Towards Legal Knowledge Management Systems for Regulatory Compliance

Transcription

1 Towards Legal Knowledge Management Systems for Regulatory Compliance Guido Boella 1, Joris Hulstijn 2, Llio Humphreys 1,3, Marijn Janssen 2, and Leendert van der Torre 3 1 Università di Torino, Italy guido@di.unito.it, lliobh@gmail.com 2 Delft University of Technology, Netherlands j.hulstijn@tudelft.nl 3 University of Luxembourg, Luxembourg leon.vandertorre@uni.lu Abstract. The burden of maintaining regulatory compliance is increasingly becoming a concern. Current ICT support is unsatisfactory. Compliance management systems could support the work of compliance managers. However, there are challenges to overcome: processing legal documents and expressing the knowledge they contain, and relating the legal prescriptions to the organization s business processes. In this paper we present an approach to handle these challenges. The approach consists of four pillars: (1) Legal ontology expressing the legal concepts that are central to the rules and regulations (2) Method to semi-automatically populate the ontology, (3) Method of mapping the legal concepts onto the actual data and business processes of a company (4) Method to buildin an audit trail, providing legally acceptable evidence of compliance. 1 Introduction Every organization has to deal with operational risks: the risks arising from the execution of a company s primary business functions. Operational risks include monetary loss, fraud, physical or environmental risks, risks related to human resources, and so forth. Risk Management departments typically collect and assess data for each risk in order to make management decisions, increasingly also using ICT support. For one type of risk there is a lack of adequate ICT support: regulatory compliance. With the advent of the financial crisis the costs associated with managing regulatory compliance are becoming increasing concern [13]. Large enterprises such as banks and insurance companies are increasingly being subjected to regulations. The risks of failure to comply with regulations are increasing in volume and complexity. There is increasing awareness in the compliance world that information systems can play a larger role in improving compliance. Most attention has been devoted to the prevention side. Focus on prevention leads to an approach called compliance by design [15]: business processes and supporting information systems are designed in such a way that conducting undesirable behavior is made

2 2 difficult or impossible. Such specification can then be verified to be formally correct. However, compliance is not just about the design and verification of processes. It involves a whole life-cyle of processes, see e.g. the COMPAS project [22]. Here, we highlight three aspects: (i) Monitoring new laws and regulations to keep an up-to-date repository of legal prescriptions relevant to the operation. (ii) Ensuring that business processes are indeed compliant with legal requirements, derived from these current legal prescriptions. (iii) Creating an audit trail that demonstrates that compliant business processes have been followed in practice. Regulatory compliance management systems could potentially be developed to support the work of compliance managers, during each of these activities. However, at the moment, compliance officers are reluctant to use ICT support systems. We believe current systems are inadequate, because of the huge challenges of processing legal documents and mapping the concepts they contain onto the organization s actual business processes. Current approaches to compliance support present four challenges: (1) ICT systems that model the law and legal concepts tend to extract norms and terminology directly from the letter of legislative sources without taking the legal interpretation process into account, e.g [17, 8]. (2) State of the art legal knowledge management systems rely almost entirely on manual population of specialist ontologies, which is not only inefficient but impractical. It is difficult to find knowledge engineers with the right interdisciplinary competences, i.e., expertise in both formal ontologies and law [13]. In addition, a large enterprise will have hundreds of processes each with hundreds of activities and states. This leads to a resource bottleneck. (3) It is difficult to find connections between norms expressed in legal ontologies and business processes, because the two worlds do not share a common terminology. Moreover, the context in which legal concepts are applied needs to be interpreted [2]. (4) Current approaches neglect the need for an audit trail to be built into the business processes, to provide reliable evidence of compliance [20]. In addition, risk management, compliance monitoring and auditing have traditionally all been conducted in separate departments, preventing a holistic and integrated approach to compliance also at the level of ICT support. In this paper we will describe the general contours of an approach to develop legal knowledge management systems that can face these challenges. The approach is called LeKMaS (Legal Knowledge Management Systems). It applies natural language processing techniques to decrease the resource bottleneck problem in ontology management and to facilitate mapping legal concepts onto processes and vice versa. It uses argumentation theory to determine which legal evidence to collect and retain and in which format. The purpose is to develop modules that support a holistic approach to compliance, ensuring synergy between law, business processes and auditing. The approach consists of four pillars: (1) Legal ontology expressing the legal concepts that are central to the rules and regulations (2) Method to semiautomatically populate the ontology, (3) Method of mapping the legal concepts

