Artificial Intelligence and Law

, Volume 26, Issue 3, pp 251–305 | Cite as

Norms modeling constructs of business process compliance management frameworks: a conceptual evaluation

  • Mustafa HashmiEmail author
  • Guido Governatori


The effectiveness of a compliance management framework (CMF) can be guaranteed only if the framework is based on sound conceptual and formal foundations. In particular, the formal language used in the CMF is able to expressively represent the specifications of normative requirements (hereafter, norms) that impose constraints on various activities of a business process. However, if the language used lacks expressiveness and the modelling constructs proposed in the CMF are not able to properly represent different types of norms, it can significantly impede the reliability of the compliance results produced by the CMF. This paper investigates whether existing CMFs are able to provide reasoning and modeling support for various types of normative requirements by evaluating the conceptual foundations of the modeling constructs that existing CMFs use to represent a specific type of norm. The evaluation results portray somewhat a bleak picture of the state-of-the-affairs when it comes to represent norms as none of the existing CMFs is able to provide a comprehensive reasoning and modeling support. Also, it points to the shortcomings of the CMFs and emphasises exigent need of new modeling languages with sound theoretical and formal foundations for representing legal norms.


Norms Compliance Business processes Modelling constructs Modelling languages Compliance management frameworks 



This is a revised and extended version of AP-BPM 2013 paper (Hashmi and Governatori, 2013). We thank Ho-Pun Lam and Régis Riveret for their valuable comments on the draft of this paper.


