An Exploratory View on Risk Management Constructs for Business

Process Models

Gabriel Bolson Dalla Favera

, Denilson dos Santos Ebling

, Vinicius Maran

, Jonas Bulegon Gassen

and Alencar Machado

Universidade Federal de Santa Maria, Santa Maria, Brazil

Antonio Meneghetti Faculdade, Restinga S

eca, Brazil

Keywords:

BPM, BPMN, Risk Management, Process Modeling.

Abstract:

Business Process Modeling and Notation (BPMN) is a widely used process modeling notation both in

academia and industry, with a structure that is easy to understand and use. It contains more than a hundred

elements referring to various concepts. However, it does not cover risk management constructs. In this paper,

we seek to identify the need and which aspects are important if we were to associate process models with risk

management. We performed an exploratory research method with experts in the area of risk management that

also work with process models. The work resulted various concepts that could be related in process models,

such as risk presentation, control activities and risk mitigation. We conclude that experts would like to have

such disciplines better integrated and that we have a starting point to design, for instance, a BPMN extension

to cover such aspects.

1 INTRODUCTION

With the increasing size and complexity of processes

in organizations, there has been a necessity to per-

form Business Process Management (BPM), improv-

ing management of aspects such as people, prod-

ucts and services (vom Brocke and Rosemann, 2015).

Along with process modeling, managing risks has be-

come increasingly important. Risks can be deﬁned as

future situations that have some impact in organiza-

tions, being mostly negative (Tsiga et al., 2017).

Business Process Modeling and notation (BPMN)

is one of the most widely used modeling notations. It

covers various stages of the BPM life cycle, allowing

to build process models (Panagacos, 2012). It is im-

portant to use modeling rules to build efﬁcient process

models (Dumas et al., 2018). According to the Object

Management Group (OMG), responsible for the ar-

chitecture of BPMN, the notation does not have con-

structs concerning risk management (OMG, 2011).

Previous works discuss the possibility of associ-

ating risks to process models, e.g. zur Muehlen and

Rosemann (2005). However, research that seeks to

understand what is important to associate concerning

risk management with process models are lacking.

Event-driven Process Chain (EPC) has an approach

that allows to inform risks and controls policy situa-

tions. Despite the literature discussion regarding pro-

cess models containing risk management constructs,

empirical analysis on the needs of such constructs is

lacking. This paper intends do give a step towards

this direction. We approach this point by means of

an exploratory research method. Experts in the areas

of processes and risk management answered a survey.

Our analysis in this point is mainly qualitative, seek-

ing to understand the needs as seen by experts.

This work is organized as follows. Section

2 presents the background, which involves BPM,

BPMN, EPC and risk management. In Section 3

the related work is presented, followed by Section 4

presents the research design, which shows assump-

tions, aim, participants, material and data cleansing.

Sections 5 presents the results from the survey. Fi-

nally, discussion and conclusions are presented, re-

spectively in Sections 6 and 7.

2 BACKGROUND

In order to better understand the development of the

paper, in the following sessions we present the related

main concepts and references. BPM, BPMN, EPC

and Risk Management are presented, respectively.

770

Favera, G., Ebling, D., Maran, V., Gassen, J. and Machado, A.

An Exploratory View on Risk Management Constructs for Business Process Models.

DOI: 10.5220/0009419707700777

In Proceedings of the 22nd International Conference on Enterprise Information Systems (ICEIS 2020) - Volume 2, pages 770-777

ISBN: 978-989-758-423-7

2.1 BPM

BPM seeks to ensure constant positive results and

deliver maximum value to companies by improving

their business processes (Panagacos, 2012).

The BPM life cycle has six stages (Dumas et al.,

2018; vom Brocke and Rosemann, 2015; Panagacos,

2012; Weske, 2012): (i) process identiﬁcation, (ii)

process discovery, (iii) process analysis, (iv) process

redesign, (v) process implementation and (vi) process

monitoring and control.

BPM’s life cycle helps to understand all technolo-

gies, processes, and steps involved in order to be

adopted in any business environment (Dumas et al.,

2018). It should be noted that the phases can occur in

a continuous form, circularly, depending on the need,

or even only once (Weske, 2012). BPM has notations

and languages that allow to express and share their

processes with stakeholders (Panagacos, 2012).

