Toward a Holistic Method for Regulatory Change Management

Sagar Sunkle and Vinay Kulkarni

Tata Consultancy Services Research, 54B Hadapsar Industrial Estate, Pune 411028, India

{sagar.sunkle,vinay.vkulkarni@tcs.com}

Keywords:

Regulatory Change Management, GRC, Formal Compliance Checking, Norm Change, Business Process

Change Propagation, Risk Modeling.

Abstract:

Complexity of regulatory compliance is heightened for modern enterprises due their global footprints and mul-

tiple regulations they are subjected to across varied domains and geographies and continual changes therein.

This necessitates a method for compliance management that is capable of establishing compliance to both

regulations and changes to regulations from a holistic perspective of governance, risk, and compliance (GRC).

We propose such a method using a conceptual model of integrated GRC whereby formal compliance checking

and norm change techniques for regulations represented as formal rules are coupled with business process

change propagation and risk modeling. The method also considers legal and business goals of regulators and

regulatees respectively in enacting compliance to regulation and changes therein. The method is substantiated

with a brief example of a real world banking regulation.

1 INTRODUCTION

Modern enterprises need to comply with multiple

domain- and geography-speciﬁc regulations. Non-

compliance results not only in putting the hard earned

reputation of enterprises at stake, but may also lead

to personal liability and risk for board directors and

top management (Alberth et al., 2012). The com-

pliance problem is acerbated by continual changes

to regulations (French Caldwell, 2013; English and

Hammond, 2014). Enterprises not only have to be

compliant with multiple regulations but also remain

compliant as these regulations change. Regulatory

change management therefore assumes a very impor-

tant role in any regulatory compliance framework and

practices. Proper regulatory change management re-

quires adoption of right attitude at the top manage-

ment level and machinery to enact compliance to both

regulations and changes to regulations.

Interestingly, both industrial governance, risk, and

compliance (GRC) solutions and formal compliance

checking techniques address the problem of compli-

ance to regulations and regulatory changes in such a

way that a compliance solution that is better than both

can be obtained by combining the best features from

both. Industrial GRC solutions mostly provide infor-

mal, content management-based, document-driven,

and expert-dependent ways of solving the compli-

ance problem (French Caldwell, 2013), but at the

same time support an integrated view of G, R, and

C tools and practices, which is a desirable feature

since changes in regulations affect aspects of gover-

nance and risk as much as they affect already com-

pliant processes (Racz et al., 2011). An integrated

GRC solution can help in managing and evaluating

assumptions in the current business model and assess-

ing the effectiveness of strategies for new business

models (Switzer et al., 2013). Formal compliance

checking techniques, in comparison to industry GRC

solutions, provide formal guarantees of compliance

and several formal compliance analysis possibilities

(Becker et al., 2012). But research in formal com-

pliance checking, although extensive, has focused on

segments of topics such as compliance checking of

business process, changes to legal norms, business

process change, and risk modeling without provid-

ing techniques from an integrated GRC perspective

(Neiger et al., 2006; Sch

afer et al., 2011).

In this position paper, we propose to relate formal

norm change techniques based on formal compliance

checking techniques with business process change

propagation and risk modeling based on an integrated

GRC perspective. To elaborate our approach, we use

elements from a conceptual model for integrated GRC

(Vicente and da Silva, 2011). Starting with key el-

ements, we show how G, R, C concerns are treated

separately as far as formal compliance checking tech-

niques are considered and eventually we arrive at a

218

Sunkle S. and Kulkarni V.

Toward a Holistic Method for Regulatory Change Management.

DOI: 10.5220/0005887402180223

In Proceedings of the Fifth International Symposium on Business Modeling and Software Design (BMSD 2015), pages 218-223

ISBN: 978-989-758-111-3

method which ensures that all three concerns are ad-

dressed while using these techniques. We believe that

this method has the potential to provide formal guar-

antees and analysis beneﬁts along with holistic treat-

ment of G, R, and C concerns.

