Control Patterns - Bridging The Gap Between Is Controls And BPM

While playing an increasingly important role across various industries, the efficient management of legal and regulatory compliance requirements remains a challenge in modern organizations. Commonly, compliance is handled by separate organizational units and not well integrated with core business processes. Based on the area of information systems (IS) controls as mechanism to fulfil given requirements, this paper proposes a concept to bridge this gap between regulatory compliance and business process management. The presented concept enables linking process models with internal control systems and provides a common language for all parties involved. An approach is developed to identify and extract reusable control elements for regulatory compliance from real-world process specifications. These artefacts are formalized as “Control Patterns” (CPs). Inductive analysis methods are employed to identify reusable patterns. As a proof of concept, based on a sample of proven implementations of the software change management process, the paper analyses possibilities to extract, generalize and explicitly model IS controls.