2.2 BPMN

BPMN is a notation containing a series of standard

process design icons (Weske, 2012), which enables

a better understanding of the designed business pro-

cesses. The models produced may differ depending

on the reason for which they are built.

Frequently, process participants perform very spe-

ciﬁc tasks and are rarely confronted with the pro-

cess as a whole (vom Brocke and Rosemann, 2015).

BPMN’s main goals are to understand the process it-

self and share its understanding with the stakeholders

(Panagacos, 2012).

BPMN has more than hundred symbols (Dumas

et al., 2018). However, just some of them are re-

ally used, less common symbols can be aggregated

according to the organization needs, e.g. in more

complex projects. In BPMN modeling there are four

groups of elements: ﬂow objects, connecting objects,

swimlanes and artifacts (Dumas et al., 2018; Panaga-

cos, 2012; Weske, 2012).

Flow objects are the main graphic elements used

to deﬁne the behavior of a business process, being di-

vided into threes types: activities, events and gate-

ways. Connecting objects present the way objects are

connected and are divided into three types. Sequence

ﬂow, that presents the ﬂow execution order. Message

ﬂow, presenting the ﬂow of messages between sender

and receiver. And association, used to associate arti-

facts (e.g. data or texts) to the ﬂow objects.

Swimlanes present a way to organize activities

into visual categories, allowing better task manage-

ment. They are divided into two categories: pool and

lane. Finally, artifacts seek to aggregate information

to the process, as well as being used to represent a

data input or output. Even though BPMN does not

contain many key elements, building a process model

involves following a few rules. Good modeling prac-

tices should be used which make the process easy for

those involved to understand (Mendling et al., 2010).

Concerning risk management, the BPMN regula-

tory body (OMG) does not deﬁne any type of ele-

ment that allows managing risks in process modeling.

Which may be seen as a disadvantage if compared to

EPC.

2.3 EPC

EPC is a process and workﬂow modeling language.

It is used to conﬁgure the execution of business re-

source planning and business process improvement

(Mendling, 2008). Unlike BPMN, EPC addresses

some organizational aspects, such as risks and control

policies (AG, 2019).

There are some similarities with BPMN. Among

them, the exclusive, parallel and inclusive connectors,

functions and events (Mendling, 2008). In BPMN

pools and lanes are used to describe organizations,

positions, tasks and functions. In EPC elements of

the group of organizations are used, divided into or-

ganizational unit, position, position and group, which

are directly associated with functions (Scheer et al.,

2005). EPC contains data and risk elements group,

which are not included in BPMN.

2.4 Risk Management

Together with process modeling, managing the risks

involved in a business has become increasingly im-

portant in organizations. Risks are future situations

that have some kind of impact on organizations,

mostly negative (Tsiga et al., 2017). Thus, risk man-

agement is a strategic planning adopted by organi-

zations to identify, analyze and prevent the risks to

which they are subject (Chapelle, 2019). The risks an

organization may be vulnerable to depend on its ac-

tivities (Cope et al., 2010).

Risk management occurs in ﬁve steps (Chapelle,

2019; Cope et al., 2010; Lambert et al., 2006;

Moeller, 2011; Tummala and Schoenherr, 2011; zur

Muehlen and Rosemann, 2005). (i) risk identiﬁca-

tion, (ii) risk measurement, (iii) risk evaluation, (iv)

risk treatment and (v) risk monitoring.

During the identiﬁcation step, a qualitative analy-

sis of the risks that may affect the process or its results

is performed. In a qualitative analysis are identiﬁed,

the causes, effects and forms of identiﬁcation.

An Exploratory View on Risk Management Constructs for Business Process Models

771

The measurement step seeks to deﬁne the proba-

bility and impact of each identiﬁed risk. At this step,

the nature of the risks and the impacts that may occur

to the project and organization objectives should be

identiﬁed. Usually using a quantitative analysis.

Having the risks measured, their assessment is

performed, deﬁning their magnitude. Decisions are

made at this step, if the risks are acceptable or need

some treatment. Decisions are made according to the

risk appetite of each organization.

Approaching the last steps of risk management, its

forms are deﬁned, divided into (i) acceptance, where

the organization assumes the risk involved by adapt-

ing when problems occur. (ii) transfer, where the

responsibility for risk is shifted from one party to

another, typically occurs when third party service is

adopted. (iii) mitigation, where plans or strategies

are made to reduce the impact of the risks involved,

e.g. using business process management for mitiga-

tion. Finally, (iv) avoid the risk, in which the risk is

completely eliminated.

Lastly, in the ﬁnal phase, risk monitoring is per-

formed. For this, it is common to use tools that allow

monitoring, tracing and reviewing risks during the ex-

ecution of processes. Monitoring is an important step

in reducing the impact and frequency of risks, and it

is essential to identify new risks.

During the BPM life cycle, a risk check is per-

formed during the process identiﬁcation step (Dumas

et al., 2018). The risks identiﬁed at this step already

occur in the organization, and are the main source for

process modeling alignment (zur Muehlen and Rose-

mann, 2005).

Although risks are not modeled together with pro-

cesses, some studies look on how to address them.

The following chapter presents papers that discuss

ways to perform risk management in conjunction with

process modeling.

3 RELATED WORK

Ahmed and Matulevi

cius (2014) presented a method

for integrating security measures with process man-

agement. For this, the method consists of seven steps

that describe how process analysis and security anal-

ysis can collaborate to result in a secure business pro-

cess. The deﬁned steps are: (i) Identify safety prin-

ciples and objectives; (ii) Analyze risk safety; (iii)

Elicit security requirements; (iv) Annotate business

process models with security requirements; (v) Feed

back business models annotated with security require-

ments; (vi) Present security solutions; (vii) Ratio-

nalise security solutions.

The method allows eliciting security requirements

in business models, however a holistic method of se-

cure risk management is required. It beneﬁts business

analytics by allowing to choose cost-effective solu-

tions that ﬁt the business. The method allows for ear-

lier recognition of risks knowing that if it occurs later

it can increase costs.

Radloff et al. (2015) presented an approach for ex-

tending EPC and other modeling languages with in-

ternal control elements. The extension includes pro-

cedural control deﬁned classes, audit results, risks and

control objectives. Each of the classes created repre-

sents functions in EPC, allowing better management

of the internal controls. In order to be represented

in the notation, new elements that better describe the

means of control are proposed. The new elements

seek to be easily understandable to those involved. Fi-

nally, the author conducted a case study to assess their

approach understanding.

Ahmed and Matulevi

cius (2014) presented an ap-

proach concerning processes situations where data

may be leaked. In these situations, the impact of the

information present in this data may affect other parts

of the process. However, no solutions for risks are

presented and neither where the risks occurs in the

process.

The paper of Radloff et al. (2015) shows a way to

link internal controls to the modeled processes, since

EPC by itself does not include this functionality. By

using their approach, tasks can be performed more

satisfactorily, since they will conform to the organi-

zation internal controls.

Regarding the works presented in this section, the

work presented by Radloff et al. (2015) contributes

an extension to the EPC related to internal controls.

The author describes the possibility adapting it for

BPMN. Ahmed and Matulevi

cius (2014) focuses on

risk prevention, not showing where the risks are actu-

ally occurring. This works contribute to this paper by

presenting some solutions to associate risks with pro-

cess models. This paper, on the other hand, focus on

collecting opinions from specialists about what is im-

portant to be presented in process models concerning

risk management.

4 RESEARCH DESIGN

In this section we present our research design. This

paper intends to analyze the lack of constructs to rep-

resent risk management in BPMN models. We start

this journey by studying the experts view, whether

they consider a good idea or not to link both. For

this, we chose an exploratory research method, aim-

ICEIS 2020 - 22nd International Conference on Enterprise Information Systems

772

ing at a qualitative analysis (Recker, 2013; Wohlin

et al., 2012).

First, we present our assumptions, followed by the

aim of this paper. Then we present the demographics

of the participants. After that, we present the material

used to achieve our goal and ﬁnally the data cleansing

applied.

4.1 Assumptions

We assume that risk management is a very important

task and that it should be considered by companies, at

least by the ones applying some sort of control in this

regard. Consequently, we assume that it is a very im-

portant aspect to be considered when applying BPM.

