Aligning processes with high-level requirements: Goal-model-based compliance checking

ContextProcess compliance refers to the alignment between business processes and regulatory requirements. Compliance is difficult because it needs to be able to express the intent and the possible interpretations of laws into formal models, align models with foreseeable executions, and inspect whether these executions could generate violations. While business process compliance has been studied through conformance checking techniques, most regulatory requirements are defined in subjective and high-level terms, limiting the application of rule- and alignment-checking algorithms to restricted cases where requirements are formally specified.ObjectiveThis paper investigates how compliance can be assessed against high-level and non-functional requirements rather than low-level process events. We aim to raise the abstraction level of compliance checking from specific task execution to the satisfaction of high-level business goals and subjective qualities.MethodWe propose a framework that links process models with goal models to capture functional decomposition, non-functional requirements, and contribution links, developed iteratively with legal practitioners. Business processes (imperative and declarative) are represented as labeled transition systems (LTS), goals and qualities as i* models, and a mapping function synchronizes process activities with goal elements. Compliance is then checked through state reachability where all qualities are satisfied, with computational support from the Kogi tool. We refine compliance into weak, strong, and monotonic quality satisfactionResultsFrom a technical view, the framework has demonstrated expressiveness, feasibility, and modularity by distinguishing strong, weak, and monotonic compliance. From a legal perspective, it has shown potential to enhance transparency in evidence-based decision-making and supports the traceability of knowledge bases underpinning system development, as illustrated by the use case from Regulation EC 261/2004.ConclusionsThe proposed approach enables compliance checking against high-level and non-functional requirements, showing potential to distinguish among compliant behaviours and increase goal satisfaction traceability compared to rule-based conformance methods.