![](bg6.png)
only approach that links the risk analysis to the
process model itself. Actually, it proposes a
systematic approach for identifying and analyzing
risks but also suggests hints regarding possible risk
reduction means to prevent the occurrence of
deviations or to provide protection against their
unwanted effect. Once the analysis is conducted,
there will be a way of preventing the occurrence of
deviations. This is done by guaranteeing that
recommendations are incorporated in the initial
design in order to get an improved model.
Accordingly, we believe that EPC-based HAZOP
presented in this paper, sketching out how new
guidewords, attributes can be an input to business
process improvement by providing to the
organization’s management the required tools to deal
with risks in an early phase of the business process
lifecycle. Such as, changes produced from the EPC-
based HAZOP output will be used as input to re-
design the process model(s) for future executions.
6 CONCLUSION
In order to improve business process, appropriate
analysis methods are needed. For this, we propose
new aspects that should be taken into account while
changing a process design. Effectively, carrying out
an appropriate risk analysis in an early phase of the
process lifecycle can lead to a review of the business
process model.
This paper presents an adaptation of HAZOP
method that is applied in the business process
environment. In fact EPC-based HAZOP simulates
an EPC model to HAZOP entities for whose
elements guide words may be applied. Later, we
proposed a unified output for EPC-based HAZOP
that aims to facilitate the translation of
recommendations to design.
Finally, we plan to extend our approach by
proposing mechanisms that permit to incorporate the
recommendation in EPC-based HAZOP table in
business process models in order to improve their
reliability.
REFERENCES
Conforti, R., Fortino, G., Rosa, M. L., ter Hofstede, A.,
2011. History-aware real-time risk detection in
business processes. In OTM 2011 Conferences.
Fenz, S., Neubauer, T., 2009. How to determine threat
probabilities using ontologies and bayesian networks.
In Proceedings of the 5th Annual Workshop on Cyber
Security and Information Intelligence Research: Cyber
Security and Information Intelligence Challenges and
Strategies, CSIIRW ’09, pages 69:1–69:3, New York,
NY, USA. ACM.
Goluch, G., Tjoa, S., Jakoubi, S., Quirchmayr, G., 2008.
Deriving resource requirements applying risk-aware
business process modeling and simulation. In ECIS,
AISeL.
Governatori, G., Milosevic, Z., Sadiq, S., 2006.
Compliance checking between business processes and
business contracts. In: Proceedings of the 10th IEEE
Conference on Enterprise Distributed Object
Computing.
ISO/DIS 31000, 2009. Risk management — Principles and
guidelines on implementation. International
Organization for Standardization.
Jans, M., Depaire, B., Vanhoof, K., 2011. Does process
mining add to internal auditing? An experience report.
In Halpin, T. A., Nurcan, S., Krogstie, J., Soffer,
P.,Proper, E., Schmidt, R., and Bider, I., editors,
BMMDS/EMMSAD, volume 81 of LNBIP, pages 31–
45, Springer.
Lano, K., Clark, D., Androutsopoulos, K., 2002. Safety
and security analysis of object-oriented models. In S.
Anderson et al., editors, Computer Safety, Reliability
and Security: SAFECOMP, volume 2434 of Lecture
Notes in Computer Science (LNCS). Springer-Verlag,
2002.
Lhannaoui, H., Kabbaj, M.I., Bakkoury, Z., 2013.
Towards an approach to improve business process
models using risk management techniques. Intelligent
Systems: Theories and Applications (SITA), 8th
International Conference on 8-9 May 2013.
Martin-Guillerez, D., Guiochet, J., Powell, D. Zanon, C.,
2010. A uml-based method for risk analysis of human–
robot interactions. In 2nd International Workshop on
Software Engineering for Resilient Systems, pp. 32–
41.
McDermid, J., Nicholson, M., Pumfrey, D., Fenelon, P.,
1995. Experience with the application of HAZOP to
computer-based systems. In Computer Assurance.
COMPASS ’95. IEEE.
Ministry of Defence, 2000. HAZOP studies on systems
containing programmable electronics. Defence
Standard 00-58, Parts 1 and 2, Issue 2, May 2000.
Mock, R., Corvo, M., 2005. Risk analysis of information
systems by event process chains. International journal
of critical infrastructures, 1(2-3):247– 257.
Suriadi, S., Weiß, B., Winkelmann, A., ter Hofstede, A.,
Adams, M., Conforti, R., Fidge, C., La Rosa, M.,
Ouyang, C., Rosemann, M., Pika, A., Wynn, M., 2000.
Current Research in Risk-Aware Business Process
Management - Overview, Comparison, and Gap
Analysis, BPM Center Report BPM-12-13,
BPMcenter.org.
ICSOFT-EA2014-9thInternationalConferenceonSoftwareEngineeringandApplications
194