The paper is arranged as follows. In Section 2,

we begin with a conceptual model of GRC and mo-

tivate why G, R, C concerns need to be addressed

together, and how the current formal research tech-

niques treat these in a divided manner. In Section

3, ﬁrst we review norm change techniques, busi-

ness process change propagation in connection with

norm change, and risk modeling techniques in that

sequence. We then put forth a method for a formal

treatment of regulatory changes on top of integrated

GRC model. In Section 4 present a very brief exam-

ple of how this method may be applied to a Know

Your Customer (KYC) regulation of Reserve Bank of

India (RBI). We discuss some pertinent pointers with

regards using integrated GRC perspective for cost-

effective enterprise decision making in Section 5 and

Section 6 concludes the paper.

2 THREE DIMENSIONS OF

REGULATORY CHANGE

GRC is an integrated, holistic approach to

organization-wide governance, risk and compli-

ance (Racz et al., 2010). Taking the stance that

different enterprises would deﬁne GRC in their

own way, (Vicente and da Silva, 2011) came up

with a conceptual model to deﬁne the domain of of

integrated GRC. We illustrate an adapted version of

this model in Figure 1.

Note that Figure 1 deliberately includes elements

common to G, R, and C, namely Key Objectives, Poli-

cies, Internal Controls, Processes, and Risks. Ad-

ditionally it contains elements speciﬁc to C, namely

Regulations and Standards, and elements speciﬁc to

R, namely Inquires/Surveys, Risk Appetite, Issues,

and Heat Maps. Governance is responsible for risk

and compliance oversight, as well as evaluating per-

formance against enterprise’s Key Objectives. Com-

pliant enterprises need an effective approach to verify

that they are in conformity with rules set from exter-

nal Regulations and Standards and internal Policies

which are eventually related to and are exercised in

terms of Internal Controls. Enterprise’s Key Objec-

tives are achieved by Processes which have an asso-

ciated set of Risks. Internal Controls should be imple-

mented on top of Processes such that they are able

to track, prevent, detect, and correct Risks associated

with Processes and thereby fulﬁll Key Objectives of

Internal(

Controls(

Risk(

Appe1te(

Key(

Objec1ves(

Processes(

Risks(

Policies(

Issues(

Heat(

maps(

Inquiries

/Surveys(

Governance(

Compliance(

Regula1ons(

and(

Standards(

Risk(

deﬁne(

determine(

use(

contemplate(

prevent,(

detect,(

correct,(

track(

associated(

fulﬁll(

iden1fy(

risks(in(

may(be(

ensure((

compliance(

with(

assessment(

leads(to(

fulﬁll(

are(

established(

in(

update(

deﬁne(

fulﬁll(

Figure 1: Integrated GRC conceptual model adapted from

(Vicente and da Silva, 2011).

the enterprise.

Figure 1 represents integrated GRC without dif-

ferentiating between compliance to Regulations and

Standards and compliance to changes in Regulations

and Standards. The elements related to R not cov-

ered in the reading above indicate essentially the in-

dustrial GRC way of risk-adjusted decision making in

compliance to both regulations and changes to regu-

lations. Based on predetermined Risk Appetite, Risks

associated with Processes are identiﬁed by expert In-

quiries/Surveys. Certain issues with Internal Con-

trols may also be treated as Risks. Based on In-

quiries/Surveys, risk Heat Maps are created pointing

to speciﬁc Processes and business functions and In-

ternal Controls are updated based on evaluation of

Heat Maps.

In contrast to industry GRC solutions, formal

compliance checking approaches help in reducing the

burden on experts by using formal models of regula-

tions and business processes. An extensive research

exists in formal compliance checking of regulations

where methods to check formalized models of busi-

ness processes against models of regulations are ex-

plicated (Sadiq et al., 2007; Liu et al., 2007; Ly et al.,

2010). Additionally, some of these approaches even

enable formal proofs of (non-)compliance by utilizing

diagnostic information about process activities (An-

toniou et al., 2008; Governatori et al., 2009). But re-

search on formal compliance checking of changes in

regulations is not yet coordinated. This is illustrated

in Figure 2.

