Search

This article describes how in regulatory supervision some form of collaboration is necessary between regulator and company in the way evidence about compliance is collected and evaluated. How to arrange such collaboration? In this article, we investigate specific ideas about continuous control monitoring and apply them to regulatory supervision. By means of a design science approach, we propose a particular governance mechanism for continuous monitoring of compliance. We derive objectives based on the literature about regulatory supervision and about auditing. By means of a case study of a new customs supervision mechanism for container terminals in a large port, we identify legal, economic and technical feasibility conditions. In particular, we discuss the role of an intermediary. The case shows that continuous control monitoring is legally and technically feasible in the customs domain, and that a suitable party can be found to play the role of intermediary. However, a good business case for parties to invest in such a system needs to be developed.

Much compliance effort concerns adherence to contracts. Parties to a contract need to make sure that the other parties will deliver. To this end they may require additional controls in the business process to monitor delivery and induce contractual penalties when needed. Controls have costs. In this paper the authors argue that introducing fully automated controls will help to reduce control costs, because (i) they can prevent misstatements (compliance by design) or (ii) they increase the quality of evidence and thereby reduce the audit risk for the external auditor and corresponding audit fees. The line of reasoning is illustrated by a case study of the implementation process of automated controls on the procurement process for public transport services for the elderly and disabled. This is a complex and heavily regulated domain. The case study indicates that control automation makes monitoring compliance to contracts in such complex domains feasible and that using control automation can in fact reduce the costs of control.

Transforming Business-to-Government (B2G) information exchange is a next frontier for reducing government spending while improving performance. This paper examines two different B2G information exchange architectures that reflect continuing transformations that empower some government agencies to do better compliance monitoring tasks with fewer resources. The win for the reporting companies is the lower cost of compliance. Instead of focusing on collecting compliance information from individual companies, the government agencies in this study focus on collecting information on the supply chain level, allowing for automated data reconciliation. Our findings reveal that pushing controls (automated checks) upstream (in company software and data sources) results in more efficiency, higher information quality and reduces redundant controls. The examined architectures exhibit high levels of compliance by design, meaning that many control objectives are by default encompassed in the design. This requires a well-aligned combination of data standardization (using shared syntax and semantics) and automated information processing (using an intelligent gateway between businesses and government agencies). However, achieving such an alignment is a difficult challenge; especially when taking into account that such transformations require solid governance, trust and high initial investments — prerequisites that are rare in many public-private partnerships.

Compliance is often achieved 'by design' through a coherent system of controls consisting of information systems and procedures. This system-based control requires a new approach to auditing in which companies must demonstrate to the regulator that they are 'in control'. They must determine the relevance of a regulation for their business, justify which set of control measures they have taken to comply with it, and demonstrate that the control measures are operationally effective. In this paper we show how value-based argumentation theory can be applied to the compliance domain. Corporate values motivate the selection of control measures (actions) which aim to fulfil control objectives, i.e. adopted norms (goals). In particular, we show how to formalize the audit dialogue in which companies justify their compliance decisions to regulators using value-based argunlentation. The approach is illustrated by a case study of the safety and security measures adopted in the context of EU customs regulation.

Much legal evidence is being generated by and stored in information systems. In this paper we look at evidence from an auditing point of view. Auditors rely on evidence of the party being audited, who may have a legitimate or illegitimate interest to manipulate it. To assess the quality of audit evidence, we argue for an approach called model-based auditing. It is based on a mathematically precise model of the expected relationships between the flow of money and the flow of goods or services. Such equations are used for cross verification. If the equations do not hold, either something is wrong (violation) or some underlying assumption is false (exception). To show the usefulness of the approach, we look in particular at a case study of a legal dispute about automated contract monitoring. A precise revenue model is instrumental in demonstrating that the data set does indeed constitute appropriate evidence to settle the case.

This paper discusses the challenges of legal norms in specialist domains - the interplay between industry/professional standards and legal norms, the information gap between legal and specialist domains and the need for interpretation at all stages of compliance - design, operation and justification. We propose extensions to the Eunomos legal knowledge management tool to help address the information gap, with particular attention to aligning norms with operational procedures, and the use of domain-specific specialist ontologies from multiple domains to help users understand and reason with norms on specialist topics. The paper focuses mainly on medical law and clinical guidelines.

Business process compliance with regulations has been a topic of many research areas in Computer Science such as Requirements Engineering RE, Artificial Intelligence AI, Logic and Natural Language Processing NLP. This work aims to provide a systematic way of establishing and managing compliance to assist decision-making and reporting. Despite many notable advances, few systems deal adequately with legal interpretation and modeling norms in an expressive way that is well-integrated with business modeling practices. In this paper, we bring together two leading systems, Legal-URN and Eunomos, for a comprehensive compliance management solution.

Maintaining regulatory compliance is an increasing area of concern for business. Legal Knowledge Management systems that combine repositories of legislation with legal ontologies can support the work of in-house compliance managers. But there are challenges to overcome, of interpreting legal knowledge and mapping that knowledge onto business processes, and developing systems that can adequately handle the complexity with clarity and ease. In this paper we extend the Legal Knowledge Management system Eunomos to deal with alternative interpretations of norms connecting it with Business Process Management systems. Moreover, we propose a workflow involving the different roles in a company, which takes legal interpretation into account in mapping norms and processes, using Eunomos as a support.

Maintaining regulatory compliance is an increasing concern. Legal Knowledge Management systems could support the work of compliance managers. However, there are challenges to overcome, of interpreting legal knowledge and mapping it onto business processes. In this discussion paper we determine requirements for Legal Knowledge Management systems that can handle these challenges. We argue that an approach to Legal Knowledge Management should consist of four pillars: (1) a legal ontology to express the legal concepts that are central to the interpretation of rules and regulations in practice, (2) natural language processing techniques, to semi-automatically populate the ontology, (3) a systematic method for mapping the legal concepts onto the actual data and business processes of a company, and (4) a method to construct an audit trail as part of the process design, providing legally acceptable evidence of compliance. The challenges are illustrated by an example of MIFID, a set of European regulations in the financial domain.

Much compliance effort concerns adherence to contracts. Parties to a contract need to make sure the other party fulfills the contract. To this end they may require additional controls in the business process. Controls have costs. In this paper we argue that fully automated controls help to lower control costs, because (i) the can help prevent misstatements (compliance by design) or (ii) they increase the quality of audit evidence and thereby reduce the audit risk and additional audit fees. The line of reasoning is illustrated by a case study of the implementation of automated controls on the procurement process for public transport services for the elderly and disabled. The case study suggests open issues, which can be linked to concepts from Normative Multi Agent Systems.

Recent turmoil in financial markets has invoked governments to monitor activities and transactions in the private sector more strictly. At the same time, policy makers strive to cut back on government spending by reducing the size of government agencies. These contradicting developments require governments to become leaner, meaning that more (new) tasks can be performed with fewer resources. In order to achieve these goals, we see a transformation from paper-based business-to-government information exchange to IT-enabled compliance architectures. However, the shape of these architectures is not yet clear, as are the challenges that come with a specific architecture design. The objective of this paper is to specify the dimensions of IT-enabled compliance architectures and the challenges that rise when transforming to such architectures. Drawing on dimensions described in literature, this paper compares two new compliance architectures, one in the meat processing industry and one in financial reporting. Findings indicate that compliance architectures require different choices regarding the frequency of reporting, the style of control, the formation of regulation, the type of dependencies, the auditing base and the way the underlying infrastructure accommodates business-to-government information exchange. This paper shows that while the transformation to IT-enabled compliance monitoring helps realize a lean-government, the design of the underlying architectures is subject to several, sector specific conditions, including established laws and regulations.

Stricter laws and regulations demand that companies provide business information more timely and accurately to various government agencies. However, this trend increases the administrative burden for companies and the regulatory burden for government agencies. Standard Business Reporting (SBR) is a program that aims to reduce these burdens. Led by government agencies, stakeholders in this program are working towards a national data taxonomy, a single reporting gateway and a secure electronic infrastructure. Anticipated benefits include reduced time and costs for assembling, analyzing and providing business data to government agencies. However, stakeholders face several hurdles that need to be addressed before such benefits can be reaped. Typical hurdles in this transformation include conflicting public and private interests, legal constraints and high security demands. This policy paper presents seven transformation principles gained from the launch of SBR in the Netherlands. The principles are meant to guide stakeholders in proactively dealing with some of the transformation issues that may manifest when launching SBR. While the current scope of SBR is focused on financial reporting, the possibilities for its future application are broader, opening new avenues for digital government research.