Flexible Workflows and Compliance: A Solvable Contradiction?!

Managing workflows is increasingly becoming flexible on both the conceptual and technical level. Reacting directly to new context situations and adapting workflows to changing requests both rapidly and flexibly are seen as key characteristic for future agile companies. Providing flexibility in process execution for single workflow instances is also a promising basis for expanding the scope of Business Process Management to other application fields and for integrating so-called dark processes into the system. However, workflows are not only subject to “pure” business needs but also increasingly to compliance requirements. To validate that a workflow is compliant with relevant laws and regulations, in principal, each change of a workflow has also to be checked according to its consequences for compliance. Not surprisingly, validating compliance is currently a well-known challenge for many companies, specifically their IT governance, and is, usually, a time-consuming manual task dealing with the challenge of fast adaptations and changes. Management has to balance the trade-off between flexible but (possibly) non-compliant workflows and compliant but (mostly) inflexible workflows. Addressing this trade-off, we present a novel approach called FlexCom and its prototypical implementation in this contribution. It aims at solving the trade-off by allowing a person in charge to change a workflow, even during execution, according to business needs, and by automatically integrating required control processes for achieving the correspondent compliance requirements. It is demonstrated that with such “sticky” controls at hand, the balance between flexibility of processes and compliance can be managed in a novel and promising way.