How Complex Does Compliance Get?

Metrics have been applied in software engineering to manage the complexity of program code. This paper explores a new application area of the classic software engineering metrics to determine the complexity of compliance rules in business processes. Despite the critical voices noting the rather weak theoretical foundation, metrics provide effective measures for overlooking the concepts that may drive the complexity of a program. Their scope, scalability, and perceived ease of use do not diffuse these doubts, but provide ample reasons to believe that there is more to complexity analysis than numbers, and that a better methodological approach can help to reveal their true potential. Utilizing this potential would be of great importance, not only for establishing effective and efficient compliance management, but also for providing innovative solutions to digitalization trends and increasing data stacks. While some extant work has shown the applicability of software metrics for analyzing the complexity of process models, metrics have not been applied so far to manage the complexity of compliance rules. The approach presented in this paper provides an integrated view on the complexity of compliance rules that are modeled with conceptually different compliance languages. To this end, we review and discuss the literature on software metrics to derive the definitions needed to compute the complexity of compliance rules, and to refurbish the methodological foundation of software engineering metrics.