Skip to main content
SpringerLink
Log in
Book cover

Handbook on Business Process Management 2 pp 265–288Cite as

Managing Regulatory Compliance in Business Processes

  • Chapter
  • First Online:

Part of the book series: International Handbooks on Information Systems ((INFOSYS))

Abstract

The ever-increasing obligations of regulatory compliance are presenting a new breed of challenges for organizations across several industry sectors. Aligning control objectives that stem from regulations and legislation with business objectives devised for improved business performance is a foremost challenge. The organizational as well as IT structures for the two classes of objectives are often distinct and potentially in conflict. In this chapter, we present an overarching methodology for aligning business and control objectives. The various phases of the methodology are then used as a basis for discussing state-of-the-art in compliance management. Contributions from research and academia as well as industry solutions are discussed. The chapter concludes with a discussion on the role of BPM as a driver for regulatory compliance and a presentation of open questions and challenges.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   189.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD   249.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    “The AML/CTF Act is a principles-based piece of legislation. It sets out broad obligations which reporting entities and others affected by the legislation must meet, but leaves the methods of meeting those obligations to be decided by those on whom the obligations fall.” (AUSTRAC 2006)

  2. 2.

    “Internal control is broadly defined as a process effected by an entity's board of directors, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations; reliability of financial reporting; and compliance with applicable laws and regulations.” (COSO 1994)

  3. 3.

    Note that obligations allow us to capture prohibitions; a prohibition is an obligation plus negation, for example the prohibition to smoke can be understood as the obligation not to smoke.

  4. 4.

    For more information about BPCC see http://www.nicta.com.au/research/projects/bpc

References

  • Abdullah NS, Indulska M, Sadiq S (2009) A study of compliance management in information systems research. In: The 17th European conference on information systems. European conference on information systems, Verona, Italy, pp 1–10

    Google Scholar 

  • Abdullah NS, Indulska M, Sadiq S (2010).Emerging challenges in information systems research for regulatory compliance management. In: Pernici B (ed) Advanced information systems engineering: Proceedings of the 22nd international conference, CAiSE 2010. 22nd international conference on advanced information systems engineering, Hammamet, 7–9 June 2010, pp 251–265

    Google Scholar 

  • Abdullah NS, Indulska M, Sadiq S (2012) A compliance management ontology: developing shared understanding through models. In: Advanced information systems engineering, Springer, Berlin/Heidelberg, pp 429–444

    Google Scholar 

  • Agrawal R, Johnson C, Kiernan J, Leymann F (2006) Taming compliance with sarbanes-oxley internal controls using database technology. In: Proceedings of the 22nd international conference on data engineering, IEEE Computer Society, Atlanta, Georgia, USA

    Google Scholar 

  • Alberti M, Chesani F, Gavanelli M, Lamma E, Mello P, Torroni P (2006) Compliance verification of agent interaction: a logic based tool. Appl Artif Intell 20(2–4):133–157

    Article  Google Scholar 

  • Antoniou G, Billington D, Governatori G, Maher MJ (2001) Representation results for de- feasible logic. ACM Trans Comput Log 2(2):255–287

    Article  Google Scholar 

  • ASX (2006) Australian securities exchange principles of good governance, recommendation 7.1, Nov 2006. www.asx.gov.au. Accessed 1 June 2008)

  • AUSTRAC (2006) Australian transaction reports and analysis centre supervisory framework. www.austrac.gov.au/files/supervisory_framework.pdf. Accessed 1 June 2008

  • BPM Forum (2006) CEE: the future. Building the compliance enabled enterprise. Report produced by global fluency in partnership with: AXS-One, chief executive magazine and IT compliance institute

    Google Scholar 

  • Caldwell F, Eid T (2008) Magic quadrant for enterprise governance, risk and compliance platforms. ID. G00158295, Gartner Research, June 2008

    Google Scholar 

  • Carmo J, Jones AJ (2002) Deontic logic and contrary to duties. In: Gabbay D, Guenther F (eds) Handbook of philosophical logic, vol 8, 2nd edn. Springer, Dordrecht, pp 265–343

    Chapter  Google Scholar 

  • Cheng R, Sadiq S, Indulska M (2011) Framework for business process and rule integration: a case of BPMN and SBVR. In: BIS 2011, Poznan, Poland, pp 13–24

    Google Scholar 

  • Conforti R, Fortino G, Rosa ML, ter Hofstede AHM (2011) A history-aware real-time risk detection in business processes. In: Meersman R et al (eds) Proceedings of the on the move to meaningful internet systems: OTM 2011, Part I, Lecture Notes in Computer Science, vol 7044. Springer, pp 100–118, 2011

    Google Scholar 

  • COSO –The Committee of Sponsoring Organizations of the Treadway Commission (1994) Internal control – integrated framework. Committee of Sponsoring Organizations of the Treadway Commission, New York. www.coso.org