  1. Abdullah NS, Sadiq S, Indulska M (2010) Emerging challenges in information systems research for regulatory compliance management. In: Proceedings of the 22nd international conference on advanced information systems engineering. CAiSE’10. Springer, pp 251–265Google Scholar
  2. Allaire M, Governatori G (2014) On the equivalence of defeasible deontic logic and temporal defeasible logic. In: Dam H, Pitt J, Xu Y, Governatori G, Ito T (eds) PRIMA 2014: principles and practice of multi-agent systems, vol 8861. LNCS. Springer, pp 74–90. doi: 10.1007/978-3-319-13191-7_7
  3. Antoniou G, Billington D, Governatori G, Maher MJ (2001) Representation results for defeasible logic. ACM Trans Comput Log 2(2):255–287. doi: 10.1145/371316.371517 MathSciNetCrossRefzbMATHGoogle Scholar
  4. Arbab F (2004) REO: a channel-based coordination model for component composition. Math Struct Comput Sci 14(3):329–366MathSciNetCrossRefzbMATHGoogle Scholar
  5. Awad A (2007) BPMN-Q: a language to query business processes. In: Enterprise modelling and information systems architectures—concepts and applications: proceedings of the 2nd international workshop on enterprise modelling and information systems architectures (EMISA’07). St. Goar, Germany, 8–9 Oct 2007, pp 115–128Google Scholar
  6. Awad A (2010) A compliance management framework for business process models. Ph.D. thesis, Hasso Plattner Institute, Potsdam University, GermanyGoogle Scholar
  7. Awad A, Weidlich M, Weske M (2011) Visually specifying compliance rules and explaining their violations for business processes. J Vis Lang Comput 22(1):30–55CrossRefGoogle Scholar
  8. Awad A, Decker G, Weske M (2008) Efficient compliance checking using BPMN-Q and temporal logic. In: BPM. LNCS. Springer, pp 326–341Google Scholar
  9. Awad A, Polyvyanyy A, Weske M (2008) Semantic querying of business process models. In: 12th international IEEE on enterprise distributed object computing conference, 2008. EDOC ’08, pp 85–94. doi: 10.1109/EDOC.2008.11
  10. Awad A, Weske M (2009) Visualisation of compliance violations in business process models. In: 5th workshop on business process intelligence, vol 9, pp 182–193Google Scholar
  11. Bandara W, Miskon S, Fielt E (2011) A systematic, tool-supported method for conducting literature reviews in information systems. In: Virpi T, Joe N, Matti R, Wael S (eds) Proceedings of 19th European conference on information systems. ECIS 2011, HelsinkiGoogle Scholar
  12. Baral C, Zhao J (2007) Non-monotonic temporal logics for goal specification. In: Proceedings of the 20th international joint conference on artificial intelligence (IJCAI 2007). Morgan Kaufmann Publishers Inc, pp 236–242Google Scholar
  13. BCBS (2013) Basel III: the liquidity coverage ratio and liquidity risk monitoring tools.
  14. Becker M, Laue R (2012) A comparative survey of business process similarity measures. Comput Ind 63(2):148–167CrossRefGoogle Scholar
  15. Becker J, Delfmann P, Eggert M, Schwittay S (2012) Generalizability and applicability of model-based business process compliance-checking approaches—a state-of-the-art analysis and research roadmap. BuR Bus Res J 5(2):221–247CrossRefGoogle Scholar
  16. Bonatti PA, Shahmehri N, Duma C, Olmedilla D, Nejdl W, Baldoni M, Baroglio C, Martelli A, Coraggio P, Antoniou G, Peer J, Fuchs NE (2004) Rule-based policy specification: state of the art and future work. REWERSE Project Report-i2-D1. Report, Universitá di Napoli Fedrecio IIGoogle Scholar
  17. Cabannilas C, Resinas M, Ruiz-Cortes A (2010) Hints on how to face business process compliance. In: III Taller de Procesos de Negocio e Ingenieria de Servicios PNIS10 in JISBD10, vol 4, pp 26–32Google Scholar
  18. Croitoru M, Oren N, Miles S, Luck M (2012) Graphical norms via conceptual graphs. Knowl Based Syst 29:31–43CrossRefGoogle Scholar
  19. Daniel F, Casati F, D’Andrea V, Mulo E, Zdun U, Dustdar S, Strauch S, Schumm D, Leymann F, Sebahi S, de Marchi F, Hacid MS (2009) Business compliance governance in service-oriented architectures. In: International conference on advanced information networking and applications, 2009. AINA ’09, pp 113 –120Google Scholar
  20. Dwyer M, Avrunin G, Corbett J (1999) Patterns in property specifications for finite-state verification. In: Proceedings of the 1999 international conference on software engineering, 1999, pp 411–420Google Scholar
