SOA-enabled compliance management: Instrumenting, assessing, and analyzing service-based business processes

Carlos Rodríguez, Daniel Schleicher, Florian Daniel, Fabio Casati, Frank Leymann, Sebastian Wagner

Research output: Contribution to journalArticle

6 Citations (Scopus)

Abstract

Facilitating compliance management, that is, assisting a company's management in conforming to laws, regulations, standards, contracts, and policies, is a hot but non-trivial task. The service-oriented architecture (SOA) has evolved traditional, manual business practices into modern, service-based IT practices that ease part of the problem: the systematic definition and execution of business processes. This, in turn, facilitates the online monitoring of system behaviors and the enforcement of allowed behaviors-all ingredients that can be used to assist compliance management on the fly during process execution. In this paper, instead of focusing on monitoring and runtime enforcement of rules or constraints, we strive for an alternative approach to compliance management in SOAs that aims at assessing and improving compliance. We propose two ingredients: (i) a model and tool to design compliant service-based processes and to instrument them in order to generate evidence of how they are executed and (ii) a reporting and analysis suite to create awareness of a company's compliance state and to enable understanding why and where compliance violations have occurred. Together, these ingredients result in an approach that is close to how the real stakeholders-compliance experts and auditors-actually assess the state of compliance in practice and that is less intrusive than enforcing compliance.

Original languageEnglish
Pages (from-to)275-292
Number of pages18
JournalService Oriented Computing and Applications
Volume7
Issue number4
DOIs
Publication statusPublished - Dec 2013
Externally publishedYes

    Fingerprint

Keywords

  • Compliance assessment
  • Key indicators
  • Reporting dashboard
  • Root cause analysis
  • Service-based compliance governance
  • Signaling instrumentation

ASJC Scopus subject areas

  • Management Information Systems
  • Software
  • Information Systems
  • Hardware and Architecture

Cite this