Figure 2 adds changes to key elements of Fig-

ure 1 and positions research in formal methods of

norm change, business process change propagation

and risks associated with changes on top of these ele-

ments. It can be seen that links between the common

elements of GRC, namely Processes, Internal Con-

trols, and Risks do not hold as illustrated by relations

between elements drawn in red. Some relations are

Toward a Holistic Method for Regulatory Change Management

219

Changes((

in#Internal#

Controls#

Changed(

Processes#

Change#

Risks#

Inquiries

/Surveys#

Business#Process#Modeling#+#Change(Propaga.on(

Formal#Compliance#Checking#+#Norm(Change(

Changes#in#

Regula@ons#

and#Standards#

Risk#Modeling#+#Change(Risk(

use(

prevent,(

detect,(

correct,(

track(

associated(

Iden.fy(

risks(in(

ensure((

compliance(

with(

deﬁne(

fulﬁll(

enact(in(

Figure 2: Research on changes in norms, business process,

and risks.

different from Figure 1, because they depict the way

formal techniques solve individual problems of norm

change, business process change, and change risks.

For an effective and efﬁcient regulatory change man-

agement, elements in the three dimensions of norm

change, business process change, and change risks

need to be coordinated. They can be coordinated pre-

cisely by focusing on relations drawn in red. We elab-

orate this in the next section by reviewing existing

work in each of these dimensions and then proposing

a method for coordination.

3 TOWARD A METHOD FOR

REGULATORY CHANGE

Norm Change Norm change research focuses on dif-

ferent ways in which contraction, expansion, and revi-

sion of legal theories can be achieved. Several inter-

esting aspects have to be taken into consideration to

formally model norm changes as enumerated below:

1. Distinction between legal (obligations, prohibi-

tions and permissions) and counts-as rules

2. Distinction between norms and their legal effects

and the notion of defeasiblity

3. Distinction between Ex Tunc and Ex Nunc norms

4. Ways in which expansion and contraction of legal

effects is achieved

5. Interpretation mechanism for balancing goals of

norms and legal effects

Each aspect above is elaborated further below.

While legal rules specify the ideal behavior and

can be changed by the legislative system such as a

regulatory body, the counts-as rules provide deﬁni-

tions of institutional concepts. The applicability con-

ditions of legal rules refer to these institutional con-

cepts, rather than to the so called brute facts (Boella

et al., 2009).

Considerable research in norm change uses ex-

tensions of defeasible logic (Governatori and Ro-

!"#$%&'()

*%+,

-$./)"..01(2"..

*%+,

!"#$%&'()

3"4,

-$./)"..01(2"..

3"4,

Reg$ BP$

567"++"+,

!$%".

589%/2/:,3&;/#&'(),

0&:<.

=(69%"8,3&;/#&'(),

>)&%?./.

!$%",@$/+"+,

01(2"..,-"<&;/(1

!$%"A+1/;"),01(2"..,

=(69(./:".

!$%"A+1/;"),B"1;/2".

!$%"AC?)&6/2

Process'rule*Con-nuum

D(4

E/#<

3(16,=<&)#",01(9&#&'(),

:(,589%/2/:,3&;/#&'(),-0

3(16,=<&)#",01(9&#&'(),

:(,567"++"+,!$%".,-0

Figure 3: Propagating norm changes to processes.

tolo, 2008a; Governatori and Rotolo, 2008b; Boella

et al., 2009) and is based on formal compliance check-

ing techniques using the same extensions of defea-

sible logic (Antoniou et al., 2008) with at least two

implementations, namely Formal Contract Language

(Sadiq et al., 2007) and DR-Prolog (Antoniou et al.,

2008). The notion of defeasibility helps in terms

of revising legal effects without necessarily revising

norms. In other words, obligations can change with

normative system being the same, as for instance, due

to change in the world, new obligations can be at-

tached or old obligations can be detached from the

legal norms. The norms themselves can be distin-

guished as Ex Tunc or Ex Nunc based on how the legal

effects are realized.

Ex Tunc norm is a norm that retroactively changes

the legal effects of actions committed prior to the ex-

istence of the norm, whereas an Ex Nunc norm af-

fects only actions committed after the existence of the

norm.

Based on the notions of Ex Tunc and Ex Nunc

norms expansion can be prospective and retroactive

promulgation (G

omez-Sebasti

a et al., 2012) and con-

traction can be annulment or abrogation respectively.

Since regulations are represented as rules in the im-

plementation, different ways have been suggested to

expand and contract legal effects such as adding or

removing rules, adding exception via defeaters, i.e.,

rules that can be used for defeating conclusions

, or

changing rule superiority.

Finally, the interpretation mechanism enables

adapting norms after their creation to the unforeseen

situations in order to achieve the social goals they

have been planned for (Boella et al., 2009).

The research in norm change does not propose

how to propagate changes with regards legal effects

realized as modiﬁed rule base to processes. We re-

For the formal speciﬁcation of defeasible logic, its ex-

tensions, and proof theory, reader is requested to refer to

(Antoniou et al., 2008; Boella et al., 2009).

Fifth International Symposium on Business Modeling and Software Design

220

view the research in business process change propa-

gation in order to suggest a way to do so.

Business Process Change Propagation We focus on

the fact that industry GRC solutions as well various

formal compliance checking techniques enact regula-

tions in processes in terms of rules. The way rules

are integrated into business processes may depend on

where the default level of rule and process integra-

tion in given enterprise lies along what is called as

process-rule continuum (Sinur, 2009; Koehler, 2011).

This is illustrated in Figure 3 top right.

Seven scenarios with regards how rules are inte-

grated with processes were described in (Sinur, 2009)

and later elaborated by (Koehler, 2011). Processes

with embedded rules encode all process paths into the

process without explicit rules and denote processes

that do not change frequently. In processes with ex-

plicit navigation rules explicit rules manage and di-

rect the process routes for each process instance. At

the end of the continuum with fully rule-dynamic

processes, rules dynamically conﬁgure processes and

rules themselves may change.

On the bottom left of Figure 3, we depict the reg-

ulation change scenario. Here, original regulations

Regulation

Old

with which original business process

BusinessProcess

old

was compliant with, is changed to

Regulation

New

. The new regulations need to be prop-

agated to the original business process in a compli-

ant manner to yield BusinessProcess

New

. ∆

Reg

cap-

tures the change operations in terms of rule addi-

tion/removal, defeater addition/removal and rule su-

periority assertions. ∆

is a change sensitive func-

tion of ∆

Reg

meaning that instead of reapplying new

rules from scratch, only changes in rules are reﬂected

into business processes.

For embedded rules type of process, the change

propagation is most costly since the process has to

be redesigned by ﬁrst ﬁnding how rules are implic-

itly embedded into the processes. The change prop-

agation becomes easier along the continuum, such

as for processes of an enterprise that fall between

the types of explicit navigation rules processes and

complex navigation and analysis. In processes with

explicit navigation rules, processes contain business

rule tasks that determine when a rule component is

executed. This is the most common scenario in enter-

prises (Koehler, 2011). Variation of this type is where

rules are annotated to a task. In that case, to propa-

gate changes in regulations, the changed set of rules

may be directly annotated to the original task. Next,

we quickly review change risk modeling.

Change Risk Modeling As illustrated earlier in Fig-

ure 2, a standard process of Inquiries/Surveys of

Changed Processes may be carried out to ascertain

Changes((

in#Internal#

Controls#

Changed(

Processes#

Change#

Risks#

Inquiries

/Surveys#

Business#Process#Modeling#+#Change(Propaga.on(

Formal#Compliance#Checking#+#Norm(Change(

Changes#in#

Regula@ons#

and#Standards#

Risk#Modeling#+#Change(Risk(

use(

ensure((compliance(with(

deﬁne(

fulﬁll(

Propagate(to(

Iden.fy(

risks(in(

prevent,(

detect,(

correct,(

track(

associated(

Figure 4: Steps for holistic regulatory change management.

risks resulting from regulation changes that are now

propagated to the business processes. The basic for-

mulation for risk estimation is the probability of the

identiﬁed event evaluated by its consequence. We be-

lieve that by incorporating the computation of goals

related with norms and legal effects (Boella et al.,

2009) into risk modeling, consequences of events

(i.e., legal effects) can be computed with more reli-

ability.

Method for Regulatory Change Using formal mod-

els of norm change (step 1), changes in regulations

can be propagated to business process based on the

level of rule integration (step 2) and ﬁnally risk can

be computed for these changes (step 3). This method

is illustrated in Figure 4 by rearranging Figure 2. A

possible application of method illustrated in Figure 4

for Know Your Customer (KYC) regulations for In-

dian banks by Reserve Bank of India (RBI) is brieﬂy

described next.

4 CASE STUDY

The key goal of KYC regulations is curbing money

laundering, and it is achieved by a basic due diligence

activity of admitting customers of given type with re-

lated set of identity and address documents as spec-

iﬁed in several annexes of KYC. Depending on cus-

tomer types, there may be other due diligence activi-

ties that a bank may be obligated to carry out, such as

for instance, in case of politically exposed persons or

foreign policy investors

. In accordance with aspects

of norm change speciﬁed in Section 3, following can

be observed:

1. Deﬁnitions of Customer, beneﬁciary owner, and

See KYC Master Circular http://www.rbi.org.in/

scripts/BS_ViewMasCirculardetails.aspx?id=9074

Toward a Holistic Method for Regulatory Change Management

221

other institutional concepts can be modeled as

counts-as rules while the due diligence activities

for each type of customer can be modeled as legal

rules.

2. Distinction between norms and legal effects is ob-

servable in the regulation change in KYC 2014

from earlier KYC master circulars where intro-

duction of new customer by existing account

holders was no longer kept mandatory.

3. While most of KYC regulations are Ex Nunc, cer-

tain customer types have been introduced, such as

foreign policy investors in 2014, and customers

matching that proﬁle but admitted in 2013 may be

subjected to corresponding regulations Ex Tunc.

4. When KYC regulations are implemented as rules

(say in DR-Prolog), expansion, contraction, and

revision of KYC regulation can be carried out by

rule addition/removal, addition of exceptions, and

changing rule superiority.

5. Finally, RBI goal of anti money laundering and

banks’ goal of reducing risk liability while ad-

mitting customers across low to high risk proﬁles

could be modeled using goals of norms and legal

effects.

The key processes indicated by RBI KYC are new

account opening, account transfer, third party trans-

actions, and transaction monitoring. These are the

processes to which changes in regulations are prop-

agated. RBI KYC also provides guidelines for risk

categorization of customers based on customer types

and transaction history which can be used to model

risks for speciﬁc customers and also changes in risk

proﬁles as regulations change.

5 DISCUSSION

Change Sensitive Propagation Figure 3 shows that

regulatory changes are propagated to business pro-

cesses. It is less likely but possible that business pro-

cesses change and now original regulations must be

complied with again. In both these cases, propagation

should be change sensitive. While we proposed such a

way when propagating regulatory changes in terms of

rules to business processes, when business processes

change, the re-applicability of original regulations to

changed processes should be change sensitive as well.

Enterprise Context In an earlier work, we showed

how to capture enterprise transformation due to var-

ious change drivers from as-is to to-be architecture

using enterprise architecture (EA), intentional, and

system dynamics models (Sunkle et al., 2013). EA

models act as descriptive models whereas intentional

models and system dynamics models act as prescrip-

tive or decision making models. We also showed how

to incorporate directives such as internal policies and

external regulations into enterprise to-be architecture

(Sunkle et al., 2014). Existing business processes sig-

nify current courses of actions that an enterprise uses

to achieve its Key Objectives. Since regulations es-

sentially constrain business processes, it may be pos-

sible to relate compliance of speciﬁc regulations with

achievement of speciﬁc Key Objectives. Once this in-

terrelatedness is established, it might be possible to

model and reason about how to make best decisions.

6 CONCLUSION

We have proposed a method that uses formal compli-

ance checking, norm change, business process change

propagation, and risk modeling to address regulatory

change management with an integrated GRC perspec-

tive. We brieﬂy discussed application of this method

for compliance with KYC regulations. The inte-

grated view paves way toward balancing achievement

of business objectives while complying to regulations

taking into consideration risks including those con-

cerning compliance.

REFERENCES

Alberth, S., Babel, B., Becker, D., Kaltenbrunner, G., Pop-

pensieker, T., Schneider, S., Stegemann, U., and Weg-

ner, T. (2012). Compliance and control 2.0: Unlock-

ing potential through compliance and quality-control

activities. McKinsey Working Papers on Risk, 33.