Finally, we assume that would be important to present

such controls in BPMN models, from our understand-

ing at least the risks related to activities and forms to

mitigate them.

Some modeling languages like EPC provide sup-

port for risk management on its core set. This pro-

vides essential information about risks. Which re-

inforce the importance to present such concepts on

BPMN models.

4.2 Aim

For this work, we try to explore the view of special-

ists working with business processes and risk man-

agement. The idea is to better understand which infor-

mation could be interesting to have in BPMN models.

4.3 Participants

We collected data from eight specialists, they are col-

laborators of public and private organizations, and

of educational institutions. All participants are from

Brazil. In order to better understand our respondents,

we asked four questions about their knowledge, mea-

sured with Likert scale. For question (i) work with

processes in organizations, seven participants chose

”three years or more” (which was the maximum) and

one chose ”between one and three years”.

For questions (ii) work with process models and

(iii) work with BPMN, the answers were repeated as

for (i). For question (iv) work with risk management

in organizations, the answers had bigger variations.

Three respondents answered ”three years or more”.

Three answered ”between one and three years”. And

two answered ”between six months and a year”.

Based on these answers we can understand that

the participants had good knowledge in the required

concepts.

4.4 Material

In order to gather data from experts, we performed a

survey, which allowed us to reach more participants.

The questionnaire inquired about the importance of

presenting risk related information in business pro-

cess models. The questions were constructed and or-

dered to avoid bias and were divided into three sec-

tions (Wohlin et al., 2012).

In the ﬁrst section, demographic questions were

asked, seeking information from the respondents.

Questions related basically to the time that each par-

ticipant has interacted with: processes, process mod-

els, BPMN and risk management. With this, we can

have an idea about the knowledge of the participants.

In the second section, we presented three ques-

tions about risks and process models that should be

answered with free text. Those referred to (i) which

information should be presented in process models to

improve the work of the expert. (ii) Which informa-

tion should be presented in the model to improve the

process executor work. (iii) What could improve risk

management in the context of process models. Here

we tried to avoid bias towards our assumptions, in or-

der to explore the ideas from the experts.

Finally, in the third section, we presented ques-

tions related to our assumptions, these were presented

in the last section to not create bias. We asked four

questions with Likert scale (1 to 6) and three ques-

tions with free text.

4.5 Data Cleansing

Two out of ten participants claimed they never worked

with risk management. As we seek to explore the

ideas of risk management experts, we did not con-

sider their answers. Additionally, they replied ”I do

not know” for almost all questions. This reinforces

that our questions relate to our goal.

5 RESULTS

As presented previously, the ﬁrst section of the sur-

vey related to demographics. Following, we present

the second section, where data related to risk manage-

ment and process models were gathered. As presented

in Section 4, the ﬁrst questions had free text answers

and their descriptions tried to avoid bias. In order to

analyse the resulting data, all the authors followed the

process bellow:

1. In an independent environment, extract the most

important concepts from each answer, based on

An Exploratory View on Risk Management Constructs for Business Process Models

773

each persons point of view. There might be N ex-

tracted concepts per answer;

2. In a shared environment, select the most depicted

concepts (e.g. by three out of four authors). Try

to standardize concepts that have very similar

names;

3. In a shared environment, merge the answers:

(a) Aggregate concepts by similarity in a table;

(b) Add the frequency of similar concepts;

lar, but written with different words or special-

ization levels. Try to chose a standard concept

based on the literature;

(d) Join related concepts in groups;

Based on this process, Table 1 presents the results

from the ﬁrst question.

Table 1: Question: Which risk management information

should be presented in the process models to improve your

work?

Extracted concepts Freq.

Risk Presentation 4

Signal critical points 1

Control activities 3

Risk handling 1

Residual risk 1

Relating models with the risk matrix 1

Risk impact level 1

It is worth mentioning that the work to be improved

pointed out in this question relates to risk manage-

ment. From the results, we can understand that pre-

senting the risks was the most cited concept to be in

process models, followed by control activities. Which

conforms with our assumptions. Additionally, ﬁve

other concepts were mentioned by specialists. Con-

cepts that are related but distinct were grouped, the

leftmost query presents a number for each group. For

instance, risk handling could be merged to control ac-

tivities, however since it is a more speciﬁc concept, it

is presented separately. Table 2 presents results from

the second question.

