1. Michael Radloff, Martin Schultz 12th International Conference BPM 2014 Modeling Concepts for Internal Controls in Business Processes – an Empirically Grounded Extension of BPMN Michael Radloff, University of Hamburg Martin Schultz, University of Applied Sciences Wedel

2. 10.9.2014 Michael Radloff, Martin Schultz Agenda / Outline Slide 2 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN Motivation and Background Summary and Next Steps Concept of an Extension for Internal Controls Interchange Format & Application Example 1 2 3 4Evaluation 5

3. 10.9.2014 Michael Radloff, Martin Schultz Slide 3 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 1 – Motivation and Background IS Support for Business Process Audits Subject to Financial Audits Business Processes Financial Statements ERP  Business processes constitute an important audit subject in current audit practices  Still, process audits entail manual audit procedures for  Survey actually effective business processes (e.g. interviews)  Check of compliance throughout the fiscal year by reviewing control documents on a sample basis  Audit-relevant information is readily available in ERP systems  Reason: Lack of comprehensive IS support for process audits

4. 10.9.2014 Michael Radloff, Martin Schultz Slide 4 1 – Motivation and Background Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN  Typical Examples from an audit company for documenting Processes and related control Means. Controls Documentation Process Model for Audit Purpose, Source: PwC Control Matrix

5. 10.9.2014 Michael Radloff, Martin Schultz Business Process Compliance (BPC) Domain Model Slide 5 1 – Motivation and Background  With empirical Research relevant constructs for Process Audit are derived  Expert Interviews (17 Experts)  Online Survey (270 Participants)  Construction of a Domain Model  Separate Concepts for Compliance and Business Process Management Domain  Complex Relation of „Control Means“ considered BPC Domain Model, Martin Schultz 2013 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN

6. 10.9.2014 Michael Radloff, Martin Schultz Control Means and Properties Slide 6 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 2 – Concept of an Extension for Internal Controls Morphological Box for Control Means Internal Control System, German Audit Standard (IDW PS 260)  Controls as Process Integrated Means  Element of Process Flow  Procedural Control  Characteristics of Control Means  Morphological Box  Essential Properties: Nature, Timing, Frequency

7. 10.9.2014 Michael Radloff, Martin Schultz BPMN 2.0.1 Elements (MOF Representation of the meta model) BPMN+C Extension Elements Slide 7 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 2 – Concept of an Extension for Internal Controls Conceptual Model for the Extension “BPMN+C“

8. 10.9.2014 Michael Radloff, Martin Schultz Notation  Representation as Marker  Timing Type (preventive, detective)  Use of Task to specify Nature  Nature Type (automated, manual) Slide 8 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 2 – Concept of an Extension for Internal Controls

9. 10.9.2014 Michael Radloff, Martin Schultz Interchange via XML Schema Document (XSD)  Method “BPMN+X“  Rule set, UML Profile  Model-to-Modell & Model-to-Code Transformation  Tool for Transformation: Eclipse  Use of UML Profile “BPMN+X“  Transformations (QVT & JET)  Generation of XSD and binding  XSD compliant with BPMN 2.0.1  XSD can be transferred to code  Java Classes & Object Factory  XML for an extended Model can be created by code  Basis for automated software solutions Slide 9 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 3 – Interchange Format and Application Example

10. 10.9.2014 Michael Radloff, Martin Schultz Slide 10 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 3 – Interchange Format and Application Example

11. 10.9.2014 Michael Radloff, Martin Schultz Online Experiment  1x2 between-group experiment  Same Information each group  Language: german  Duration: approx. 25 Minutes  BPM and/or Audit Professionals  3 Models with increasing complexity  Fictitious Company  Purchase-to-pay business processes  Comprehension Task Performance  Does the extension enhance the model comprehension?  Comprehension Task Efficiency  Does the extension enhance the time of the model interpretaion? Slide 11 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 4 – Evaluation

12. 10.9.2014 Michael Radloff, Martin Schultz Example: Tasks in the Experiment  Identification of Control Means  Click-Task  Time Measurement  Comprehension Questions  Process related  Control Means related Slide 12 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 4 – Evaluation

13. 10.9.2014 Michael Radloff, Martin Schultz Results  78 Participants  N=39 BPMN 2.0, N=39 BPMN+C  Comprehension Task Performance  No statistical significance for a positive effect on comprehension  Comprehension Task Efficiency  Identification of Controls is significantly faster with the BPMN+C Extension Slide 13 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 4 – Evaluation

14. 10.9.2014 Michael Radloff, Martin Schultz Further Research Generalization of the Extension Further BPC related integration and Tool implementation Presented work Domain specific needs Extension Concept “BPMN+C“ Interchange of Extension Evaluation via Experiment Slide 14 Modeling Concepts for Internal Controls – an Empirically Grounded Extension of BPMN 5 – Summary and next Steps ?

15. Michael Radloff, Martin Schultz Thanks for your attention! Documentation Formats in Business Process Audits 21.03.2014 Slide 15 Martin Schultz Business Intelligence & ERP Systems University of Applied Sciences Wedel msz@fh-wedel.de Feldstraße 143 22880 Wedel, Germany Martin Schultz Business Intelligence & ERP Systems University of Applied Sciences Wedel msz@fh-wedel.de Feldstraße 143 22880 Wedel, Germany Michael Radloff Information Systems, Faculty of Economics University of Hamburg michael.radloff@wiso.uni-hamburg.de Max-Brauer-Allee 60 22765 Hamburg, Germany Michael Radloff Information Systems, Faculty of Economics University of Hamburg michael.radloff@wiso.uni-hamburg.de Max-Brauer-Allee 60 22765 Hamburg, Germany