  • Desai N, Mallya AU, Chopra AK, Singh MP (2005) Interaction protocols as design abstractions for business processes. IEEE Trans Softw Eng 31(12):1015–1027

    Article  Google Scholar 

  • Desai N, Nanjangud NC, Singh MP (2008) Checking correctness of business contracts via commitments. In: Padgham L, Parkes DC, Müller J, Parsons S (eds) Proceedings of 7th international conference on autonomous agents and multiagent systems (AAMAS2008), Estoril, 12–16 May 2008

    Google Scholar 

  • Elgammal A, Türetken O, van den Heuvel W-J (2012) Using patterns for the analysis and resolution of compliance violations. Int J Coop Info Syst 21(1):31–54

    Article  Google Scholar 

  • Farrell ADH, Sergot MJ, Sallé M, Bartolini C (2005) Using the event-calculus for tracking the normative state in contracts. Int J Coop Info Syst 14(2–3):99–129

    Article  Google Scholar 

  • Giblin C, Muller S, Pfitzmann B (2006) From regulatory policies to event monitoring rules: towards model driven compliance automation. IBM research report. Zurich Research Laboratory, Zurich, Switzerland

    Google Scholar 

  • Goedertier S, Vanthienen J (2006) Designing compliant business processes with obligations and permissions. In Eder J, Dustdar S et al (eds) Proceedings of workshop on business process design, LNCS, vol 4103, Springer, Vienna, pp 5–14

    Google Scholar 

  • Gordon TF, Governatori G, Rotolo A (2009) Rules and norms: requirements for rule inter- change languages in the legal domain. In: Governatori G, Hall J, Paschke A (eds) Rule representation, interchange and reasoning on the web (RuleML 2009), LNCS, vol 5858, Springer, pp 282–296

    Google Scholar 

  • Governatori G (2005) Representing business contracts in RuleML. Int J Coop Info Syst 14(2–3):181–216

    Article  Google Scholar 

  • Governatori G, Milosevic Z (2006) A formal analysis of a business contract language. Int J Coop Info Syst 15(4):659–685

    Article  Google Scholar 

  • Governatori G, Rotolo A (2006) Logic of violations: a gentzen system for reasoning on contrary- to-duty obligations. Austr J Logic 4:193–215

    Google Scholar 

  • Governatori G, Rotolo A (2008) An algorithm for business process compliance. In: Francesconi E, Sartor G, Tiscornia D (eds) Legal knowledge and information systems, IOS Press, Florence Italy & Brisbane, Australia, pp 186–191

    Google Scholar 

  • Governatori G, Rotolo A (2010) A Conceptually Rich Model of Business Process Compliance. In Link S, Ghose A (eds) 7th Asia-Pacific conference on conceptual modelling (APCCM 2010), ACS, Florence Italy & Brisbane, Australia, pp 3–12

    Google Scholar 

  • Governatori G, Sadiq S (2009) The journey to business process compliance. In: Cardoso J, van der Aalst W (eds) Handbook of research on BPM. IGI Global, Hershey, pp 426–454

    Google Scholar 

  • Governatori G, Shek S (2012) Rule based business process compliance. In: Proceedings of the RuleML2012@ECAI challenge, CEUR workshop proceedings 874, Montpellier, France, article 5

    Google Scholar 

  • Governatori G, Hoffmann J, Sadiq S, Weber I (2008) Detecting regulatory compliance for business process models through semantic annotations. In: 4th international workshop on business process design (BPD’08). In conjunction with the 6th international conference on business process management, Milan, pp 1–4

    Google Scholar 

  • Hagerty J, Hackbush J, Gaughan D, Jacobson S (2008) The governance, risk management, and compliance spending report, 2008–2009: inside the $32B GRC market, AMR Research, Boston, 25 Mar 2008

    Google Scholar 

  • Hashmi M, Governatori G, Wynn MT (2012) Business process data compliance. In: Bikakis A, Giurca A (eds) 6th international symposium on rules on the web: research and applications (RuleML 2012), LNCS, vol 7438, Springer, pp 32–46

    Google Scholar 

  • Herrestad H (1991) Norms and formalization. In: Proceedings of ICAIL 1991, ACM, New York, pp 175–184

    Google Scholar 

  • KPMG Advisory (2005) The compliance journey: balancing risk and controls with business improvement, KPMG Australia

    Google Scholar 

  • Kuster J, Ryndina K, Gall H (2007) Generation of business process models for object life cycle. In: Proceedings of the 5th international conference on business process management, Springer, Brisbane, pp 165–180

    Google Scholar 

  • Lam H-P, Governatori G (2009) The making of SPINdle. In: Governatori G, Hall J, Paschke A (eds) Rule representation, interchange and reasoning on the web (RuleML 2009), LNCS, vol 5858, Springer, Las Vegas, Nevada, USA, pp. 315–322

