Search

Business process compliance with regulations has been a topic of many research areas in Computer Science such as Requirements Engineering RE, Artificial Intelligence AI, Logic and Natural Language Processing NLP. This work aims to provide a systematic way of establishing and managing compliance to assist decision-making and reporting. Despite many notable advances, few systems deal adequately with legal interpretation and modeling norms in an expressive way that is well-integrated with business modeling practices. In this paper, we bring together two leading systems, Legal-URN and Eunomos, for a comprehensive compliance management solution.

Regulatory compliance in international trade can be enhanced by facilitating electronic exchange of trade documents to increase the supply chain visibility. Crucial for acceptance of the supply chain visibility concept is trust in the reliability of the data. This depends on both the integrity of information (no data is altered illicitly) and integrity of the flow of goods (no goods are unknowingly added or taken away). The challenge is to determine how these concepts of integrity are interconnected. In this paper, we discuss control measures to ensure integrity of supply chain information and the related goods flow. Such controls consist of three components. First, only trusted traders take part. Second, technical control measures ensure internal consistency of the information system, i.e., the system maintains integrity constraints based on a model of the transactions taking place. Third, physical and organizational control measures mitigate the risk that events in the real world do not correspond to the reported transactions. The usefulness and adequacy of the approach is illustrated with two case studies: the use of electronic seals in the Smart-CM project, and the use of biometrics for authentication in the E-Link project at Schiphol Airport, the Netherlands.

Part 5: Transformation, Values and Change; International audience; The ongoing financial crisis is forcing governments to consider leaner (less resource intensive) forms of public service delivery. This is a difficult process, especially since recent private sector scandals demand that governments become more vigilant. Public-private collaboration (PPC) needs to address this ‘lean yet vigilant’ challenge. However, PPCs have proven to take a long time to establish and bring to fruition. Hurdles that delay the achievement of goals include the need to agree on standards in an environment with heterogeneous interests, changing laws and unclear revenue models. While literature on managing PPC hints towards the need for both compulsory measures (plan-driven, restrictive) and adaptive measures (learning-driven, leeway), case studies illustrating how these measures can be integrated in practice are scarce. Drawing on the Standard Business Reporting case in the Netherlands, this paper shows that both compulsory and adaptive measures are necessary to advance in multi-actor standardization processes. Our findings indicate that PPC managers need to impose with leeway by taking an engineering approach to architecture development yet providing leeway in the details.

Regulation based on Continuous Control Monitoring could reduce the administrative burden for companies. Often, companies already have elaborate internal control and quality management systems. Instead of periodic physical inspections, regulatory supervision can partly be automated and performed on a continuous basis. The regulator gets access to a validated copy of key data elements from the company’s internal information systems, which serve as indicator of compliance to specific control objectives. In this paper we describe an information architecture for continuous control monitoring, and show how it can be applied to supervision of regulatory compliance. The approach is illustrated by a pilot project in the Netherlands of applying continuous control monitoring to food safety regulations in the meat processing industry. Participants concluded that the approach is technically feasible but requires a different mindset towards regulation, and a clear business case.

Norm-enforcement models applied in human societies may serve as an inspiration for the design of multi-agent systems. Models for norm-enforcement in multi-agent systems often focus either on the intra- or interagent level. We propose a combined approach to identify objectives for an architecture for self-regulating agents. In this paper we assess how changes on the inter-agent level affect the intra-agent level and how a generic BDI architecture IRMA can be adapted for self-regulation. The approach is validated with a case study of AEO certification, a European wide customs initiative to secure the supply chain while facilitating international trade.

Compliance is often achieved 'by design' through a coherent system of controls consisting of information systems and procedures. This system-based control requires a new approach to auditing in which companies must demonstrate to the regulator that they are 'in control'. They must determine the relevance of a regulation for their business, justify which set of control measures they have taken to comply with it, and demonstrate that the control measures are operationally effective. In this paper we show how value-based argumentation theory can be applied to the compliance domain. Corporate values motivate the selection of control measures (actions) which aim to fulfill control objectives, i.e. adopted norms (goals). In particular, we show how to formalize the dialogue in which companies justify their compliance decisions to regulators using value-based argumentation. The approach is illustrated by a case study of the safety and security measures adopted in the context of EU customs regulation.

