Background: Business process compliance management has recently attracted a lot of attention in both business and academia as it enables organizations to not only control and monitor their business processes from a legal point of view but also to avoid financial penalties and undesirable consequences to their reputation. Objective: This thesis aims to provide a framework that would enable organizations to: 1- Discover business processes that violate regulations, laws and policies; 2- Discover the importance level of business processes based on the organization’s goals; 3- Determine the impact of compliance-related process modifications on business goals, including conflicting goals between stakeholders, and on policies; and 4- Enable organizations to measure the level of business process compliance for one or multiple policies. Methodology: A systematic literature review in the area of goal-oriented business process compliance management and measurement has been conducted, which showed that balancing legal compliance obligations with business objectives remains a difficult challenge. A new Indicator-based Policy Compliance Framework (IPCF), which combines policy and rule models together with models capturing business goals (with their relative importance to the organization) and business processes, has been proposed. This framework builds on the User Requirements Notation (URN), which is the first international standard to combine goal modeling with scenario modeling. The intents and objectives of policies have been modeled, as well as the goals and business processes of organizations, and indicators are used to measure the compliance level of policies. This enables the detection of non-compliant business processes and the evaluation of the impact of compliance-related process modifications on business goals. Human resource policies and business processes are used as an example to illustrate the method. Aerodrome security regulations and business processes are then used to validate the method in a real-life environment. Comparisons to related work, evaluation against different sets of criteria, and tool support complement the framework validation. Results: The Indicator-based Policy Compliance Framework enables organizations to discover business processes that violate policies as well as other types of rules, regulations, and laws. Guidelines for modeling legal text with URN’s Goal-oriented Requirement Language (GRL) are proposed. