![](bg2.png)
2.1 BPM
BPM seeks to ensure constant positive results and
deliver maximum value to companies by improving
their business processes (Panagacos, 2012).
The BPM life cycle has six stages (Dumas et al.,
2018; vom Brocke and Rosemann, 2015; Panagacos,
2012; Weske, 2012): (i) process identification, (ii)
process discovery, (iii) process analysis, (iv) process
redesign, (v) process implementation and (vi) process
monitoring and control.
BPM’s life cycle helps to understand all technolo-
gies, processes, and steps involved in order to be
adopted in any business environment (Dumas et al.,
2018). It should be noted that the phases can occur in
a continuous form, circularly, depending on the need,
or even only once (Weske, 2012). BPM has notations
and languages that allow to express and share their
processes with stakeholders (Panagacos, 2012).
2.2 BPMN
BPMN is a notation containing a series of standard
process design icons (Weske, 2012), which enables
a better understanding of the designed business pro-
cesses. The models produced may differ depending
on the reason for which they are built.
Frequently, process participants perform very spe-
cific tasks and are rarely confronted with the pro-
cess as a whole (vom Brocke and Rosemann, 2015).
BPMN’s main goals are to understand the process it-
self and share its understanding with the stakeholders
(Panagacos, 2012).
BPMN has more than hundred symbols (Dumas
et al., 2018). However, just some of them are re-
ally used, less common symbols can be aggregated
according to the organization needs, e.g. in more
complex projects. In BPMN modeling there are four
groups of elements: flow objects, connecting objects,
swimlanes and artifacts (Dumas et al., 2018; Panaga-
cos, 2012; Weske, 2012).
Flow objects are the main graphic elements used
to define the behavior of a business process, being di-
vided into threes types: activities, events and gate-
ways. Connecting objects present the way objects are
connected and are divided into three types. Sequence
flow, that presents the flow execution order. Message
flow, presenting the flow of messages between sender
and receiver. And association, used to associate arti-
facts (e.g. data or texts) to the flow objects.
Swimlanes present a way to organize activities
into visual categories, allowing better task manage-
ment. They are divided into two categories: pool and
lane. Finally, artifacts seek to aggregate information
to the process, as well as being used to represent a
data input or output. Even though BPMN does not
contain many key elements, building a process model
involves following a few rules. Good modeling prac-
tices should be used which make the process easy for
those involved to understand (Mendling et al., 2010).
Concerning risk management, the BPMN regula-
tory body (OMG) does not define any type of ele-
ment that allows managing risks in process modeling.
Which may be seen as a disadvantage if compared to
EPC.
2.3 EPC
EPC is a process and workflow modeling language.
It is used to configure the execution of business re-
source planning and business process improvement
(Mendling, 2008). Unlike BPMN, EPC addresses
some organizational aspects, such as risks and control
policies (AG, 2019).
There are some similarities with BPMN. Among
them, the exclusive, parallel and inclusive connectors,
functions and events (Mendling, 2008). In BPMN
pools and lanes are used to describe organizations,
positions, tasks and functions. In EPC elements of
the group of organizations are used, divided into or-
ganizational unit, position, position and group, which
are directly associated with functions (Scheer et al.,
2005). EPC contains data and risk elements group,
which are not included in BPMN.
2.4 Risk Management
Together with process modeling, managing the risks
involved in a business has become increasingly im-
portant in organizations. Risks are future situations
that have some kind of impact on organizations,
mostly negative (Tsiga et al., 2017). Thus, risk man-
agement is a strategic planning adopted by organi-
zations to identify, analyze and prevent the risks to
which they are subject (Chapelle, 2019). The risks an
organization may be vulnerable to depend on its ac-
tivities (Cope et al., 2010).
Risk management occurs in five steps (Chapelle,
2019; Cope et al., 2010; Lambert et al., 2006;
Moeller, 2011; Tummala and Schoenherr, 2011; zur
Muehlen and Rosemann, 2005). (i) risk identifica-
tion, (ii) risk measurement, (iii) risk evaluation, (iv)
risk treatment and (v) risk monitoring.
During the identification step, a qualitative analy-
sis of the risks that may affect the process or its results
is performed. In a qualitative analysis are identified,
the causes, effects and forms of identification.
An Exploratory View on Risk Management Constructs for Business Process Models
771