Richard Cull A BEST PRACTICE METHODOLOGY FOR COMPLIANCE-DRIVEN BPM PROJECTS

Transcription

1 Richard Cull A BEST PRACTICE METHODOLOGY FOR COMPLIANCE-DRIVEN BPM PROJECTS Since the introduction of the Sarbanes-Oxley Act (SOX) of 2002 there has been much greater pressure on businesses to rethink the way their processes are managed. The documentation, automation and testing of controls is possibly the most expensive and time consuming aspect of SOX compliance. One of the main areas that have been impacted is IT. A prevalent method of developing controlled and compliant business processes is the use of Business Process Management Software to automate them. However as this is still an emerging concept and is not understood as well as others, it is often designed and implemented incorrectly or inefficiently. The goal of this research is to investigate the issues concerning BPM Projects and define a best practice methodology for migrating processes onto BPM software. 1. INTRODUCTION: The tendency for businesses to turn to Business Process Management (BPM) solutions is now wide-spread. One aspect of BPM which is not shared between such projects is the drivers behind them. Armistead (1996) states the drivers which demand change are; customer focus, responsiveness, reduction in lead-time and reducing costs; and moreover, improving these factors simultaneously. The idea of reduction in lead-time is possibly the most common of these however; changing legislative climate has created new drivers which are becoming evermore popular. The introduction of the Sarbanes-Oxley Act of 2002 means that businesses who are affected by it are required to analyse and document their internal controls in a more detailed way than ever before. Rausch (2006) identified the need to integrate both compliance management and business process management. In any legislation-driven BPM project it is important to ensure that both compliance and lead-time are managed effectively due to the relationship between the two. Compliance is often seen as having a negative effect on lead-time and trying to reduce lead-time is often detrimental to Richard Cull 1

2 compliance. The goal of this research is to propose a framework for guiding compliance-driven BPM projects, 2. RESEARCH PROBLEM The Business Process Management Lifecycle (zur Muehlen and Ho 2006) identifies organisational analysis and modelling as two key stages of the BPM process. These two stages are the basis of the BPM project, and the information generated here will become the foundation and reference point for the development of the solution. The first stage, Organisational Analysis, is about goal specification and environmental analysis. It is here that the project mission should be identified and the ideal outcome of the project is created. The second stage, Specification and Modelling, is where the business processes are modelled using a semi-formal modelling notation. This model becomes the reference point for key users, business analysts, developers and end-users as the process is redesigned. The problem is that the majority of existing methodologies within the literature for BPM projects are focused on more traditionally driven projects and so companies who must exist in a compliant environment must adapt existing practices to suit their own needs. Richard Cull 2

3 Figure 1. - The Business Process Management Lifecycle (zur Muehlen and Ho 2006) The main issues arising from the lack of a formal compliance-driven BPM methodology are a lack of selection metrics based on environmental analysis and the lack of a modelling notation which models compliance issues as well as traditional issues such as inefficiencies. Identifying which processes should become BPM projects in compliance-driven companies is something which has not received any attention in literature. There are more criteria involved in the decision to undertake a BPM project when legislation is involved. Traditional criteria such as efficiency potential and reduction in lead-time are still relevant but must be prioritised against compliance-led criteria such as error rates or audit failures. Certain modelling techniques have grown prevalent within the subject of BPM. Business Process Management Notation (BPMN), Unified Modelling Language (UML) and Integrated Definition Models (IDEF) are the most popular notations in industry (according to research conducted with a leading BPM software vendor). Other notations such as Role Activity Diagrams and Petri Nets have Richard Cull 3

4 undergone much research but have not been widely adopted in business practice despite the benefits these notations offer us. Because there are many motivations behind BPM projects themselves, the motivation behind the model will also vary. The majority of modelling notations can be categorised into three perspectives: informational, behavioural and object-oriented. Informational models concern themselves with information flow and the idea of conceptual tokens representing items of work which are passed from one task to another. Behavioural models represent the behaviour of the process and its components such as changes in state, interactions between functions and aspects of time. Object-Oriented modelling documents the data and entities involved in the process and the relationships between them. Depending upon the motivation behind the model a different perspective will be required. Compliance-driven BPM projects will need to be modelled in such a manner that both the informational and behavioural perspectives of the process are adequately modelled. Unfortunately no such technique has yet been accepted into business practice. Role Activity Diagrams were created in an attempt to bridge this gap but, despite emerging research into the technique, its notation was seen as too complex by business users. The majority of the most frequently used notations concentrate on what people do instead of how they do it and show what should happen rather than what does. 3. RESEARCH METHODOLOGY The research was based at a company in the construction and mining equipment industry whose market was world wide. As the company was listed on the New York Stock Exchange they were forced to comply with the Sarbanes-Oxley Act of This forced the organisation into a full review of all of their business processes meaning that, in the short term, efficiency and costs would have to rise. The organisation chose to view this as an opportunity rather than a threat and installed a Workflow Management System to automate their business processes. The goal of the project was to emerge from the review before their competitors in a more flexible and efficient manner than they were before. The company brief stated the impact of SOX was the compliant processes are cumbersome and labour intensive to operate, and as such represent a risk to the longer term competitiveness of the company. As the company had little experience in this kind of work they Richard Cull 4

