TRPro: Taming the Impact of Regulatory Document Changes on Process Compliance

TRPro：减轻监管文件变更对流程合规性的影响

• 批准号: 514769482
• 负责人: Professorin Dr. Stefanie Rinderle-Ma
• 金额: --
• 依托单位: Lehrstuhl für Informatik 17: Wirtschaftsinformatik und Geschäftsprozessmanagement
• 依托单位国家: 德国
• 项目类别: Research Grants
• 资助国家: 德国
• 项目状态: 未结题
• 来源: https://gepris.dfg.de/gepris/projekt/514769482?language=en
• 关键词: TRPro; Taming; Impact; Regulatory; Document

Business process compliance sits at the interface of RegTech and business process management and is concerned with the verification of compliance constraints over process models and process instances during design time and runtime. Typically, compliance constraints are not available in structured or formalized format, but stem from a possibly vast set of regulatory documents such as the General Data Protection Regulation (GRPD). Lately, approaches for the extraction of constraints from regulatory documents have been proposed, mostly based on Natural Language Processing (NLP), but still several open questions remain, e.g., the granularity of splitting regulatory documents for constraint extraction. Regulatory documents are subject to frequent and possibly disruptive amendments and change, e.g., an average of 2000 legal acts are issued by the European Union every year. Regulatory changes might cause compliance violations, e.g., if an amendment requires to conduct an additional quality test, which is not implemented in the associated process models and instances yet. Compliance violations, in turn, can become costly for companies, e.g., in the case of GDPR violations. Despite these severe consequences, regulatory document changes have not been investigated with respect to their impact on process compliance yet. Furthermore, there is little effort to leverage computer science and technology to contextualize, process, and streamline for a more efficient digitalized compliance management. Challenges comprise i) capturing change of potentially complex regulatory documents, ii) high frequency of regulatory document change, iii) large process model repositories and a plethora of process instances, and iv) changes of process models and instances occurring in concurrency to regulatory document changes. TRPro provides a framework for regulatory document changes with definitions of their structure and formal semantics (i). For this, previous work on NLP-based constraint extraction is exploited and extended. As change semantics targets compliance impact, the set of extracted constraints reflecting regulatory compliance requirements is taken as logical abstraction layer. TRPro provides algorithms for assessing the impact of changes at regulatory document level on the associated process models and instances during design and runtime. Moreover, TRPro elaborates alignments of process models and instances in order to address compliance violations caused by regulatory document changes. Due to challenges ii) and iii), the efficiency of the impact assessment and finding the alignments is crucial, particularly at the presence of concurrent changes (iv). TRPro concepts are prototypically implemented and evaluated on real-world data sets, e.g., EUR-Lex and the GDPR. In summary, TRPro results constitute an important building block in digitalized compliance management by providing comprehensive control on the impact of regulatory document changes on process compliance.

业务流程遵从性位于RegTech和业务流程管理的接口上，与在设计时和运行时对流程模型和流程实例的遵从性约束的验证有关。通常，合规性约束不能以结构化或形式化的形式提供，而是源于大量的法规文档，例如通用数据保护条例（General Data Protection Regulation， GRPD）。最近，人们提出了从法规文件中提取约束的方法，这些方法大多基于自然语言处理（NLP），但仍然存在一些悬而未决的问题，例如，分割法规文件以提取约束的粒度。规范性文件受到频繁且可能具有破坏性的修订和变更的影响，例如，欧盟每年平均发布2000项法律行为。法规变更可能导致法规遵从性违规，例如，如果修改需要执行额外的质量测试，而这还没有在相关的流程模型和实例中实现。反过来，违反合规性可能会让公司付出高昂的代价，例如违反GDPR的情况。尽管有这些严重的后果，规范性文件的变化还没有调查它们对过程遵从性的影响。此外，很少有人努力利用计算机科学和技术来实现更有效的数字化法规遵循管理的上下文化、流程化和流程化。挑战包括i)捕获潜在复杂的法规文档的更改，ii)法规文档更改的频率高，iii)大型流程模型存储库和过多的流程实例，以及iv)与法规文档更改并发发生的流程模型和实例的更改。TRPro为法规文件变更提供了一个框架，并定义了其结构和形式语义(i)。为此，利用和扩展了先前基于nlp的约束提取工作。由于变更语义的目标是遵从性影响，因此将反映法规遵从性需求的提取约束集作为逻辑抽象层。TRPro提供了用于在设计和运行时期间评估法规文档级别的更改对相关流程模型和实例的影响的算法。此外，TRPro详细说明了流程模型和实例的对齐，以便处理由法规文档更改引起的遵从性违规。由于挑战（二）和（三），影响评估的效率和寻找对齐是至关重要的，特别是在同时存在变化（四）的情况下。TRPro概念通常在真实世界的数据集上实现和评估，例如EUR-Lex和GDPR。总之，TRPro结果通过全面控制法规文件变更对流程合规性的影响，构成了数字化合规管理的重要组成部分。