Modeling, Development, and Support, LNBIP, vol. 50, 2010, pp. 94-107.
15. S. Rinderle-Ma, J. Mangler, Integration of process constraints from heterogeneous sources in process-aware information systems, in: International EMISA Workshop, 2011, pp. 51-64.
16. B. Kitchenham, Procedures for performing systematic reviews, Technical Report, Keele University, 2004.
17. E.A.P. Santos, R. Francisco, A.D. Vieira, E.d.F.R. Loures, M.A. Busetti, Modeling business rules for supervisory control of process-aware information systems, in: Business Process Management Workshops, 2012, pp. 447-458.
18. K. Namiri, N. Stojanovic, Pattern-based design and validation of business process compliance, in: On the Move to Meaningful Internet Systems, 2007, pp. 59-76.
19. R.v. Ammon, T. Ertlmaier, O. Etzion, A. Kofman, T. Paulus, Integrating complex events for collaborating and dynamically changing business processes, in: Service-Oriented Computing Workshops, 2010, pp. 370-384
20. F. Barbon, P. Traverso, M. Pistore, M. Trainotti, Run-time monitoring of instances and classes of web service compositions, in: International Conference on Web Services, 2006, pp. 63-71.
21. L. Baresi, D. Bianculli, C. Ghezzi, S. Guinea, P. Spoletini, A timed extension of wscol, in: International Conference on Web Services, 2007, pp. 663-670.
22. L. Baresi, S. Guinea, Dynamo: Dynamic monitoring of WS-BPEL processes, in: International Conference on Service-Oriented Computing, 2005, pp. 478-483.
23. L. Baresi, S. Guinea, L. Pasquale, Self-healing BPEL processes with dynamo and the jBoss rule engine, in: International Workshop on Engineering of Software Services for Pervasive Environments, 2007, pp. 11-20.
24. S. Halle, R. Villemaire, Runtime monitoring of message-based workflows with data, in: International IEEE Enterprise Distributed Object Computing Conference, 2008, pp. 63-72.
25. L. Khaluf, C. Gerth, G. Engels, Pattern-based modeling and formalizing of business process quality constraints, in: International Conference on Advanced Information Systems Engineering, 2011, pp. 521-535.
26. D.A. Basin, M. Harvan, F. Klaedtke, E. Zalinescu, Monpoly: monitoring usage-control policies, in: International Conference on Runtime Verification, 2012, pp. 360-364.
27. D.A. Basin, F. Klaedtke, S. Müller, B. Pfitzmann, Runtime monitoring of metric first-order temporal properties, in: IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science (FSTTCS 2008), LIPIcs, vol. 2, Schloss Dagstuhl - Leibniz-Zentrum fuer Informatik, 2008, pp. 49-60.
28. J. Becker, P. Delfmann, M. Eggert, and S. Schwittay Generalizability and applicability of model- based business process compliance-checking approaches - a state-of-the-art analysis and research roadmap Bus. Res. 5 2 2012 221 247
29. L. Baresi, S. Guinea, Towards dynamic monitoring of WS-BPEL processes, in: International Conference on Service-Oriented Computing, 2005, pp. 269-282.
30. D. Basin, F. Klaedtke, S. Marinovic, E. Zalinescu, Monitoring compliance policies over incomplete and disagreeing logs, in: International Conference on Runtime Verification, 2013, pp. 151-167.
31. S. Bragaglia, F. Chesani, P. Mello, M. Montali, D. Sottara, Fuzzy conformance checking of observed behaviour with expectations, in: International Conference on AI∗IA 2011: Artificial Intelligence Around Man and Beyond, 2011, pp. 80-91
32. F. Chesani, P. Mello, M. Montali, F. Riguzzi, M. Sebastianis, Storari, Compliance checking of execution traces to business rules: an approach based on logic programming, in: Business Process Management Workshops, 2008, pp. 134-145.
33. C. Giblin, S. Müller, B. Pfitzmann, From regulatory policies to event monitoring rules: towards model-driven compliance automation, Technical Report, RZ 3662, 2006.
34. M. Gomez-Lopez, R. Gasca, S. Rinderle-Ma, Explaining the incorrect temporal events during business process monitoring by means of compliance rules and model-based diagnosis, in: Enterprise Distributed Object Computing Conference Workshops, 2013, pp. 163-172.
35. L.T. Ly, S. Rinderle-Ma, D. Knuplesch, P. Dadam, Monitoring business process compliance using compliance rule graphs, in: On the Move to Meaningful Internet Systems, 2011, pp. 82-99.
36. F.M. Maggi, M. Montali, W.M.P. van der Aalst, An operational decision support framework for monitoring business constraints, in: International Conference on Fundamental Approaches to Software Engineering, 2012, pp. 146-162.
37. F.M. Maggi, M. Montali, M. Westergaard, W.M.P. van der Aalst, Monitoring business constraints with linear temporal logic: an approach based on colored automata, in: International Conference on Business Process Management, 2011, pp. 132-147.
38. F.M. Maggi, M. Westergaard, M. Montali, W.M.P. van der Aalst, Runtime verification of LTL-Based declarative process models, in: International Conference on Runtime Verification, 2012, pp. 131-146.
39. M. Montali, F.M. Maggi, F. Chesani, P. Mello, and W.M.P. van der Aalst Monitoring business constraints with the event calculus ACM Trans. Intell. Syst. Technol. 5 1 2013
40. N. Narendra, V. Varshney, S. Nagar, M. Vasa, A. Bhamidipaty, Optimal control point selection for continuous business process compliance monitoring, in: International Conference on Service Operations and Logistics, and Informatics, 2008, pp. 2536-2541.
41. R. Thullner, S. Rozsnyai, J. Schiefer, H. Obweger, M. Suntinger, Proactive business process compliance monitoring with event-based systems, in: IEEE Enterprise Distributed Object Computing Conference Workshops, 2011, pp. 429-437.
42. S. Sebahi, Business process compliance monitoring: a view-based approach (Ph.D. thesis), LIRIS, 2012.
43. W.M.P. van der Aalst, K. van Hee, J.M. van der Werf, A. Kumar, and M. Verdonk Conceptual model for online auditing Decis. Support Syst. 50 3 2011 636 647
44. A. Awad, M. Weidlich, M. Weske, Consistency checking of compliance rules, in: International Conference on Business Information Systems, 2010, pp. 106-118.
45. E. Ramezani, D. Fahland, W.M.P. van der Aalst, Where did I misbehave? Diagnostic information in compliance checking, in: International Conference on Business Process Management, 2012, pp. 262-278.
46. E. Ramezani, D. Fahland, J.M. van der Werf, P. Mattheis, Separating compliance management and business process management, in: Business Process Management Workshops, 2012, pp. 459-464.
47. W.M.P. van der Aalst, and A. de Medeiros Process mining and security: detecting anomalous process executions and checking process conformance Electron. Notes Theor. Comput. Sci. 121 2005 3 21
48. W.M.P. van der Aalst, A. Adriansyah, and B. van Dongen Replaying history on process models for conformance checking and performance analysis Wiley Interdiscip. Rev.: Data Min. Knowl. Discov. 2 2 2012 182 192
49. R. Accorsi, T. Stocker, On the exploitation of process mining for security audits: the conformance checking case, in: Annual ACM Symposium on Applied Computing, 2012, pp. 1709-1716.
50. Q. He, Detecting runtime business process compliance with artifact lifecycles, in: Service-Oriented Computing Workshops, 2013, pp. 426-432.
51. M. Harvan, D. Basin, G. Caronni, S. Ereth, F. Klaedtke, H. Mantel, Checking system compliance by slicing and monitoring logs∗, Technical Report, ETH, Department of Computer Science, Institute of Information Security, 2013.
52. A. Awad, E. Pascalau, and M. Weske Towards instant monitoring of business process compliance EMISA Forum 30 2 2010 10 24
53. E. Mulo, U. Zdun, and S. Dustdar Domain-specific language for event-based compliance monitoring in process-driven SOAs Serv. Orient. Comput. Appl. 7 1 2013 59 73
54. E. Mulo, U. Zdun, S. Dustdar, Monitoring web service event trails for business compliance, in: International Conference on Service-Oriented Computing and Applications, 2009, pp. 1-8.
55. M. Strano, Contract specification for compliance checking of business interactions (Ph.D. thesis), Newcastle University, 2010.
