On Risk Management in Business Process Design

With the development of technologies such as Business Process Execution Language (BPEL), a business-process centric approach to design of information systems has emerged. This approach calls for the modeling and analysis of the business process— both to document it as well as to analyze its risk characteristics – specifically, the risk of errors in the data produced by the process. This focus on risk has been driven by recent legislative mandates such as the Sarbanes Oxley Act. Using a graphical model of a business process, we develop a probabilistic approach to assess the risk of errors in the data produced by a business process. We propose an optimization-based method to determine cost-effective ways of embedding controls – procedures that mitigate such risk – in a business process to meet desired risk thresholds. The method lends itself to implementation within process modeling workbenches offered by leading software vendors. We illustrate our work through the case of order fulfillment process in a functioning, online pharmacy.