Abstract
This paper proposes a concrete approach for the automatic mitigation of risks that are detected during process enactment. Given a process model exposed to risks, e.g. a financial process exposed to the risk of approval fraud, we enact this process and as soon as the likelihood of the associated risk(s) is no longer tolerable, we generate a set of possible mitigation actions to reduce the risks’ likelihood, ideally annulling the risks altogether. A mitigation action is a sequence of controlled changes applied to the running process instance, taking into account a snapshot of the process resources and data, and the current status of the system in which the process is executed. These actions are proposed as recommendations to help process administrators mitigate process-related risks as soon as they arise. The approach has been implemented in the YAWL environment and its performance evaluated. The results show that it is possible to mitigate process-related risks within a few minutes.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
van der Aalst, W.M.P.: Process Mining: Discovery, Conformance and Enhancement of Business Processes. Springer (2011)
van der Aalst, W.M.P., Schonenberg, M.H., Song, M.: Time prediction based on process mining. Information Systems 36(2), 450–475 (2011)
Adams, M., ter Hofstede, A.H.M., van der Aalst, W.M.P., Edmond, D.: Dynamic, Extensible and Context-Aware Exception Handling for Workflows. In: Meersman, R., Tari, Z. (eds.) OTM 2007, Part I. LNCS, vol. 4803, pp. 95–112. Springer, Heidelberg (2007)
Alberts, C.J., Dorofee, A.J.: OCTAVE criteria, version 2.0. Technical Report CMU/SEI-2001-TR-016, Carnegie Mellon University (2001)
Alter, S.: A work system view of DSS in its fourth decade. In: DSS, vol. 38 (December 2004)
Barber, B., Davey, J.: The use of the CCTA Risk Analysis and Management Methodology CRAMM in health information systems. In: MEDINFO. North Holland Publishing (1992)
Basel Committee on Bankin Supervision. Basel II: International Convergence of Capital Measurement and Capital Standards (2006)
Betz, S., Hickl, S., Oberweis, A.: Risk-aware business process modeling and simulation using xml nets. In: IEEE CEC, pp. 349–356 (September 2011)
Charfi, A., Mezini, M.: AO4BPEL: An aspect-oriented extension to BPEL. In: WWW (2007)
Combi, C., Posenato, R.: Controllability in Temporal Conceptual Workflow Schemata. In: Dayal, U., Eder, J., Koehler, J., Reijers, H.A. (eds.) BPM 2009. LNCS, vol. 5701, pp. 64–79. Springer, Heidelberg (2009)
International Electrotechnical Commission. IEC 61025 Fault Tree Analysis, FTA (1990)
Conforti, R., Fortino, G., La Rosa, M., ter Hofstede, A.H.M.: History-Aware, Real-Time Risk Detection in Business Processes. In: Meersman, R., Dillon, T., Herrero, P., Kumar, A., Reichert, M., Qing, L., Ooi, B.-C., Damiani, E., Schmidt, D.C., White, J., Hauswirth, M., Hitzler, P., Mohania, M. (eds.) OTM 2011, Part I. LNCS, vol. 7044, pp. 100–118. Springer, Heidelberg (2011)
Conforti, R., ter Hofstede, A.H.M., La Rosa, M., Adams, M.J.: Automated risk mitigation in business processes (extended version). QUT ePrints 49331 (2012)
Cope, E.W., Kuster, J.M., Etzweiler, D., Deleris, L.A., Ray, B.: Incorporating risk into business process models. IBM Journal of Research and Development 54(3), 4:1–4:13 (2010)
Dadam, P., Reichert, M.: The ADEPT project: a decade of research and development for robust and flexible process support. CSRD 23, 81–97 (2009)
Dumas, M., van der Aalst, W.M.P., ter Hofstede, A.H.M.: Process-Aware Information Systems: Bridging People and Software through Process Technology. Wiley & Sons (2005)