56. M. Strano, C. Molina-Jimenez, S. Shrivastava, A model for checking contractual compliance of business operations, Technical Report, University of Newcastle, 2008.
57. G. Middleton, L. Peyton, C. Kuziemsky, B. Eze, A framework for continuous compliance monitoring of eHealth processes, in: World Congress on Privacy, Security, Trust and the Management of e-Business, 2009, pp. 152-160.
58. J. Stevovic, J. Li, H.R. Motahari-Nezhad, F. Casati, and G. Armellin Business process management enabled compliance-aware medical record sharing Int. J. Bus. Process Integr. Manag. 6 3 2013 201 223
59. M. Binder, W. Dorda, G. Duftschmid, R. Dunkl, K.A. Fröschl, W. Gall, W. Grossmann, K. Harmankaya, M. Hronsky, S. Rinderle-Ma, C. Rinner, S. Weber, On analyzing process compliance in skin cancer treatment: an experience report from the evidence-based medical compliance cluster (EBMC2), in: International Conference on Advanced Information Systems Engineering, 2012, pp. 398-413.
60. C. Garbe, K. Peris, A. Hauschild, P. Saiag, M. Middleton, A. Spatz, J. Grob, J. Malvehy, J. Newton-Bishop, A. Stratigos, and et al. Diagnosis and treatment of melanoma: European consensus-based interdisciplinary guideline Eur. J. Cancer 46 2 2010 270 283
61. ADVENTURE Project Consortium, D7.1.2 use case specification, http://www.fp7-adventure.eu/resources/, 2012.
62. L.T. Ly, C. Indiono, J. Mangler, S. Rinderle-Ma, Data transformation and semantic log purging for process mining, in: International Conference on Advanced Information Systems Engineering, 2012, pp. 238-253.
63. F.M. Maggi, A.J. Mooij, W.M.P. van der Aalst, Analyzing Vessel Behavior using Process Mining, Poseidon Book, 2013, pp. 133-148.
64. L.T. Ly, Seaflows - a compliance checking framework for supporting the process lifecycle (Ph.D. thesis), University of Ulm, 2013.
65. E.M. Clarke, O. Grumberg, and D.A. Peled Model Checking 1999 The MIT Press Cambridge
66. R. Alur, and T.A. Henzinger Real-time logics: complexity and expressiveness Inf. Comput. 104 1993 35 77
67. R.A. Kowalski, and M.J. Sergot A logic-based calculus of events New Gener. Comput. 4 1 1986 67 95
68. N. Russell, A.H.M. ter Hofstede, D. Edmond, W.M.P. van der Aalst, Workflow data patterns: identification, representation and tool support, in: International Conference on Conceptual Modeling, 2005, pp. 353-368.
69. J.F. Allen Maintaining knowledge about temporal intervals Commun. ACM 26 11 1983 832 843
70. F.A. Schreiber Is time a real time? An overview of time ontology in informatics Real Time Comput. F 127 1994 283 307
71. M. Reichert, and P. Dadam ADEPT flex - supporting dynamic changes of workflows without losing control J. Intell. Inf. Syst. 10 2 1998 93 129
72. J. Mangler, S. Rinderle-Ma, Rule-based synchronization of process activities, in: International Conference on E-Commerce, 2011, pp. 121-128.
73. H. Prakken, and M.J. Sergot Contrary-to-duty obligations Stud. Log. 57 1 1996 91 115
74. M. Montali, Specification and Verification of Declarative Open Interaction Models - A Logic-Based Approach, LNBIP, vol. 56, 2010.
75. E.A.P. Santos, R. Francisco, A.D. Vieira, E.F.R. Loures, M.A. Busetti, Modeling business rules for supervisory control of process-aware information systems, in: Business Process Management Workshops, 2012, pp. 447-458.
76. M. Dwyer, G. Avrunin, J. Corbett, Patterns in property specifications for finite-state verification, in: International Conference on Software Engineering, 1999, pp. 411-420.
77. G. De Giacomo, M.Y. Vardi, Linear temporal logic and linear dynamic logic on finite traces, in: International Joint Conference on Artificial Intelligence, 2013, pp. 854-860.
78. G. De Giacomo, R. De Masellis, M. Montali, Reasoning on LTL on finite traces: insensitivity to infiniteness, in: AAAI Conference on Artificial Intelligence, 2014, pp. 1027-1033.