The second question focus on what is important

to whom performs the processes. The most cited an-

swer is the risk presentation. Again, the related con-

cepts were grouped together. Risk handling follows

next based on frequency. Three other individual con-

cepts were mentioned by the specialists. One inter-

esting answer pointed that no information about risk

management should be put in the process model for

the executors. The specialist claimed that the model

Table 2: Question: Which information regarding risk man-

agement should be presented in process models to improve

the work from who performs the processes?

Extracted concepts Freq.

Risk presentation 3

Signaling critical points 2

Risk handling 2

Control activities 1

Risk mitigation 1

3 None 1

4 Relating info sources (e.g. normative) 1

5 Severity and risk repercussion 1

should be as simple as possible. Table 3 presents the

results from the ﬁnal question of second section.

Table 3: Question: What could improve risk management in

the context of process models?

Extracted concepts Freq.

Presenting risks 4

Presenting high impact risks 1

2 Agile tool for process monitoring 1

3 Querying standard processes via tools 1

Reviewing unnecessary controls 1

Reviewing uncontrolled risks 1

5 Risk mitigation 1

6 Risk-based process improvement 1

This question opens to any information concerning

any task that could be presented on models. The most

cited concepts relate to risk presentation. A total of

six groups of concepts were mentioned by the spe-

cialists.

In the third section of the form, Likert scale and

free text questions were presented. Likert scale ques-

tions collected information about the importance of

performing risk management in the organization. The

Likert scale (from 1 to 6) deﬁnes the scale of not im-

portant to very important. For this, four questions

were made: (i) importance of risk management to

your organization, (ii) importance that stakeholders

that perform activities know its risks, (iii) importance

that stakeholders that perform activities know how

to mitigate its risks and (iv) presenting information

about risks management in process models will im-

prove your organization. Note that here we impose

our assumptions in the questions descriptions, Focus-

ing in presenting and mitigating risks. Table 4 depicts

the answers for each question.

ICEIS 2020 - 22nd International Conference on Enterprise Information Systems

774

Table 4: Importance of connecting risk management with process models.

Imp. for organizations Imp. to perform risk activities Imp. to mitigate Imp. to present risks

6 5 5 6

6 6 6 4

6 6 6 6

5 5 5 6

4 5 6 1

6 6 6 6

1 6 6 6

5 5 6 6

Average 4.87 5.5 5.75 5.12

Based on this table, we can understand that the ex-

perts consider all aspects to be very important. For

the three ﬁrst questions, it was somehow predictable,

as the experts live this in their work day. For ques-

tion four, it is interesting to acknowledge that most of

them consider very important to present risk manage-

ment information in process models.

Afterwards, the last three questions had free text

answers seeking to explore the respondents view to-

wards our assumptions.

Table 5 shows the answers for the ﬁrst question

of the third part of the questionnaire. These questions

may have created some bias considering the questions

previously asked.

Table 5: Question: Which information should be presented

to those involved in risky process model activities?

Extracted concepts Freq.

1 Risk presentation 5

2 Impact vs. probability of risks 3

Control activities 2

Risk handling 2

Risk mitigation 1

4 Process progress control 1

5 Stakeholders identifying risks 1

This question directed the experts towards risky ac-

tivities of the process model. With that, the most

cited concept was risk presentation. The group relat-

ing to controls followed, and impact vs. probability

came next. Two more concepts were pointed out af-

terwards.

The table 6 presents the second question from the

third part of the questionnaire.

Based on the data, it is possible to acknowledge

that actions to mitigate risks present in the process

model was the most cited aspect. Followed by pre-

Table 6: Question: Which information should be presented

to those involved with risky activities from process models,

in order to mitigate them?

Extracted concepts Freq.

Risk mitigation actions 4

Control activities 1

Risk handling 1

Risk presentation 2

Residual risk 1

Impact x probability of risks 1

Risk impact on other processes 1

4 Stakeholder to report problems 1

5 Risk-based process improvement 1

Table 7: Question: What could be done in order to BPMN

models better approach risk management?

