State of the art design-time compliance checking techniques are generally limited to verifying control-flow relations. In this paper, we propose an algorithm for verifying design-time compliance of business process models including data. For a faithful resemblance to real-world cases, we include a degree of uncertainty in the outcomes of activities, such that a single execution is not guaranteed to lead to a unique data state. We represent the compliance requirements using conditional obligations. Our proposed approach uses a symbolic representation to compactly represent the possible data states across an execution, and evaluates them as a constraint satisfaction problem to first prune the state space of paths that require no further analysis and finally to evaluate if an execution violates one of the regulatory requirements. The performance of the approach is evaluated against existing algorithms implemented in NuXMV. The results show that our approach significantly outperforms the existing algorithms across the board.

Event logs capture the execution of business processes, such that each task is represented by an event and each individual execution is a chronological sequence of events, called an event trace. Event logs allow after-the-act and runtime analysis of deployed business processes to verify whether their execution complies with regulations and business requirements. Checking the compliance of a single sequence of events in a trace is straightforward and a number of approaches have been proposed to address this. However, some regulations or business rules span multiple process instances, requiring a cross-instance analysis. In order to check whether such requirements are maintained at all times, multiple traces need to be analysed together, which can result in a combinatorial computational complexity. In this article, we present a novel approach that efficiently checks runtime regulatory compliance based on event logs, while supporting cross-instance rule evaluation and extensible function evaluation over sequences of attribute data values. The efficiency and applicability of the proposed method is tested in a two-pronged evaluation, showing a significant improvement over existing techniques with respect to capabilities as well as computational complexity. The approach presented in this paper is subject to a patent application, with patent number WO2021/248201.

In this paper, we propose a methodology to verify the regulatory compliance of a composition of multiple interacting business process models. The proposed solution is based on providing a compliance certification for the components of the composition, and evaluating the compliance of the encompassing composition by aggregating the information shared by the certifications, going beyond existing techniques merely checking compliance on message flows. An advantage of adopting such methodology is that the computational details of the inner process models are not needed to verify compliance of the composition, so that companies can decide to not disclose such details while still being able to show that adopting their services would lead to compliant solutions in all possible scenarios.

Verifying whether a business process is compliant with a regulatory framework is a difficult task. In the present paper we prove the hardness of the business process regulatory compliance problem by taking into account a sub-problem of the general problem. This limited problem allows to verify only the compliance of structured processes with respect to a regulatory framework composed of a set of conditional obligations including a deadline. Experimental evidence from existing studies shows that compliance is a difficult task. In this paper, despite considering a sub-problem of the general problem, we provide some theoretical evidence of the difficulty of the task. In particular we show that the source of the complexity lies in the core language of verifying conditional obligations with a deadline. We prove that for this simplified case verifying partial compliance belongs to the class of NP-complete problems, and verifying full compliance belongs to the class of coNP-complete problems. Thus by proving the difficulty of a simplified compliance problem we prove that the general problem of verifying business process regulatory compliance is hard.