3 3 onto the actual data and business processes of a company (4) Method to build-in an audit trail, providing legally acceptable evidence of compliance. Presentation in this paper will only focus on number (1) and (4): the legal set-up of a compliance system and the required evidence. Pillars (2) and (3) will have to wait for another occasion. The remainder of this paper is structured as follows: Section 2 explains the legal ontology. Section 3 explains our approach to evidence. The paper ends with conclusions and recommendations for further research. 2 Legal Ontology Use of the right ontology is very important to our approach to understanding and representing legal content. We believe that previous work on the representation of legal content rests on false assumptions. Many technology driven approaches assume a clear-cut one-to-one mapping between legislative text and rules [17, 8]. In compliance, rules are generally the result of legal interpretation involving insights from different kinds of sources. Ontologies act as intermediaries between users and the source legislative text, helping to locate and explain the law. There is some movement to developing systems that model the complexity of the law, so that the system can support the work of lawyers and legal scholars. The authors have contributed with advanced legal document management systems [1, 6], also applied to compliance [7]. Projects such as Compas, Regnet, GRC GRID rest on simplistic assumptions which hinder the acceptability of the results for lawyers. Even if a more acceptable formalization of law is devised, there remains the problem of the resource bottleneck: the creation of formalised legal knowledge is a costly enterprise. Doing it entirely by hand is unfeasible, a problem made worse by the need to find the knowledge engineers with the right inter-disciplinary competences. Mapping laws onto processes is not a trivial task. Compliance management involves not only legal knowledge but also knowledge concerning the business processes, and we cannot assume that the two worlds share the same terminology. While every jurisdiction has its own terminology, the same can be said for organisations, whether they are formalised into ontologies or not. Semi-automated ontology extraction and mapping can play a critical role in aligning norms with the processes they govern due to the size of the data: hundreds of legal clauses and thousands of processes with hundreds of steps described in natural language. Ontologies are a methodology increasingly used to represent legal knowledge. Ontologies enable sharing and integration of data from different domains and data sources. However, they usually come from different domains, thus they are rarely identical. In particular, differences can be due to homonyms (i.e., nodes with identical concept-names, but possibly different semantics) and synonyms (concepts with different names but same semantics) [12]. For this reason, there is also the need of an alignment among distinct domains like the legal domain and the domain of business processes, which are designed by persons with different competences. The problem of semi-automatically constructing taxonomies or

4 4 ontologies from texts can be faced at different levels of granularity, starting from the discovery of domain-specific dictionaries to more complex tasks aimed at organizing the terms in some structural form [9]. This work becomes important when there is a lack of resources or dictionaries that can serve for automatic matching between processes and regulations. In general, common practices used to make probabilistic inferences about the terms contained in a corpus leverage on their frequency and their context, defined as the set of terms that often co-occur with them [14]. Further improvements on pure statistical methods rely on the use of natural language processing (NLP) technologies that can filter out data noise while maintaining high levels of accuracy. [18] defined a system for extracting definitional sentences (i.e., sentences that contain at least one hyponymy-hyperonym relationship), using them to build an IS-A graph (subsumption graph). This mined knowledge can be pruned later to form a taxonomy [19]. Such techniques have a high precision but a significantly low recall. This is what NLP approaches usually achieve in terms of accuracy levels, as opposed to statistical methods. Another issue to be addressed concerns the mapping between the processes with the prescriptions of the regulations that often follow different guidelines of production and have distinct dictionary with overlapping semantics. One has to move behind a case-oriented methodology that needs to be studied carefully. In general, the simple string matching between an ontology concept with the regulation texts does not provide accurate results because of its inefficiency to cope with the natural flexibility of the language. In that sense, the general goal to get to is to enrich the content expressed by an ontology concept with additional information from two different sources: the structural position and context within the ontology or, eventually, a set of concept-associated documents that help depict its semantics [16]. These two types of information are the basis of existing algorithms for ontology alignment, namely structurally-informed or extensionally-informed [12]. The first method takes into account the structural neighbourhood of a concept in the ontology to make more fine-grained the matching with the parts of text contained in the regulations. The clear advantage of using this technique is that it can be done in an automatic fashion without any external resource, though it still suffers from possible divergences in the used terminology. On the contrary, relying on a first, approximate, automatic classification of regulations into the ontology usually provides an initial overview of the concepts themselves that can be later used for informed matching between the two data sources [11]. 3 Establishing evidence As we argued inn to the introduction, compliance is not just about the design and verification of processes. In this section new will deal wit the third pillar: creating an audit trail that provides evidence that compliant business processes have been followed in practice. To do so, we will present a method for designing an audit trail of business processes, in such a way that the evidence thus generated can