Gambini, M., La Rosa, M., Migliorini, S., Ter Hofstede, A.H.M.: Automated Error Correction of Business Process Models. In: Rinderle-Ma, S., Toumani, F., Wolf, K. (eds.) BPM 2011. LNCS, vol. 6896, pp. 148–165. Springer, Heidelberg (2011)
Hermosillo, G., Seinturier, L., Duchien, L.: Using complex event processing for dynamic business process adaptation. In: SCC, pp. 466–473. IEEE (2010)
ter Hofstede, A.H.M., van der Aalst, W.M.P., Adams, M., Russell, N. (eds.): Modern Business Process Automation: YAWL and its Support Environment. Springer (2010)
Jallow, A.K., Majeed, B., Vergidis, K., Tiwari, A., Roy, R.: Operational risk analysis in business processes. BTTJ 25(1), 168–177 (2007)
Johnson, W.G.: MORT: The Management Oversight and Risk Tree. U.S. Atomic Energy Commission (1973)
Lund, M.S., Solhaug, B., Stølen, K.: Model-Driven Risk Analysis: The CORAS Approach. Springer (2011)
Muller, R., Greiner, U., Rahm, E.: AgentWork: a workflow system supporting rule-based workflow adaptation. Data & Knowledge Engineering 51(2), 223–256 (2004)
Neiger, D., Churilov, L., zur Muehlen, M., Rosemann, M.: Integrating risks in business process models with value focused process engineering. In: ECIS. AISeL (2006)
Ouyang, C., La Rosa, M., ter Hofstede, A.H.M., Dumas, M., Shortland, K.: Toward web-scale workflows for film production. IEEE, Internet Computing 12(5), 53–61 (2008)
Russell, N., van der Aalst, W.M.P., ter Hofstede, A.H.M.: Workflow Exception Patterns. In: Martinez, F.H., Pohl, K. (eds.) CAiSE 2006. LNCS, vol. 4001, pp. 288–302. Springer, Heidelberg (2006)
Sienou, A., Lamine, E., Pingaud, H., Karduck, A.P.: Risk driven process engineering in digital ecosystems: Modelling risk. In: Proc. of IEEE DEST, pp. 647–650 (2010)
Smith, K.I., Everson, R.M., Fieldsend, J.E., Murphy, C., Misra, R.: Dominance-based multiobjective simulated annealing. IEEE TEC 12(3), 323–342 (2008)
Standards Australia and Standards New Zealand. Standard AS/NZS ISO 31000 (2009)
Strecker, S., Heise, D., Frank, U.: RiskM: A multi-perspective modeling method for IT risk assessment. Information Systems Frontiers, 1–17 (2010)
Suriadi, S., Weiß, B., Winkelmann, A., ter Hofstede, A., Wynn, M., Ouyang, C., Adams, M.J., Conforti, R., Fidge, C., La Rosa, M., Pika, A.: Current research in risk-aware business process management - overview, comparison, and gap analysis. QUT ePrints 50606 (2012)
Tan, K., Crampton, J., Gunter, C.A.: The consistency of task-based authorization constraints in workflow. In: Proc. of IEEE CSFW, pp. 155–169 (June 2004)
Tjoa, S., Jakoubi, S., Goluch, G., Kitzler, G., Goluch, S., Quirchmayr, G.: A formal approach enabling risk-aware business process modeling and simulation. IEEE TSC 4(2) (2011)
Voluntary Interindustry Commerce Solutions Association. Voluntary Inter-industry Commerce Standard (VICS), http://www.vics.org (accessed: June 2011)
Warner, J., Atluri, V.: Inter-instance authorization constraints for secure workflow management. In: Proc. of SACMAT, pp. 190–199. ACM, New York (2006)
Weber, B., Wild, W., Feige, U.: CBRFlow: Enabling Adaptive Workflow Management Through Conversational Case-Based Reasoning. In: Funk, P., González Calero, P.A. (eds.) ECCBR 2004. LNCS (LNAI), vol. 3155, pp. 434–448. Springer, Heidelberg (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Conforti, R., ter Hofstede, A.H.M., La Rosa, M., Adams, M. (2012). Automated Risk Mitigation in Business Processes. In: Meersman, R., et al. On the Move to Meaningful Internet Systems: OTM 2012. OTM 2012. Lecture Notes in Computer Science, vol 7565. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-33606-5_14
Download citation
DOI: https://doi.org/10.1007/978-3-642-33606-5_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-33605-8
Online ISBN: 978-3-642-33606-5
eBook Packages: Computer ScienceComputer Science (R0)