Antoniou, G., Bikakis, A., Dimaresis, N., Genetzakis,

M., Georgalis, G., Governatori, G., Karouzaki, E.,

Kazepis, N., Kosmadakis, D., Kritsotakis, M., Lilis,

G., Papadogiannakis, A., Pediaditis, P., Terzakis, C.,

Theodosaki, R., and Zeginis, D. (2008). Proof ex-

planation for a nonmonotonic semantic web rules lan-

guage. Data & Knowledge Engineering, 64(3):662 –

687.

Becker, J., Delfmann, P., Eggert, M., and Schwittay, S.

(2012). Generalizability and applicability of mod-

elbased business process compliance-checking ap-

proaches — a state-of-the-art analysis and research

roadmap. BuR — Business Research, 5(2):221–247.

Publication status: Published.

Boella, G., Governatori, G., Rotolo, A., and van der Torre,

L. (2009). Lex Minus Dixit Quam Voluit, Lex Magis

Dixit Quam Voluit: A formal study on legal compli-

ance and interpretation. In Casanovas, P., Pagallo, U.,

Sartor, G., and Ajani, G., editors, AI Approaches to the

Complexity of Legal Systems., volume 6237 of Lecture

Notes in Computer Science, pages 162–183. Springer.

English, S. and Hammond, S. (2014). Cost of compliance

2014 (Thomson Reuters Accelus).

Fifth International Symposium on Business Modeling and Software Design

222

French Caldwell, J. A. W. (2013). Magic quadrant for en-

terprise governance, risk and compliance platforms

(Gartner).

omez-Sebasti

a, I.,

Alvarez-Napagao, S., V

azquez-

Salceda, J., and Felipe, L. O. (2012). Towards run-

time support for norm change from a monitoring per-

spective. In Ossowski, S., Toni, F., and Vouros,

G. A., editors, Proceedings of the First International

Conference on Agreement Technologies, AT 2012,

Dubrovnik, Croatia, October 15-16, 2012, volume

918 of CEUR Workshop Proceedings, pages 71–85.

CEUR-WS.org.

Governatori, G., Hoffmann, J., Sadiq, S., and Weber, I.

(2009). Detecting regulatory compliance for busi-

ness process models through semantic annotations.

In Ardagna, D., Mecella, M., and Yang, J., editors,

Business Process Management Workshops, volume 17

of Lecture Notes in Business Information Processing,

pages 5–17. Springer Berlin Heidelberg.

Governatori, G. and Rotolo, A. (2008a). Changing legal

systems: Abrogation and annulment part I: revision of

defeasible theories. In van der Meyden, R. and van der

Torre, L., editors, Deontic Logic in Computer Science,

9th International Conference, DEON 2008, Luxem-

bourg, Luxembourg, July 15-18, 2008. Proceedings,

volume 5076 of Lecture Notes in Computer Science,

pages 3–18. Springer.

Governatori, G. and Rotolo, A. (2008b). Changing legal

systems: Abrogation and annulment. part II: tempo-

ralised defeasible logic. In Boella, G., Pigozzi, G.,

Singh, M. P., and Verhagen, H., editors, Third Inter-

national Workshop on Normative Multiagent Systems

- NorMAS 2008, Luxembourg, July 15-16, 2008. Pro-

ceedings, pages 112–127.

Koehler, J. (2011). The process-rule continuum - can

BPMN & SBVR cope with the challenge? In Hofre-

iter, B., Dubois, E., Lin, K., Setzer, T., Godart, C.,

Proper, E., and Bodenstaff, L., editors, 13th IEEE

Conference on Commerce and Enterprise Comput-

ing, CEC 2011, Luxembourg-Kirchberg, Luxembourg,

September 5-7, 2011, pages 302–309. IEEE Computer

Society.

Liu, Y., M

uller, S., and Xu, K. (2007). A static compliance-

checking framework for business process models.

IBM Systems Journal, 46(2):335–362.

Ly, L. T., Knuplesch, D., Rinderle-Ma, S., G

oser, K.,

Pfeifer, H., Reichert, M., and Dadam, P. (2010).