Extracted concepts Freq.

Risk presentation 3

Presentation of inherent risks 1

2 Risk management and BPM together 1

4 Relate process model and risk matrix 1

5 Control activities 1

6 Link to normative 1

7 Querying tool 1

8 Using models for stakeholders training 1

senting risks and the impact of risks.

Two more concepts were given by the specialists.

Finally, Table 7 refers to the last question of the

questionnaire.

This was a general open question, allowing the

participants to express what would be more interest-

ing from their point of view. The most frequent aspect

An Exploratory View on Risk Management Constructs for Business Process Models

775

was risk presentation. Six more options were given by

the specialists. One expert mentioned that adding el-

ements to the model is not the most important thing,

but applying BPM and risk management together.

The next section presents towards an extension to

associate risks with the BPMN. The extension was

based on the concepts given by the specialists.

6 DISCUSSION

In this section, we discuss the results, pinpoint impli-

cations for research and present threats to validity.

6.1 Results

Our survey results suggests that experts would like to

have risk management information presented in pro-

cess models. Suggesting that having such informa-

tion in BPMN models would have good acceptabil-

ity amongst them. The results also suggest that our

assumption towards relating risk to process models

activities and presenting how to mitigate risk within

process models seems to be the view of experts.

Section 5 presents the concepts extracted from the

free text answers gave by specialists. Some aspects

are clear, e.g. they believe that information about risks

should be presented in process models. Having that,

we understand that people would have a clear view on

steps of the process that should have higher attention.

In addition to the concept itself, some other sug-

gestions were made:

• Identify the risks altogether with the stakeholders

that work in each process;

• Present the impact level of the risks;

• Relate risks to activities in the process models;

• Where to ﬁnd information about handling the risk;

• The main risks are the ones to be presented;

When the experts considered the stakeholders that ex-

ecute the processes, we perceive a focus on mitiga-

tion actions additionally to risk presentation. Aside

the concepts, some other suggestions refer to:

• Presenting the risk will make it easier for the ex-

ecutor, providing conﬁdence;

• Where to ﬁnd normative and manuals, also infor-

mation about handling the risk;

• Severity and repercussion also appear;

• Minimizing risks is important;

This answers bring the idea that experts see process

models as an additional vehicle to communicate how

stakeholders should perform their activities consider-

ing risk management.

When asking questions related to our assump-

tions: presenting risks and mitigation actions, we see

some concepts increasing frequency. In both cases,

impact and probability are mentioned. Those con-

cepts refer to risk severity (Moeller, 2011).

Some specialists suggest presenting different in-

formation regarding risk. For instance, to present

residual risk or inherent risk. All suggestions are to

be taken into account, however not all information can

be ﬁt into a process model.

Very few answers were negative on connecting

process models with risks, one of which concerns

model complexity. This is a very good point that

should be considered and it has been studied through-

out the literature (Mendling et al., 2010). Therefore,

the amount of information and presentation manner

have to be cautiously studied.

6.2 Implications for Research

This work suggests the interest of experts towards

relating risk management concepts in process mod-

els. With the exploratory proﬁle of this paper, it con-

tributes with a starting point to researchers intending

to study new constructs to process models. The con-

cepts also help who develop the activities to perform

with more attention, avoiding risky situations.

6.3 Threats to Validity

Although in this paper we focus on a exploratory

qualitative analysis and no statistical tests were per-

formed, external validity could be improved by in-

creasing the number of specialists. Also, having spe-

cialists from different countries would be interesting.

With the application of a survey, we had a trade-

off, on the good side we were able to reach more spe-

cialists. On the bad side, we lost some power of un-

derstanding. By means of interviews, for instance, we

would have the chance to ask additional explanation

in the occurrence of unclear statements.

On the next section, the conclusions of this paper

are presented. Contributions and future works are ad-

dressed.

7 CONCLUSIONS

This paper seeks to explore the idea of construct-

ing process models with risk information, aiming to

identify its importance. To this end, specialists from

Brazil answered a questionnaire about the importance

ICEIS 2020 - 22nd International Conference on Enterprise Information Systems

776

of risk management associated to modeling processes.