79. G. Governatori, ICT support for regulatory compliance of business processes, in: World Continuous Auditing and Reporting Symposium (29WCARS), 2013.
80. M. Pesic, Constraint-based workflow management systems: shifting controls to users (Ph.D. thesis), Beta Research School for Operations Management and Logistics, Eindhoven, 2008.
81. M. Montali, M. Pesic, W.M.P. van der Aalst, F. Chesani, P. Mello, and S. Storari Declarative specification and verification of service choreographies ACM Trans. Web 4 1 2010
82. O. Turetken, A. Elgammal, W.-J. van den Heuvel, and M. Papazoglou Capturing compliance requirements: a pattern-based approach IEEE Softw. 29 3 2012 28 36
83. A. Awad, M. Weidlich, M. Weske, Specification, verification and explanation of violation for data aware compliance rules, in: International Conference on Service Oriented Computing, 2009, pp. 500-515.
84. M. Montali, F. Chesani, P. Mello, F. M. Maggi, Towards data-aware constraints in Declare, in: Annual ACM Symposium on Applied Computing, 2013, pp. 1391-1396.
85. F.M. Maggi, M. Dumas, L. García-Bañuelos, M. Montali, Discovering data-aware declarative process models from event logs, in: International Conference on Business Process Management, 2013, pp. 81-96.
86. D. Knuplesch, M. Reichert, L.T. Ly, A. Kumar, S. Rinderle-Ma, Visual modeling of business process compliance rules with the support of multiple perspectives, in: International Conference on Conceptual Modeling, 2013, pp. 106-120.
87. W.M.P. van der Aalst, and M. Pesic DecSerFlow: towards a truly declarative service flow language M. Bravetti, M. Nunez, G. Zavattaro, International Conference on Web Services and Formal Methods (WS-FM 2006), Lecture Notes in Computer Science vol. 4184 2006 Springer-Verlag Berlin 1 23
88. M. Pesic, H. Schonenberg, W.M.P. van der Aalst, Declare: full support for loosely-structured processes, in: IEEE Enterprise Distributed Object Computing Conference, 2007, pp. 287-300.
89. W.M.P. van der Aalst, M. Pesic, and H. Schonenberg Declarative workflows: balancing between flexibility and support Comput. Sci. Res. Dev. 23 2 2009 99 113
90. G. Governatori, Z. Milosevic, S. Sadiq, Compliance checking between business processes and business contracts, in: IEEE Enterprise Distributed Object Computing Conference, 2006, pp. 221-232.
91. M. Hashmi, G. Governatori, M.T. Wynn, Business process data compliance, in: International Symposium Rules on the Web: Research and Applications, 2012, pp. 32-46.
92. F.M. Maggi, Declarative process mining with the Declare component of ProM, Business Process Management Demos, 2013.
93. M. Pesic, W.M.P. van der Aalst, A declarative approach for flexible business processes management, in: Business Process Management Workshops, 2006, pp. 169-180.
94. S. Bragaglia, F. Chesani, P. Mello, M. Montali, P. Torroni, Reactive event calculus for monitoring global computing applications, Logic programs, norms and action, in: Lecture Notes in Computer Science, vol. 7360, 2012.
95. D. Luckham The Power of Events: An Introduction to Complex Event Processing in Distributed Enterprise Systems 2008 Springer Berlin, Heidelberg
96. N.A. Chaudhry, K. Shaw, and M. Abdelguerfi Stream Data Management 2005 Springer US
97. E. Mulo, U. Zdun, and S. Dustdar Domain-specific language for event-based compliance monitoring in process-driven SOAs Serv. Orient. Comput. Appl. 7 1 2013 59 73
98. D. Schuller, R. Hans, S. Zöller, R. Steinmetz, On optimizing collaborative manufacturing processes in virtual factories, in: Workshop on ICT Services and Interoperability for Manufacturing, 2014, pp. 66-74.
99. W.M.P. van der Aalst Discovery, Conformance and Enhancement of Business Processes 2011 Springer Berlin, Heidelberg
100. M. Leitner, J. Mangler, S. Rinderle-Ma, Definition and enactment of instance-spanning process constraints, in: Web Information Systems Engineering, 2012, pp. 652-658.