TRPro: Taming the Impact of Regulatory Document Changes on Process Compliance

业务流程合规性位于监管科技和业务流程管理的界面，涉及在设计时和运行时验证流程模型和流程实例的合规性约束。通常情况下，合规性约束并不以结构化或正式化的格式提供，而是源于可能大量的监管文件，如《通用数据保护条例》（GRPD）。最近，已经提出了用于从监管文档中提取约束的方法，主要是基于自然语言处理（NLP），但是仍然存在一些开放的问题，例如，用于约束提取的分割规范文档的粒度。监管文件会经常进行修订和变更，可能会造成混乱，例如，欧盟平均每年颁布2000项法律的法案。法规变更可能导致违反合规性，例如，如果一个修正案需要执行一个额外的质量测试，而这个测试还没有在相关的过程模型和实例中实现。反过来，违规行为可能会使公司付出高昂的代价，例如，在违反GDPR的情况下。尽管存在这些严重后果，但尚未调查监管文件变更对工艺合规性的影响。此外，几乎没有努力利用计算机科学和技术来进行情境化、处理和简化，以实现更有效的数字化合规管理。挑战包括i）捕获潜在复杂的监管文档的变化，ii）监管文档变化的高频率，iii）大型过程模型存储库和过多的过程实例，以及iv）与监管文档变化同时发生的过程模型和实例的变化。TRPro为监管文件变更提供了一个框架，并定义了其结构和形式语义（i）。为此，以前的工作基于NLP的约束提取的利用和扩展。由于变更语义以合规性影响为目标，因此将反映合规性要求的约束集合作为逻辑抽象层。TRPro提供了算法，用于评估在设计和运行期间，法规文档级别的变更对相关流程模型和实例的影响。此外，TRPro详细说明了流程模型和实例的对齐，以解决因法规文件更改而导致的合规性违规。由于挑战ii）和iii），影响评估和寻找路线的效率至关重要，特别是在同时存在变化的情况下（iv）。TRPro概念在真实世界的数据集上进行原型实现和评估，例如，EUR-Lex和GDPR总之，TRPro结果通过全面控制监管文件变更对流程合规性的影响，构成了数字化合规管理的重要组成部分。

Business process compliance sits at the interface of RegTech and business process management and is concerned with the verification of compliance constraints over process models and process instances during design time and runtime. Typically, compliance constraints are not available in structured or formalized format, but stem from a possibly vast set of regulatory documents such as the General Data Protection Regulation (GRPD). Lately, approaches for the extraction of constraints from regulatory documents have been proposed, mostly based on Natural Language Processing (NLP), but still several open questions remain, e.g., the granularity of splitting regulatory documents for constraint extraction. Regulatory documents are subject to frequent and possibly disruptive amendments and change, e.g., an average of 2000 legal acts are issued by the European Union every year. Regulatory changes might cause compliance violations, e.g., if an amendment requires to conduct an additional quality test, which is not implemented in the associated process models and instances yet. Compliance violations, in turn, can become costly for companies, e.g., in the case of GDPR violations. Despite these severe consequences, regulatory document changes have not been investigated with respect to their impact on process compliance yet. Furthermore, there is little effort to leverage computer science and technology to contextualize, process, and streamline for a more efficient digitalized compliance management. Challenges comprise i) capturing change of potentially complex regulatory documents, ii) high frequency of regulatory document change, iii) large process model repositories and a plethora of process instances, and iv) changes of process models and instances occurring in concurrency to regulatory document changes. TRPro provides a framework for regulatory document changes with definitions of their structure and formal semantics (i). For this, previous work on NLP-based constraint extraction is exploited and extended. As change semantics targets compliance impact, the set of extracted constraints reflecting regulatory compliance requirements is taken as logical abstraction layer. TRPro provides algorithms for assessing the impact of changes at regulatory document level on the associated process models and instances during design and runtime. Moreover, TRPro elaborates alignments of process models and instances in order to address compliance violations caused by regulatory document changes. Due to challenges ii) and iii), the efficiency of the impact assessment and finding the alignments is crucial, particularly at the presence of concurrent changes (iv). TRPro concepts are prototypically implemented and evaluated on real-world data sets, e.g., EUR-Lex and the GDPR. In summary, TRPro results constitute an important building block in digitalized compliance management by providing comprehensive control on the impact of regulatory document changes on process compliance.