We had assumptions prior to this paper that presenting

risks and risk mitigation actions would be interesting.

Based on the results and discussions, it was possi-

ble to obtain a direction on concepts to associate risk

management with process models. Three concepts

were the most cited by the specialists: risk presen-

tation, control activities and risk mitigation. Aside of

many other information to be considered when plan-

ning to bring those areas together.

Therefore, this work contributes by providing a

starting point to create an adequate association ap-

proach. The mentioned concepts provide a base to

construct a useful extension for notations such as

BPMN.

We intend to further analyse the creation of a

BPMN extension. Aspects related to, among others,

semiotics and cognitive psychology will be consid-

ered. Experiments to test the extension will be carried

out. With this, we hope to allow experts from organi-

zations to apply the extension and improve risk man-

agement in their work places, better integrated with

BPM.

ACKNOWLEDGEMENTS

Special thanks to Col

egio Polit

ecnico from Universi-

dade Federal de Santa Maria, Brazil.

REFERENCES

AG, S. (2019). Overview event-driven process chain nota-

tion. Accessed: december of 2019.

Ahmed, N. and Matulevi

cius, R. (2014). Securing business

processes using security risk-oriented patterns. Com-

puter Standards & Interfaces, pages 723–733.

Chapelle, A. (2019). Operational Risk Management - Best

Practices in the Financial Services Industry, pages 1–

33. Wiley, 1 edition.

Cope, E., K

uster, J., Etzweiler, D., Deleris, L., and Ray,

B. (2010). Incorporating risk into business process

models. IBM Journal of Research and Development,

54:4.

Dumas, M., La Rosa, M., Mendling, J., and Reijers, H.

(2018). Fundamentals of business process manage-

ment. Springer, 2 edition.

Lambert, J. H., Jennings, R. K., and Joshi, N. N. (2006).

Integration of risk identiﬁcation with business process

models. Syst. Eng., 9(3):187–198.

Mendling, J. (2008). Event-driven process chains (epc).

6:17–57.

Mendling, J., Reijers, H., and Aalst, W. M. P. (2010). Seven

process modeling guidelines (7pmg). Information and

Software Technology, 52:127–3136.

Moeller, R. R. (2011). COSO Enterprise Risk Management:

Establishing Effective Governance, Risk, and Compli-

ance Processes. John Wiley & Sons, 2nd edition edi-

tion.

OMG (2011). Business process model and notation (bpmn).

Accessed: may of 2019.

Panagacos, T. (2012). The ultimate guide to business pro-

cess management, pages 8–24. 1 edition.

Radloff, M., Schultz, M., and N

uttgens, M. (2015). Extend-

ing different business process modeling languages

with domain speciﬁc concepts: The case of internal

controls in epc and bpmn. pages 45–58.

Recker, J. (2013). Scientiﬁc Research in Information Sys-

tems: A Beginner’s Guide. Progress in IS. Springer-

Verlag Berlin Heidelberg, 1 edition.

Scheer, A.-W., Thomas, O., and Adam, O. (2005). Process

modeling using event-driven process chains. pages

119–145.

Tsiga, Z., Emes, M., and Smith, A. (2017). Implementation

of a risk management simulation tool.

Tummala, V. and Schoenherr, T. (2011). Assessing and

managing risks using the supply chain risk manage-

ment process (scrmp). Supply Chain Management:

An International Journal, 16:474–483.

vom Brocke, J. and Rosemann, M. (2015). Handbook

on business process management 1, pages 209–250.

Springer, 2 edition.

Weske, M. (2012). Business process management: con-

cepts, languages, architectures, pages 3–23. Springer,

2 edition.

Wohlin, C., Runeson, P., H

ost, M., Ohlsson, M., Regnell,

B., and Wessl

en, A. (2012). Experimentation in Soft-

ware Engineering. Springer-Verlag Berlin Heidel-

berg, 1 edition.

zur Muehlen, M. and Rosemann, M. (2005). Integrating

risks in business process models. ACIS 2005 Proceed-

ings - 16th Australasian Conference on Information

Systems.

An Exploratory View on Risk Management Constructs for Business Process Models

777