  21. El Kharbili M (2012) business process regulatory compliance management solution frameworks: a comparative evaluation. In: APCCM 2012, CRPIT 130, pp 23–32Google Scholar
  22. Elgammal AFSA (2012) Towards a comprehensive framework for business process compliance. Ph.D. thesis, Tiburg University.
  23. Elgammal A, Turetken O, van den Heuvel WJ, Papazoglou M (2011) On the formal specification of regulatory compliance: a comparative analysis. In: Proceedings of ICSOC’10, pp 27–38Google Scholar
  24. Elgammal A, Turetken O, Heuvel WJ, Papazoglou M (2014) Formalizing and applying compliance patterns for business process compliance. Softw Syst Model 15(1):119–146. doi: 10.1007/s10270-014-0395-3 CrossRefGoogle Scholar
  25. Elgammal A, Türetken O, van den Heuvel WJ, Papazoglou MP (2010) Root-cause analysis of design-time compliance violations on the basis of property patterns. In: ICSOC, pp 17–31Google Scholar
  26. FATF (2017) The FATF recommendations: international standards on combating money laundering and the financing of terrorism and proliferation.
  27. Figl K, Mandling J, Strembeck M (2009) Towards a usability assessment of process modelling languages. In: Markus N, Rump F, Jan M, Nick G (eds) Geschftsprozessmanagement mit Ereignisgesteuerten Prozessketten (EPK 2009), Ceur workshop proceedings, vol 554, pp 138–156
  28. Fongon P, Grillo K (2004) Corporate implications of Sarbanes Oxley Act: a public policy.
  29. Ghose A, Koliadis G (2007) Auditing business process compliance. In: Krämer B, Lin KJ, Narasimhan P (eds) Service-oriented computing (ICSOC 2007), vol 4749. LNCS. Springer, pp 169–180Google Scholar
  30. Giblin C, Liu AY, Müller S, Pfitzmann B, Zhou X (2005) Regulations expressed as logical models (REALM). In: Proceeding of the 18th annual conference on legal knowledge and information systems (JURIX 2005). IOS Press, pp 37–48Google Scholar
  31. Goedertier S, Vanthienen J (2006) Compliant and flexible business processes with business rules. In: BPMDS, vol 236. CEUR workshop proceedings, CEUR-WS.orgGoogle Scholar
  32. Goedertier S, Vanthienen J (2006) Designing compliant business processes with obligations and permissions. In: Eder J, Dustdar S (eds) Business process management workshops 2006. LNCS 4103. Springer, pp 5–14Google Scholar
  33. Governatori G (2015) Thou shalt is not you will. In: Atkinson K (ed) Proceedings of the fifteenth international conference on artificial intelligence and law. ACM, New YorkGoogle Scholar
  34. Governatori G (2005) Representing business contracts in RuleML. Int J Cooper Inf Syst 14(2–3):181–216CrossRefGoogle Scholar
  35. Governatori G, Rotolo A (2006) Logic of violations: a Gentzen system for reasoning with contrary-to-duty obligation. Australas J Log 4:193–215MathSciNetzbMATHGoogle Scholar
  36. Governatori G, Hashmi M (2015) No time for compliance. In: Proceedings of 19th IEEE the enterprise computing conference (EDOC’15)Google Scholar
  37. Governatori G, Milosevic Z, Sadiq S (2006) Compliance checking between business processes and business contracts. In: 10th international enterprise distributed object computing conference (EDOC 2006). IEEE Computing Society, pp 221–232Google Scholar
  38. Governatori G, Rotolo A (2010) A conceptually rich model of business process compliance. In: Proceedings of APCCM ’10, vol 110, pp 3–12Google Scholar
  39. Governatori G, Sadiq S (2009) The journey to business process compliance. In: Cardoso J, van der Aalst W (ed) Handbook of research on business process management, Chap 20. IGI Global, pp 426–454. doi: 10.4018/978-1-60566-288-6.ch020
  40. Hashmi M, Governatori G, Wynn MT (2016) Normative requirements for regulatory compliance: an abstract formal framework. Inf Syst Frontiers 18(3):429–455. doi: 10.1007/s10796-015-9558-1 CrossRefGoogle Scholar
  41. Hashmi M, Governatori G, Wynn MT (2012) Business process data compliance. In: Proceedings of 6th international symposium. RuleML 2012, Montpellier, pp 32–46Google Scholar
  42. Hashmi M, Governatori G, Wynn MT (2013) Normative requirements for business process compliance. In: Proceedings of 3rd symposium (ASSRI’13) on service research and innovation, Sydney, pp 100–116Google Scholar
  43. Hashmi M, Governatori G, Wynn MT (2014) Modeling obligations with event-calculus. In: Proceedings of 8th international symposium. RuleML 2014, Prague,, pp 296–310Google Scholar
  44. Herrestad H (1991) Norms and formalization. In: Proceedings of ICAIL 1991, pp 175–184Google Scholar