    Google Scholar 

  • Liu Y, Muller S, Xu K (2007) A static compliance checking framework for business process models. IBM Syst J 46:335–361

    Article  Google Scholar 

  • Lu R, Sadiq S, Governatori G (2008) Compliance aware business process design. Third international workshop on business process design (BPD’07). In: Conjunction with the 5th international conference on business process management, LNCS, Vol 4928/2008. Springer, Berlin, 24–28 Sept 2007, pp 120–131

    Google Scholar 

  • Ly LT, Rinderle-Ma S, Göser K, Dadam P (2012) On enabling integrated process compliance with semantic constraints in process management systems – requirements, challenges, solutions. Info Syst Front 14(2):195–219

    Article  Google Scholar 

  • Maggi F, Montali M, Westergaard M, van der Aalst W (2011) Monitoring business constraints with linear temporal logic: an approach based on colored automata. In: BPM 2011, LNCS, vol 6896, Springer, pp 132–147

    Google Scholar 

  • Neiger D, Churilov L, zur Mühlen M, Rosemann M (2006) Integrating risks in business process models with value focused process engineering. In: Proceedings of the 2006 European conference on information systems (ECIS 2006), Goteborg, 12–14 June 2006

    Google Scholar 

  • Padmanabhan V, Governatori G, Sadiq S, Colomb R, Rotolo A (2006) Process modeling: the deontic way. In Stumptner M, Hartmann S, Kiyoki Y (eds) Australia–Pacific conference on conceptual modeling, CRPIT, Hobart, Tasmania, Australia, vol 53, pp 75–84

    Google Scholar 

  • Pesic M, van der Aalst WMP (2006) A declarative approach for flexible business processes. In: Eder J, Dustdar S (eds) Business process management workshops, workshop on dynamic process management (DPM 2006), Lecture notes in computer science, vol 4103. Springer, Berlin, pp 169–180

    Google Scholar 

  • Rosemann M, vom Brocke J (2014) The six core elements of business process management. In: vom Brocke J, Rosemann M (eds) Handbook on business process management, vol 1, 2nd edn. Springer, Heidelberg, pp 105–122

    Google Scholar 

  • Sadiq S, Sadiq W, Orlowska M (2005) A framework for constraint specification and validation in flexible workflows. Info Syst 30(5):349–378

    Article  Google Scholar 

  • Sadiq S, Governatori G, Naimiri K (2007) Modeling control objectives for business process compliance. In: Proceedings of the 5th international conference on business process management, Springer, Brisbane, pp 149–164

    Google Scholar 

  • Sartor G (2005) Legal reasoning: a cognitive approach to the law. Springer, Berlin

    Google Scholar 

  • van der Aalst WMP, van Dongen BF, Herbst J, Maruster L, Schimm G, Weijters AJMM (2003) Workflow mining: a survey of issues and approaches. Data Knowl Eng 47:237–267

    Article  Google Scholar 

  • van Dongen BF, de Medeiros AKA, Verbeek HMW, Weijters AJMM, van der Aalst WMP (2005) The ProM Framework: a new era in process mining tool support. In: Proceedings of 26th international conference applications and theory of Petri nets, Springer, Miami, pp 444–454

    Google Scholar 

  • zur Mühlen M, Rosemann M (2005) Integrating risks in business process models. In: Proceedings of 16th Australasian conference on information systems, Sydney

    Google Scholar 

  • zur Mühlen M, Indulska M, Kamp G (2007) Business process and business rule modelling languages for compliance management: a representational analysis. In: 26th international conference on conceptual modelling – ER2007 –tutorials, posters, panels and industrial contributions, Auckland

    Google Scholar 

Download references

Acknowledgment

NICTA is funded by the Australian Government as represented by the Department of Broadband, Communications and the Digital Economy and the Australian Research Council through the ICT Centre of Excellence program.

Author information

Authors and Affiliations

  1. School of Information Technology and Electrical Engineering, The University of Queensland, Brisbane, QLD, Australia

    Shazia Sadiq

  2. NICTA Software Systems Research Group, Brisbane, Australia

    Guido Governatori

Authors
  1. Shazia Sadiq
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Guido Governatori
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Shazia Sadiq .

Editor information

Editors and Affiliations

  1. Institute of Information Systems, University of Liechtenstein, Vaduz, Liechtenstein

    Jan vom Brocke

  2. School of Information Systems, Queensland University of Technology, Brisbane, Queensland, Australia

    Michael Rosemann

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer-Verlag Berlin Heidelberg

About this chapter

Cite this chapter

Sadiq, S., Governatori, G. (2015). Managing Regulatory Compliance in Business Processes. In: vom Brocke, J., Rosemann, M. (eds) Handbook on Business Process Management 2. International Handbooks on Information Systems. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-45103-4_11

Download citation

Publish with us

Policies and ethics

Search

Navigation