5 be used to demonstrate later that the business process was indeed compliant to relevant laws and regulations. Obviously, we make use of the legal concepts identified in the ontology. Conceptually, the method is based on the realization that what counts as evidence of some conduct or behavior being compliant or not, is essentially a social or institutional matter; compare the notion of constitutive norms [21]. Some person in some role is authorized to make that decision, both at design time, and later when needed for convincing an auditor, settling a legal dispute or in court. This requires extending the legal ontology with the notion of roles, along the lines of [4] and with the notion of a so called constitutive norm representing the counts as relation, applying the approach developed by the partners in [5]. Evidence is a multi-faceted concept, which requires and extensive literature study. Scientific literature about reliability and evidence can be found in legal theory, e.g., but also in auditing theory, where such concepts as segregation of duties have been developed [3]. Obviously, there need to be links to the business process management community, because evidence collection will be embedded in the process. Finally, there are links to the social sciences in particular about measurement. Often, objectives of a process are stated in terms of desired outcomes, for example, a reduced financial risk for society. What is measured however is output, for instance, risk assessment reports. The art of process design is to find performance measures (outputs), which accurately approximate the actual effects (outcomes). Note that deciding the amount of evidence to be collected, is often a trade-off between collecting too much, which will make the system slow or will make it impossible to find needed evidence later, and collecting too little, which make it impossible to use the evidence later in legal proceedings. Such trade offs usually point into the direction of a risk analysis, or alternatively, to a form of argumentation [10]. Only evidence which is deemed both necessary and sufficient for demonstrating compliance objectives, needs to be collected. The method will at least address the following aspects. Stakeholder analysis. This part of the project will be approached from a sociotechnical point of view. Therefore it is crucial to know up front what the relevant stakeholders are. What parties are possibly interested in the evidence? What are these interests? How do these interests relate to the regulations and norms collected? How do these interests relate to the legal concepts in the ontology, and the corresponding boundaries for specific decisions? All these aspects will be covered in a stakeholder analysis, resulting in an overview of the common actors and roles in business process compliance and their interests. Control measures. Auditing theory contains much expertise on the establishment of a set of audit criteria or control measures for establishing reliability of data. However, what is new in this case is that the evidence is not collected for accounting purposes, but rather for regulatory compliance purposes. Moreover, we need to adapt existing techniques for the fact that a legal ontology has been used to identify the crucial concepts to be monitored. We need to take into account the business models of the various parties involved, because they may have 5

6 6 an interest in adapting the evidence in their interest. In which ways should the accuracy, completeness and timeliness of the evidence be ensured, both at the very first instance of recording, and at subsequent processing (integrity)? Which party or parties are made responsible for the evidence collection? Which control measures can be developed? Representation. Finally, we need a way of expressing the evidence in an accessible format. The format should accommodate the legal ontology. Not only the evidence itself, but also many kinds of meta-data about the evidence need to be represented. Consider for instance the provenance of the evidence (where did it come from), the date and time of collection, the responsible persons, the size, etc. There exists various XML formats; recent developments in XBRL will also be taken into account, particularly because experts are working on audit criteria for establishing reliability of XBRL documents. Delft will provide techniques for modelling legal constraints on business processes, and for defining evidence in the form of an audit trail. 4 Conclusions The costs of compliance are increasing. In particular in the financial industry, compliance officers are struggling to keep up with the ever increasing burn of new rules and regulations. There is increasing awareness in the compliance world that information systems can have a larger role in improving compliance. Most attention has been devoted to prevention. Focus on prevention leads to an approach called compliance by design [15]: business processes and supporting information systems are designed in such a way that conducting undesirable behavior is made difficult or impossible. However, from the point of view of compliance officers compliance management is not just about the design and verification of processes. It involves three pillars: (i) Monitoring laws and regulations to keep an up-to-date repository of legal prescriptions. (ii) Ensuring that business processes are indeed compliant with legal requirements, derived from these current legal prescriptions. (iii) Creating an audit trail with evidence to demonstrate that compliant business processes have been followed in practice. In this paper we have discussed an approach to the development of legal knowledge management systems, called LekMAS. The approach consist of four pillars: (1) the use of a legal ontology, to represent and reason with legal concepts, (2) a semi-automatic method for populating the ontology, to overcome the resource bottleneck, (3) a method for mapping legal concepts and prescription onto business processes, and (4) a method for collecting reliable evidence of the business processes, and for auditing that they are actually compliant. In particular we have focused at (1) and (4): the set-up of the system.

7 7 References 1. Gianmaria Ajani, Leonardo Lesmo, Guido Boella, Alessandro Mazzei, and Piercarlo Rossi. Terminological and ontological analysis of european directives: multilinguism in law. In The 11th International Conference on Artificial Intelligence and Law, Proceedings of the Conference (ICAIL), pages ACM, H. Aldewereld, F. Dignum, A.Garcia Camino, P. Noriega, J.A. Rodriguez-aguilar, and C. Sierra. Operationalisation of norms for usage in electronic institutions. Coordination, Organizations, Institutions, and Norms in Agent Systems II (COIN 06), LNC1 4386: , J.H. Blokdijk. Tests of control in the audit risk model: effective? efficient? International Journal of Auditing, 8: , G. Boella, R. Damiano, J. Hulstijn, and L. van der Torre. A common ontology of agent communication languages: Modeling mental attitudes and social commitments using roles. Applied Ontology, 2(3-4): , G. Boella and L. van der Torre. Regulative and constitutive norms in normative multiagent systems. In Proceedings of 9th International Conference on the Principles of Knowledge Representation and Reasoning (KR 2004), pages AAAI Press, Menlo Park, Guido Boella, Llio Humphreys, Marco Martin, Piercarlo Rossi, and Leendert van der Torre. Eunomos, a legal document and knowledge management system to build legal services. In Proceedings of AI Approaches to the Complexity of Legal Systems Workshop (AICOL), Berlin, Springer. 7. Guido Boella, Marco Martin, Piercarlo Rossi, Leendert van der Torre, and Andrea Violato. Eunomos, a legal document and knowledge management system for regulatory compliance. In Proceedings of Information Systems: a crossroads for Organization, Management, Accounting and Engineering (ITAIS) Conference, Berlin, Springer. 8. T. D. Breaux:. Legal Requirements Acquisition for the Specification of Legally Compliant Information Systems. PhD Thesis PhD thesis, North Carolina State University, Raleigh (NC), Paul Buitelaar, Philipp Cimiano, and Bernardo Magnini, editors. Ontology Learning from Text: Methods, Evaluation and Applications, volume 123 of Frontiers in Artificial Intelligence and Applications. IOS Press, Amsterdam, Brigitte Burgemeestre, Joris Hulstijn, and Yao-Hua Tan. Value-based argumentation for justifying compliance. Artificial Intelligence and Law, 19(2-3): , K. Selçuk Candan, Luigi Di Caro, and Maria Luisa Sapino. Creating tag hierarchies for effective navigation in social media. In Proceeding of the 2008 ACM Workshop on Search in Social Media, SSM 2008, pages 75 82, K. Selçuk Candan, Mario Cataldi, Maria Luisa Sapino, and Claudio Schifanella. Structure- and extension-informed taxonomy alignment. In oceedings of the 4th International VLDB Workshop on Ontology-based Techniques for DataBases in Information Systems and Knowledge Systems, ODBIS 2008, Auckland, New Zealand, August 23, 2008, Co-located with the 34th International Conference on Very Large Data Bases, pages 1 8, Stacey English and Susannah Hammond. Cost of compliance survey Technical report, Thompson Reuters, Blaz Fortuna, Marko Grobelnik, and Dunja Mladeni. Semi-automatic data-driven ontology construction system

8 8 15. G. Governatori and S. Sadiq. The journey to business process compliance, pages IGI Global, Jong Wook Kim and K. Sel#231;uk Candan. Cp/cv: concept similarity mining without frequency information from domain describing taxonomies. In Proceedings of the 15th ACM international conference on Information and knowledge management, CIKM 06, pages , New York, NY, USA, ACM. 17. G. Lau. A Comparative Analysis Framework for Semi-Structured Documents, with Applications to Government Regulations. PhD thesis, Stanford, Roberto Navigli and Paola Velardi. Learning word-class lattices for definition and hypernym extraction. In Proceedings of the 48th Annual Meeting of the Association for Computational Linguistics, ACL 10, pages , Roberto Navigli, Paola Velardi, and Stefano Faralli. A graph-based algorithm for inducing lexical taxonomies from scratch M. B. Romney and P. J. Steinbart. Accounting Information Systems, 10e. Prentice Hall, NJ, J. R. Searle. The Construction of Social Reality. The Free Press, Patrícia Silveira, Carlos Rodríguez Aliaksandr Birukou, Fabio Casati, Florian Daniel, Vincenzo D Andrea, Claire Worledge, and Zouhair Taheri. Aiding compliance governance in service- based business processes. In S. Reiff-Marganiec and M. Tilly, editors, Handbook of Research on Service-Oriented Systems and Non- Functional Properties: Future Directions, chapter 22, pages IGI Global, S. Reiff-Marganiec, and M. Tilly, 2012.