Artikel in Zeitschrift ART-2013-03

Rodríguez, Carlos; Schleicher, Daniel; Daniel, Florian; Casati, Fabio; Leymann, Frank; Wagner, Sebastian: SOA-enabled compliance management: instrumenting, assessing, and analyzing service-based business processes.
In: Springer (Hrsg): Service Oriented Computing and Applications.
Universität Stuttgart, Fakultät Informatik, Elektrotechnik und Informationstechnik.
S. 1-18, englisch.
Springer, Februar 2013.
ISSN: 1863-2386; 1863-2394.
Artikel in Zeitschrift.
CR-Klassif.H.4.1 (Office Automation)
KeywordsService-based compliance governance; Compliance assessment; Signaling instrumentation; Key indicators; Root cause analysis; Reporting dashboard

Facilitating compliance management, that is, assisting a company’s management in conforming to laws, regulations, standards, contracts, and policies, is a hot but non-trivial task. The service-oriented architecture (SOA) has evolved traditional, manual business practices into modern, service-based IT practices that ease part of the problem: the systematic definition and execution of business processes. This, in turn, facilitates the online monitoring of system behaviors and the enforcement of allowed behaviors—all ingredients that can be used to assist compliance management on the fly during process execution. In this paper, instead of focusing on monitoring and runtime enforcement of rules or constraints, we strive for an alternative approach to compliance management in SOAs that aims at assessing and improving compliance. We propose two ingredients: (i) a model and tool to design compliant service-based processes and to instrument them in order to generate evidence of how they are executed and (ii) a reporting and analysis suite to create awareness of a company’s compliance state and to enable understanding why and where compliance violations have occurred. Together, these ingredients result in an approach that is close to how the real stakeholders—compliance experts and auditors—actually assess the state of compliance in practice and that is less intrusive than enforcing compliance.

Abteilung(en)Universität Stuttgart, Institut für Architektur von Anwendungssystemen
Eingabedatum13. Februar 2013
   Publ. Institut   Publ. Informatik