Building collaborative relationships with trusted businesses is a long-term strategy for EU governments. Recently, for the EU Tax and Customs Administration (TCA), the realization of this goal has become more visible with the emerging concept of the Authorized Economic Operator (AEO). Businesses in the member states can apply for the AEO certificate. When it is being granted, simplified control procedures and trade facilitation will be provided by the TCA. A possible "win-win situation" can be achieved, with increased trade efficiency and lowered administrative burden. However, without proper selection of trusted business partners, governments may be worse off due to the adverse selection problem caused by information asymmetry. In this paper, we analyze the cause and effect of the adverse selection in the Government-to-Business relationship building. Further, we show that an IT enabled risk assessment approach can effectively eliminate the G2B information asymmetry and solve the adverse selection problem. The AEO assessment approach of DutchTCA is analysed to give a real life application on how IT is enabling the general risk management approach of the DutchTCA.

Aqvist's paradox of epistemic obligation can be solved, if we use knowledge-wh instead of knowledge-that in specifications of the `need to know': the knowledge which an agent in a certain organisational role is required to have. Knowledge-wh is knowledge of an answer to a question, which depends on the context. We show how knowledge-wh can be formalised in a logic of questions, which is combined with standard deontic logic to represent epistemic obligations. We demonstrate that under the new interpretation, the paradox can no longer be derived. The resulting logic is useful for representation of access control policies.

Norms are implemented by administrative procedures. This paper addresses the delegation of control in administrative procedures. Instead of having to check all details, a controlling actor can trust the data provided by other actors, provided they can demonstrate to be `in control'. In this paper we provide a conceptual analysis of situations in which control has been delegated. The approach is based on an analysis of the dependencies between activities performed by the actors involved and on evidence documents. To motivate and illustrate the approach, we discuss a case study about the redesign of EU customs procedures for collecting excise duties.

We provide a conceptual analysis of several kinds of deadlines, represented in Temporal Modal Defeasible Logic. The paper presents a typology of deadlines, based on the following parameters: deontic operator, maintenance or achievement, presence or absence of sanctions, and persistence after the deadline. The deadline types are illustrated by a set of examples.

This paper describes the use of coherence constraints as a means to regulate agent interaction. Coherence constraints describe relationships between the content of utterances, and the context. They can be used for example to express that an answer must refer back in a meaningful way to the question that it answers. We also discuss several possible ways in which the enforcement of coherence constraints can be implemented in a multiagent system. Finally we describe a possible implementation in the 3APL platform, which shows the feasibility of this form of interaction regulation.

In the paper we study the dynamics of roles played by agents in multiagent systems. We capture role dynamics in terms of four operations performed by agents: ‘enactment', ‘deactment', ‘activate', and ‘deactivate'. The use of these operations is motivated, in particular for open systems. A formal semantics for these operations is provided. This formalization is aimed at serving as a basis for implementation of role dynamics in an agent programming language such as 3APL.

In this paper we are interested in argument based reasoning for access control, for example in the context of agents negotiating access to resources or web services in virtual organizations. We use a logical framework which contains agents with objectives concerning access to a resource or provision of a service, including security objectives. The access control mechanism is described by a set of policy rules, that specify that access to a resource or service requires a specific set of credentials. Our contribution is a formalization of the reasoning about access control using a planning theory formalized in Dung's abstract argumentation framework. We build on Amgoud's argumentation framework for plan arguments, which is based on an adaptation of Dung's notion of defence. Our formal argumentation framework allows arguments about the backward derivation of plans from objectives and policy rules (abduction), as well as arguments about the forward derivation of goals from general objectives. We show that reasoning about the feasibility of goals requires mixed goal-plan arguments, and we show how to formalize the plan arguments in Dung's framework without adapting the notion of defence.

In this paper we investigate the specification and verification of infor- mation systems with an organizational structure. Such systems are modelled as a normative multiagent system. To this end we use KBDIOCTL, an extension of BDICTL in which obligations and permissions are represented by directed modal operators. We illustrate how the logic can be used by introducing and discussing various properties of normative systems and individual agents which can be rep- resented in the logic. In particular we discuss the enforcement of norms.