The resource-based view of the organisation has argued that organisations are unlikely to yield superior performance if they operate business process management (BPM) resources in isolation. As organisations attempt to boost their performance, the question becomes how to configure BPM resources to continuously improve organisation performance. In this paper, we posit that managerial BPM capabilities based on managers commitment and employee involvement have a positive impact on technical BPM capabilities (i.e. comprised of strategic alignment and IT infrastructure), which in turn drives an organisation's ability to enhance its performance. Using data from matched surveys of 182 organisations, we find that technical capabilities mediate the relationship between managerial capabilities and organisations' performance. Furthermore, we reveal that organisation culture moderates the relationship between managerial and technical capabilities. This paper contributes to the theory of BPM by showing that it can be ...

A business process management capabilities perspective on organisation performance

The effective, efficient and continuous execution of business processes is crucial for meeting entrepreneurial goals. Business process modeling and simulation are used to enable desired business process optimizations. However, current approaches mainly focus on economic aspects while security aspects are dealt with in separate initiatives. This missing interconnection may lead to significant differences in improvement suggestions, such as the differing valuation of security investments (e.g., redundancy of systems). The major contribution of this paper is the introduction of a formal model that is capable of expressing the relations between threats, detection mechanisms, safeguards, recovery measures and their effects on business processes. This novel business process simulation capability paves the way for the evaluation of security investments at process design stage by allowing the consideration of stochastic influences of the occurrence of threats on process activities and resources in a unified way. A stylized business case outlines how our method can be applied to real world scenarios.

A Formal Approach Enabling Risk-Aware Business Process Modeling and Simulation

Business processes and services can more flexibly be combined when based upon standards. However, such flexible compositions practically always contain vulnerabilities, which imperil the security and dependability of processes. Vulnerability management tools require patterns to find or monitor vulnerabilities. Such patterns have to be derived from vulnerability types. Existing analysis methods such as attack trees and FMEA result in such types, yet require much experience and provide little guidance during the analysis. Our main contribution is ATLIST, a new vulnerability analysis method with improved transferability. Especially in service-oriented architectures, which employ a mix of established web technologies and SOA-specific standards, previously observed vulnerability types and variations thereof can be found. Therefore, we focus on the detection of known vulnerability types by leveraging previous vulnerability research. A further contribution in this respect is the, to the best of our knowledge, most comprehensive compilation of vulnerability information sources to date. We present the method to search for vulnerability types in SOA-based business processes and services. Also, we show how patterns can be derived from these types, so that tools can be employed. An additional contribution is a case study, in which we apply the new method to an SOA-based business process scenario.

Vulnerability Analysis in SOA-Based Business Processes

In the past years, regulative bodies have obliged a more stringent consideration of risk and security management. This development forced companies to apply risk, security and business process management in a more integrated way. Simultaneously, it can be observed that the scientific community intensified research activities in this integrative domain. Within this survey paper we examine scientific research efforts in the field of security and risk related business process/workflow management. Therefore we survey nine representative approaches and identify research challenges in this area.

/pdf/a-survey-of-scientific-approaches-considering-the-3utfirhe3m.pdf

A Survey of Scientific Approaches Considering the Integration of Security and Risk Aspects into Business Process Management

Companies face the challenge to effectively and efficiently perform their business processes and to guarantee their continuous operation. To meet the economic requirements, companies predominantly apply business process management concepts. The substantial consideration of robustness and continuity of operations is performed in other domains such as risk or business continuity management. Applying these domains separately, analysis results may significantly differ as valuations from an economic and risk point of view may lead to deviating improvement recommendations. Observing developments in the past years, one can see that regulative bodies, the industry, and the research community laid a special focus on the tighter integration of business process and risk management. Consequently, the integrated consideration of economic, risk, and security aspects when analyzing and designing business processes delivers enormous value to achieve these requirements.

/pdf/risk-aware-business-process-management-establishing-the-link-5dlv28ksod.pdf

Risk-Aware Business Process Management—Establishing the Link Between Business and Security

The vision of automated business processes within a service-oriented paradigm includes the flexible orchestration of IT services Whenever alternative services are available for activities in an ITsupported business process, an automated decision is worth aspiring to According to valueoriented management, this decision should be motivated economically and also requires taking account of risk This paper presents a novel approach for assessing the risk of IT services, based on vulnerability information as can be obtained in the form of publicly available Common Vulnerability Scoring System (CVSS) data 1 Automating IT service selection Market forces are raising companies’ ability to respond quickly and flexibly to changing demands, which is seen as one of the main competitive advantages of the future [1, 23] To keep pace, directing business models towards automation is still regarded as an important strategic topic [25] and aligning the technological infrastructure to service oriented architecture (SOA) seems a feasible and promising way [10, 16] Apparently, present SOA and standards such as BPEL or BPMN are still in need of improvement to satisfy business demands [29] and the present hype around service orientation is endangered by setbacks [13] Nevertheless, prominent suppliers of hardand software are already embodying service orientation into their products: IBM offers Websphere [19], SAP integrates Netweaver [6], and Microsoft uses services in Windows Vista [4] Besides the technical feasibility of SOA, exploiting the full potential of services requires solutions to several business demands In this contribution, the focus is laid on one of these issues: the automated selection between alternative IT services available for supporting the execution of business process activities Since the ability of an IT service to meet business process-specific protection goals is crucial, a method for assessing the risk of an IT service within the context of the supported business process is developed The method consists of two major parts: The first part proposes a new way to measure the probability of achieving protection goals within an IT service by assessing vulnerabilities The second part extends business process models by an economic decision algorithm that also takes risk into consideration and enables an automated decision between alternative IT services in the concrete execution context Addressing these two parts, the remainder of this contribution is structured as follows: in section 2, a layer-based model is introduced bringing 1 University of Freiburg, Institute of Computer Science & Social Studies, Department of Telematics, Friedrichstrasse 50, 79098 Freiburg, Germany

/pdf/a-risk-based-approach-for-selecting-services-in-business-42ab4ntrz3.pdf

A risk based approach for selecting services in business process execution

Weaving together information spread over several public and private organizations is crucial for managing catastrophic events and for realizing resilient social infrastructures. While beneficial in emergencies, an unlimited access to (sensitive) data is usually defined as the worst case in any privacy or IT security scenario. As a solution to this tradeoff, the transferability of successful methods and tools known from business process and workflow management to rescue processes is discussed. The resulting framework as well as the identified research questions do not aim at generating "pure" technical security but at reducing the probability of misuse and, thus, providing a sound technical basis for a social discussion on resilient infrastructures.

Gaining Flexibility and Compliance in Rescue Processes with BPM

Both external and internal stakeholders are asking companies and other institutions for transparency and compliance. To enforce compliance within their business processes, companies implement controls as the predominant approach to safeguard adherence to rules and regulations. Since modeling controls adequately is important, this contribution analyzes common business process modeling notations with regard to their capability to specify controls. First results show that BPMN 2.0 does not perfectly fit all requirements, however, it clearly outpaces the other languages.

Modeling Controls for Compliance -- An Analysis of Business Process Modeling Languages

Managing workflows is increasingly becoming flexible on both the conceptual and technical level. Reacting directly to new context situations and adapting workflows to changing requests both rapidly and flexibly are seen as key characteristic for future agile companies. Providing flexibility in process execution for single workflow instances is also a promising basis for expanding the scope of Business Process Management to other application fields and for integrating so-called dark processes into the system. However, workflows are not only subject to “pure” business needs but also increasingly to compliance requirements. To validate that a workflow is compliant with relevant laws and regulations, in principal, each change of a workflow has also to be checked according to its consequences for compliance. Not surprisingly, validating compliance is currently a well-known challenge for many companies, specifically their IT governance, and is, usually, a time-consuming manual task dealing with the challenge of fast adaptations and changes. Management has to balance the trade-off between flexible but (possibly) non-compliant workflows and compliant but (mostly) inflexible workflows. Addressing this trade-off, we present a novel approach called FlexCom and its prototypical implementation in this contribution. It aims at solving the trade-off by allowing a person in charge to change a workflow, even during execution, according to business needs, and by automatically integrating required control processes for achieving the correspondent compliance requirements. It is demonstrated that with such “sticky” controls at hand, the balance between flexibility of processes and compliance can be managed in a novel and promising way.

Flexible Workflows and Compliance: A Solvable Contradiction?!

Managing workflows is becoming increasingly flexible on both the conceptual and the technical level. However, workflow flexibility has to be accompanied by comprehensive access to information and the processing of it. Validating compliance is a still disregarded but crucial aspect though in flexible workflows where a lot of information is processed. In this contribution, a novel prototype named “KitCom” is presented, aiming at an automated adaptation of controls to realize flexible and compliant workflows. 1 Flexibility and Compliance – Precondition for Effective

/pdf/flexibility-and-compliance-in-workflow-systems-the-kitcom-4fzahc5qjw.pdf

Flexibility and Compliance in Workflow Systems - The KitCom Prototype.

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Kai Kittel

Author Tools

Chat about Author