  45. Hinge K, Ghose A, Koliadis G (2009) Process SEER: a tool for semantic effect annotation of business process models. In: EDOC ’09. IEEE international, pp 54–63Google Scholar
  46. HIPAA TUG (1996) The US Health Insurance Portability and Accountability Act of 1996Google Scholar
  47. IFRS (2014) IFRS 7 international financial reporting standards: financial instruments disclosures.
  48. Ingolfo S, Jureta I, Siena A, Perini A, Susi A (2014) Nmos 3: legal compliance of roles and requirements. In: Yu E, Dobbie G, Jarke M, Purao S (eds) Conceptual modeling, vol 8824. Lecture Notes in Computer Science. Springer, pp 275–288Google Scholar
  49. Johansson LO, Wärja M, Carlsson S (2012) An evaluation of business process model techniques, using Moody’s quality criterion for a good diagram. In: BIR12, vol 963. CEUR workshop proceedings, CEUR-WS.orgGoogle Scholar
  50. Karagiannis D (2008) A business process-based modeling extension for regulatory compliance. In: Multikonferenz WirtschaftsinformatikGoogle Scholar
  51. Kaźmierczak P, Pedersen T, Ågotnes T (2012) NORMC: a norm compliance temporal logic model checker. In: STAIRS 2012 - Proceedings of the sixth starting AI researchers’ symposium, Montpellier, France, 27–28 August 2012, vol 241. IOS Press, pp 168–179. doi: 10.3233/978-1-61499-096-3-168
  52. Lu R, Sadiq S (2007) A survey of comparative business process modeling approaches. In: Abramowicz W (ed) Business information systems, vol 4439. LNCS. Springer, Heidelberg, pp 82–94CrossRefGoogle Scholar
  53. Lu R, Sadiq S, Governatori G (2007) Compliance aware business process design. In: 3rd international workshop on business process design (BPD’07). Springer, pp 120–131Google Scholar
  54. Ly LT, Knuplesch D, Rinderle-Ma S, Goeser K, Reichert M, Dadam P (2010) SeaFlows toolset—compliance verification made easy. In: CAiSE’10 DemosGoogle Scholar
  55. Ly LT, Maggi FM, Montali M, Rinderle S, van der Aalst W (2013) A framework for the systematic comparison and evaluation of compliance monitoring approaches. In: Proceeding of EDOCGoogle Scholar
  56. Ly L, Rinderle-Ma S, Dadam P (2010) Design and verification of instantiable compliance rule graphs in process-aware information systems, vol 6051. Springer, Berlin, pp 9–23. doi: 10.1007/978-3-642-13094-6_3 Google Scholar
  57. Ly LT, Rinderle-Ma S, Göser K, Dadam P (2012) On enabling integrated process compliance with semantic constraints in process management systems. Inf Syst Frontiers 14(2):195–219CrossRefGoogle Scholar
  58. Ly LT, Maggi FM, Montali M, Rinderle S, van der Aalst W (2015) Compliance monitoring in business processes: functionalities, application, and tool-support. Inf Syst. doi: 10.1016/ Google Scholar
  59. Ly L, Rinderle-Ma S, Knuplesch D, Dadam P (2011) Monitoring business process compliance using compliance rule graphs. In: Meersman R, Dillon T, Herrero P, Kumar A, Reichert M, Qing L, Ooi BC, Damiani E, Schmidt D, White J, Hauswirth M, Hitzler P, Mohania M (eds) On the move to meaningful internet systems: OTM 2011, vol 7044. LNCS. Springer, Berlin, pp 82–99Google Scholar
  60. Maggi F, Montali M, Westergaard M, van der Aalst W (2011) Monitoring business constraints with linear temporal logic: an approach based on colored automata. In: BPM. LNCS 6896. Springer, pp 132–147Google Scholar
  61. Maggi F, Westergaard M, Montali M, van der Aalst W (2011) Runtime verification of LTL-based declarative process models. In: Proceedings of RV. LNCS. SpringerGoogle Scholar
  62. Makinson D, van der Torre L (2003) Permission from an input/output perspective. J Philos Log 32(4):391–416MathSciNetCrossRefzbMATHGoogle Scholar
  63. MASTER (2008) Managing assurance, security, and trust for services. FP7-ICT integrated project for secure, dependable, and trusted infrastructuresGoogle Scholar
  64. McIntyre SR (2008) Integrated governance, risk and compliance: improve performance and enhance productivity in federal agencies. Technical report, PricewaterhouseCoopersGoogle Scholar
  65. Mili H, Tremblay G, Jaoude GB, Lefebvre E, Elabed L, Boussaidi GE (2010) Business process modeling languages: sorting through the alphabet soup. ACM Comput Surv 43(1):1–56. doi: 10.1145/1824795.1824799 CrossRefGoogle Scholar
  66. Montali M (2010) Specification and verification of declarative open interaction models: a logic-based approach, vol 56. LNBIP. Springer, BerlinzbMATHGoogle Scholar
