A Formal Approach for Internal Controls Compliance in Business Processes

Regulatory compliance requirements in the area of Internal Controls such as Sarbanes Oxley Act force enterprises to identify, shape and document their business processes. In this context enterprises require mechanisms to ensure that their business processes implement and fulfill compliance requirements independently from business level requirements. In this paper we present a novel approach for the modeling and implementation of Internal Controls in business processes. The approach is based on the formal modeling of Internal Controls, thus it can serve as the basis for usage of logic mechanisms in the compliance verification process. The main idea is the introduction of a semantic layer in which the process instances are interpreted according to given control statements, without changing the original (business-goal driven) business processes.