Reasoning About Accountability in Business Processes: A Risk-Driven Approach

Abstract Business processes define the activities expected to achieve organizationalobjectives, yet actual executions may deviate from the prescribed model due to errors or adaptations to circumstances. Organizations use accountability frameworks to collect information about such deviations and introduce corrective actions. Since accountability mechanisms, such as approval or verification activities, introduce additional costs, they should be applied selectively. This paper proposes a strategy to identify highest-risk activities for which accountability structures are justified. The proposed evaluation relies on execution logs from past process executions to estimate the likelihood of deviations from the model. In addition to likelihood, risk estimation also considers severity , capturing the consequences that deviations may have on process execution. Finally, we distinguish between the risk of executing an activity when it is not expected and the risk of not executing an activity prescribed by the process. We show how the alignment process mining technique can be effectively used for the computation of the likelihood of a misalignment associated with an activity. Additionally, by means of the Traffic Fine Management Case Study we demonstrate how distinguishing between the two types of risks may lead to a refined analysis of business process executions. The proposed technique allows process engineers to design efficient accountability countermeasures by associating activities with a fine-grained risk component. This allows them to limit the overhead costs by only focusing on the most critical activities: the higher the risk for an activity, the higher the need for setting up accountability relationships.