  67. Montali M, Pesic M, van der Aalst WMP, Chesani F, Mello P, Storari S (2010) Declarative specification and verification of service choreographiess. ACM Trans Web 4(1):3:1–3:62CrossRefGoogle Scholar
  68. Olivieri F (2014) Compliance by design. Synthesis of business processes by declarative specifications. Ph.D., Dipartimento di Informatica, Università digli Studi di Verona, Italy and Institute for Integrated and Intelligent Systems, Griffith University, AustraliaGoogle Scholar
  69. Otto P, Anton A (2007) Addressing Legal requirements in requirements engineering. In: 15th IEEE international on requirements engineering conference, 2007. RE ’07, pp 5–14Google Scholar
  70. Palmirani M, Governatori G, Contissa G (2011) Modelling temporal legal rules. In: Proceedings of the 13th international conference on artificial intelligence and law (ICAIL 2011). ACM PressGoogle Scholar
  71. Pesic M, Schonenberg H, van der Aalst W (2007) DECLARE: full support for loosely-structured processes. In: Proceedings of 11th IEEE international conference on enterprise distributed object computing (EDOC’07), pp 287–287Google Scholar
  72. Pesic M, van der Aalst W (2006) A declarative approach for flexible business processes management. In: BPM workshops, vol 4103. LNCS. Springer, pp 169–180Google Scholar
  73. Ramezani E, Fahland D, van der Werf J, Mattheis P (2012) Separating compliance management and business process management. In: Daniel F, Barkaoui K, Dustdar S (eds) Business process management workshops, vol 100. LNBIP. Springer, Berlin, pp 459–464. doi: 10.1007/978-3-642-28115-0_43 CrossRefGoogle Scholar
  74. Ramezani E, Fahland D, van der Aalst W (2012) Where did i misbehave? Diagnostic information in compliance checking. In: Proceedings of business process management, pp 262–278Google Scholar
  75. Ramezani E, Fahland D, van Dongen BF, van der Aalst W (2013) Diagnostic information for compliance checking of temporal compliance requirements. In: CAiSE, pp 304–320Google Scholar
  76. Rieke R, Repp J, Zhdanova M, Eichler J (2014) Monitoring security compliance of critical processes. In: 2014 22nd Euromicro international conference on parallel, distributed and network-based processing (PDP), pp 552–560Google Scholar
  77. Sadiq S, Governatori G (2015) Managing regulatory compliance in business processes. In: vom Brocke J, Rosemann M (eds) Handbook of business process management, vol 2, 2nd edn. International handbooks on information systems. Springer, Berlin, pp 265–288Google Scholar
  78. Sadiq S, Governatori G, Namiri K (2007) Modeling control objectives for business process compliance. In: Proceedings of BPM’07. Springer, pp 149–164Google Scholar
  79. Sartor G (2005) Legal reasoning: a cognitive approach to the law. Springer, BerlinGoogle Scholar
  80. SCBS (2004) BASEL II accord - International convergence of capital measurement and capital standards: a revised framework.
  81. Schumm D, Turetken O, Kokash N, Elgammal A, Leymann F, Heuvel WJVD (2010) Business process compliance through reusable units of compliant processes. In: Proceedings of international conference on current trends in web engineeringGoogle Scholar
  82. Türetken O, Elgammal A, van den Heuvel WJ, Papazoglou M (2012) Capturing compliance requirements: a pattern-based approach. Softw IEEE 29(3):28–36. doi: 10.1109/MS.2012.45 CrossRefGoogle Scholar
  83. Türetken O, Elgammal A, van den Heuvel WJ, Papazoglou M (2011) Enforcing compliance on business processes through the use of patterns. In: Proceeding of European conference on information system.
  84. Turki S, Bjekovic-Obradovic M (2010) Compliance in e-government service engineering: state-of-the-art. In: Exploring services science. LNBIP. Springer, pp 270–275Google Scholar
  85. US-Government (2002) Public Company Accounting Reforms and Investor Protection Act (Sarbanes-Oxley Act). Public Law 107-204, 116 Stat. 745Google Scholar
  86. van der Aalst W, Pesic M, Schonenberg H (2009) Declarative workflows: balancing between flexibility and support. Comput Sci Res Dev 23:99–113CrossRefGoogle Scholar
  87. van der Aalst W, ter Hofstede A, Kiepuszewski B, Barros A (2002) Workflow patterns. QUT Technical report. FIT-TR-2002-02, Queensland University of Technology, Brisbane, Australia.

Copyright information

© Springer Science+Business Media B.V. 2017

Authors and Affiliations

  1. 1.Data61CSIROBrisbaneAustralia

Personalised recommendations