Against the Gods: The Remarkable Story of Risk

Regulatory compliance of business operations is a critical problem for enterprises. As enterprises increasingly use business process management systems to automate their business processes, technologies to automatically check the compliance of process models against compliance rules are becoming important. In this paper, we present a method to improve the reliability and minimize the risk of failure of business process management systems from a compliance perspective. The proposed method allows separate modeling of both process models and compliance concerns. Business process models expressed in the Business Process Execution Language are transformed into pi-calculus and then into finite state machines. Compliance rules captured in the graphical Business Property Specification Language are translated into linear temporal logic. Thus, process models can be verified against these compliance rules by means of model-checking technology. The benefit of our method is threefold: Through the automated verification of a large set of business process models, our approach increases deployment efficiency and lowers the risk of installing noncompliant processes; it reduces the cost associated with inspecting business process models for compliance; and compliance checking may ensure compliance of new process models before their execution and thereby increase the reliability of business operations in general.

A static compliance-checking framework for business process models

Enterprizes need Data Quality Management (DQM) to respond to strategic and operational challenges demanding high-quality corporate data. Hitherto, companies have mostly assigned accountabilities for DQM to Information Technology (IT) departments. They have thereby neglected the organizational issues critical to successful DQM. With data governance, however, companies may implement corporate-wide accountabilities for DQM that encompass professionals from business and IT departments. This research aims at starting a scientific discussion on data governance by transferring concepts from IT governance and organizational theory to the previously largely ignored field of data governance. The article presents the first results of a community action research project on data governance comprising six international companies from various industries. It outlines a data governance model that consists of three components (data quality roles, decision areas, and responsibilities), which together form a responsibility assignment matrix. The data governance model documents data quality roles and their type of interaction with DQM activities. In addition, the article describes a data governance contingency model and demonstrates the influence of performance strategy, diversification breadth, organization structure, competitive strategy, degree of process harmonization, degree of market regulation, and decision-making style on data governance. Based on these findings, companies can structure their specific data governance model.

One Size Does Not Fit All---A Contingency Approach to Data Governance

This paper reviews Information Systems (IS) literature that is relevant to Information Technology Governance (ITG) and examines how it informs Accounting Information Systems (AIS). We present a taxonomy of research encompassing the focus areas identified by the IT Governance Institute (ITGI), namely Strategic Alignment (SA), Risk Management (RK), Resource Management (RM), Value Delivery (VD) and Performance Measurement (PM). Based upon 496 papers in ten IS/AIS and two Management Accounting journals over the period 1998–2008, we discuss research perspectives and identify avenues for future research. Results revealed a lack of integration between focus areas, with little about ITG as a whole.

A Review of IT Governance: A Taxonomy to Inform Accounting Information Systems

This chapter examines several perspectives on answering the question “What is knowledge?” including the usable representations view, the states view, the production view, and the knowledge-versus-information view. The relationship between knowledge and technology is considered, concluding that technology is a major enabler of knowledge-based organizations. Regardless of the view of knowledge that one adopts and the degree of technology adoption, it is valuable to be aware of various attribute dimensions that qualify the nature of knowledge.

Knowledge and Its Attributes

As the result of the increasing costs of risk and compliance activities, enterprises are beginning to integrate compliance and risk management into a comprehensive enterprise risk management function and thus proactively address all sorts of risk, including operational risk and the risk of noncompliance. We present the IBM Research enterprise risk management framework, designed to address risk and compliance management in a strategic, integrated, and comprehensive manner. We demonstrate how enterprises evolve along an enterprise-risk-management maturity continuum from a state of mere penalty avoidance through a state of improvement until they finally reach a state of continuous, risk-based transformation. We then explain our high-level model of the enterprise and its environment and describe the central issues, systems, models, and technologies involved. We conclude by presenting the tactical steps necessary to successfully launch enterprise risk management in accordance with our framework.

Optimized enterprise risk management

Enterprise risk management (ERM) refers to a set of processes that enables the effective management of the risks, opportunities, and expected and unexpected events that may affect the enterprise. The successful implementation of ERM is a challenging task in part because it requires collaboration among multiple business units of different sizes, scope, and capability, each facing what it perceives as unique risks. Other difficulties with ERM implementations include lack of adoption of an enterprise-wide governance model, lack of a common risk language (e.g., taxonomy), and uneven levels of maturity within an organization regarding the management of risks. This paper establishes three conceptual frameworks that provide a basis for an enterprise embarking on ERM: 1) a risk management cycle; 2) a risk-related taxonomy; and 3) an ERM maturity model. The risk management cycle provides a discipline to consistently and coherently manage virtually all risks in the enterprise. The risk taxonomy provides a foundation for clear and concise communication about risk across the enterprise to enable better risk management. The ERM maturity model, and its associated capability assessment, allows an organization to determine gaps in its current risk management processes and define ways to improve those ERM capabilities. Together, these three frameworks are key enablers for a successful ERM implementation and ongoing operation.

Three key enablers to successful enterprise risk management

Resilience is often a qualitative property that is considered fundamental for communities affected by disasters. The concept, along with its variations, has been explored in several domains, such as warfare, business continuity, ecology, computer security, and infrastructure management. The lessons learned constitute a valuable starting point for building resilient socio-technical systems. In previous work, we have described resilience principles at the systems level by reviewing related studies in several research areas. This paper organizes the principles into a conceptual framework for resilient design, which includes a set of nonfunctional requirements for resilience and an assessment methodology for evaluating architectural work from a resilience standpoint. After having presented this conceptual framework, we discuss its application in our collaboration with the Victorian Fire Services Commissioner. This collaboration has led to the specification of a high-level reference architecture for the information interoperability platform that will support emergency services in Victoria.

Engineering resilient information systems for emergency management

Electronic mail (e-mail) has become an important tool for companies to use to conduct their businesses. With the introduction of the World Wide Web, awareness of the existence of the Internet has exponentially increased over the last two years, and people are starting to realize that there is more to the Internet than just the Web. Companies are expanding their use of e-mail from internal to external. But the large set of proprietary, noninteroperable e-mail systems make this more of a trip through a jungle than a drive along the information highway. Most approaches to overcome the connectivity problems use gateways to convert between the proprietary format and the Internet standards. These conversions are lossy at best; hence, most proprietary system vendors are revamping their systems to base them on Internet standards. This paper summarizes the current state of the most important Internet standards related to e-mail and the general state of proprietary e-mail systems. It then introduces a set of technologies we developed to solve the complex problem of evolving from proprietary to Internet-standards-based e-mail systems. We have structured these technologies into Internet Messaging Frameworks.

Internet messaging frameworks

Formalizes an interpretation of message-flow diagrams, allowing them to be translated into an executable forms, and develops a system, called "Cara", which allows a designer to enter message-flow diagrams and data operations, and to begin simulating with them immediately. Both control and data operations are translated into rules, which can be fine-tuned by the designer and used for simulation. In the Cara system, a flow-to-rule translator and a rule simulator operate concurrently with the designer. As the designer creates and modifies a diagram, the translator incrementally updates the architecture. The simulator uses the updated definition immediately to offer a next action to the designer (if one exists). In this way, the designer can always see whether the architecture is operating as intended. >

http://ieeexplore.ieee.org/iel2/353/3859/00144029.pdf

J. von Känel

Papers

Optimized enterprise risk management

Three key enablers to successful enterprise risk management

Engineering resilient information systems for emergency management

Internet messaging frameworks

Interactive prototyping of communication-intensive systems