Seaﬂows toolset - compliance veriﬁcation made easy

for process-aware information systems. In Soffer, P.

and Proper, E., editors, Information Systems Evolution

- CAiSE Forum 2010, Hammamet, Tunisia, June 7-9,

2010, Selected Extended Papers, volume 72 of Lec-

ture Notes in Business Information Processing, pages

76–91. Springer.

Neiger, D., Churilov, L., zur Muehlen, M., and Rosemann,

M. (2006). Integrating risks in business process mod-

els with value focused process engineering. In Ljung-

berg, J. and Andersson, M., editors, Proceedings of

the Fourteenth European Conference on Information

Systems, ECIS 2006, G

oteborg, Sweden, 2006, pages

1606–1615.

Racz, N., Weippl, E., and Seufert, A. (2011). Governance,

risk & compliance (GRC) software - an exploratory

study of software vendor and market research perspec-

tives. In Proceedings of the 2011 44th Hawaii Inter-

national Conference on System Sciences, HICSS ’11,

pages 1–10, Washington, DC, USA. IEEE Computer

Society.

Racz, N., Weippl, E. R., and Seufert, A. (2010). A frame

of reference for research of integrated governance,

risk and compliance (GRC). In Decker, B. D. and

Schaum

uller-Bichl, I., editors, Communications and

Multimedia Security, 11th IFIP TC 6/TC 11 Interna-

tional Conference, CMS 2010, Linz, Austria, May 31

- June 2, 2010. Proceedings, volume 6109 of Lecture

Notes in Computer Science, pages 106–117. Springer.

Sadiq, S. W., Governatori, G., and Namiri, K. (2007). Mod-

eling control objectives for business process compli-

ance. In Alonso, G., Dadam, P., and Rosemann, M.,

editors, Business Process Management, 5th Interna-

tional Conference, BPM 2007, Brisbane, Australia,

September 24-28, 2007, Proceedings, volume 4714 of

Lecture Notes in Computer Science, pages 149–164.

Springer.

Sch

afer, T., Fettke, P., and Loos, P. (2011). Towards an

integration of GRC and BPM - requirements changes

for compliance management caused by externally in-

duced complexity drivers. In Daniel, F., Barkaoui,

K., and Dustdar, S., editors, Business Process Man-

agement Workshops - BPM 2011 International Work-

shops, Clermont-Ferrand, France, August 29, 2011,

Revised Selected Papers, Part II, volume 100 of Lec-

ture Notes in Business Information Processing, pages

344–355. Springer.

Sinur, J. (2009). The art and science of rules vs. process

ﬂows (Gartner Research Report G00166408).

Sunkle, S., Kholkar, D., Rathod, H., and Kulkarni, V.

(2014). Incorporating directives into enterprise TO-

BE architecture. In Grossmann, G., Hall

e, S.,

Karastoyanova, D., Reichert, M., and Rinderle-Ma,

S., editors, 18th IEEE International Enterprise Dis-

tributed Object Computing Conference Workshops

and Demonstrations, EDOC Workshops 2014, Ulm,

Germany, September 1-2, 2014, pages 57–66. IEEE.

Sunkle, S., Roychoudhury, S., and Kulkarni, V. (2013).

Using Intentional and System Dynamics Modeling

to Address WHYs in Enterprise Architecture. In

Cordeiro, J., Marca, D. A., and van Sinderen, M., edi-

tors, ICSOFT, pages 24–31. SciTePress.

Switzer, C. S., Suri, A., Kapoor, G., and Nazemoff, V.

(2013). Governance, risk management, and compli-

ance: Creating the right grc strategy for your company

Books24x7.

Vicente, P. and da Silva, M. M. (2011). A conceptual model

for integrated governance, risk and compliance. In

Mouratidis, H. and Rolland, C., editors, Advanced In-

formation Systems Engineering - 23rd International

Conference, CAiSE 2011, London, UK, June 20-24,

2011. Proceedings, volume 6741 of Lecture Notes in

Computer Science, pages 199–213. Springer.

Toward a Holistic Method for Regulatory Change Management

223