5 arbitrarily decided on the tools they would use based on the popularity of the theory. The end result was that unsuitable processes were selected and mapped using a notation that was not suited to the goal of the project. The company identified the need for a new strategy and came up with the following mission statement: Develop and establish a best practice implementation strategy to enable migration of core business processes onto Business Process Management software to enforce Sarbanes-Oxley act compliance. The research was initially conducted in a series of action research sessions which were held throughout the business, studying users at all levels of the organisational structure from directors to the lowest level of the hierarchy. These sessions were used to gather data on users perceptions based on their experience and background. This arbitrary data helped identify evaluation metrics for existing tools. Following these sessions available techniques within the literature were reviewed as to their suitability according to the results of the initial action research. Further action research was held with business users following the proposal of the new methodology. 4. TECHNICAL PROPOSAL The first step was to implement a project selection framework. As stated earlier, the most common drivers behind BPM projects are concepts of efficiency or reduction in lead-time however; in compliance-driven projects there are more factors which must be considered. The increase in risk means that prioritisation of criteria is essential. The framework that is proposed is a variant of the Analytic Hierarchy Process (AHP) by Thomas Saaty (1994). AHP was chosen for investigation because it is the most popular selection process available in the literature. Richard Cull 5

6 Table 1. Selection Process applied to five company partner processes The company in the research had already tried to implement AHP before this project started and came across problems similar to those stated by French (1988). The main problem was the issue of its inflexibility. The company wanted to continually update a decision-matrix which would compare processes against a set of criteria and prioritise them. AHP is known to cause a phenomenon called rank reversal when it is reused or updated. If another criterion is added to the decision matrix it can polarise the priorities, making previous decisions redundant. The AHP was modified to remove the final paired comparison stage so rank reversal would not become an issue and each process would be prioritised against other potential project. The results of this can be found in table 1. The second part of the project was to implement a process modelling notation that could be used to integrate compliance into the business process management lifecycle. First action research was undertaken at the company to identify users expectations Richard Cull 6

7 and perceptions of process modelling. Users across the organisation were asked to create a process model based on how they expected it to look. The results were gathered with the aim of identifying trends and commonalities between users perceptions of what a model should look like. The results helped identify a set of modelling notations which could potentially be useful. The methodologies chosen for the next phase of research were Business Process Modelling Notation (White 2004), UML Activity Diagrams (Bell 2003), Integrated DEFinition-models 3 (Mayer et al 1995), Activity Cycle Diagrams (Paul and Balmer 1998) and Role Activity Diagrams (Ould 2005). Each of these methodologies is aimed at serving a different purpose. Some are informational models and some are behavioural ones. Further research found that none of these notations could adequately model a process in a compliancedriven project and so the decision was taken to build a hybrid methodology composing the most effective parts of the above notations. Another action research session requested that users rank BPMN, Activity Diagrams, Role Activity Diagrams, IDEF3, activity cycle diagrams and the hybrid notation. The results of this research indicated that hybrid was most preferred at the company. The results of this research can be found in table 2. The decision was made to implement the notation which has now been applied to several processes and the projects have received considerable reductions in project lead time. The basic notation is described in table 3 and example of its application can be found in figure 2. Table 2 IDEF3 4 Role Activity Diagram 4 Activity Diagram 6 Hybrid 25 Activity Cycle Diagram 4 Business Process Diagram 17 Results of Action Research project phase 2 at company partner Richard Cull 7

8 Table 3 Basic Hybrid Modelling notation Richard Cull 8

9 Figure 2. - Hybrid Notation applied to company partner process 5. CONCLUSIONS AND FURTHER WORK This paper proposed the foundations of a framework for compliance-driven BPM projects. The framework was created based on the needs and requirements of a major company. Within this framework there is an AHP-based selection process for identifying and prioritising a set of potential projects. Currently, the company has employed the selection framework to prioritise its potential projects and produce a process roadmap. The value added by the selection process has not yet been evaluated as it is too soon to realise the benefits of its use. The next phase of this part of the project will be to monitor and evaluate the success of the process roadmap and in turn the selection process. The second element of the framework was a hybrid notation for modelling compliance-based business processes. The notation s objectives are to model a given process at an informational and behavioural process-level, thus capturing all of the required elements. The notation has been deployed within the company partner during Richard Cull 9

10 many successful projects and is currently being revised to cover more potential workflow constructs and expand its notation. Other potential research projects arising from this includes the development of an executable modelling language which is supported by the hybrid notation so that the process-level model can be translated into an executable workflow or simulation model. Richard Cull 10

11 1. Lu, R., Sadiq, R.W. (2007). A Survey of Comparative Business Process Modelling Approaches. BIS 2007: Rausch, T. (2006). Holistic Business Process and Compliance Management. Conference for Systems Integration 3. zur Muehlen, M., Ho, D.T. (2006). Risk Management in the BPM Lifecycle. In Proc. Business Process Management Workshops (BPM2005), LCNS, Vol (2006) Saaty, T.L. (1994), How to make a decision: the analytic hierarchy process, Interfaces, Vol. 24 No.6, pp French, S. (1988) Decision Theory: an Introduction to the Mathematics of Rationality, Ellis Horwood, Chichester 6. White, Stephen A. (2004). Introduction to BPMN, IBM Corporation Find at: (Checked 18/02/09) 7. Bell, Donald. (2003). UML Basic Part II: The Activity Diagram, Rational Software Find at: pdf (Checked 18/02/09) 8. Ould, Martyn A. (2005), Business Process Management: A Rigorous Approach, The British Computer Society 9. Paul, Ray, Balmer, David. (1998), Simulation Modelling, Brunel University 10. Mayer, Richard J. Cullinane, Thomas P. de Witte, Paula S. Knappenberger, William B. Perakath, Benjamin M. (1995). Information Integration for Concurrent Engineering (IICE) IDEF3 Process Description Capture Method Report. Knowledge Based System Inc. Richard Cull 11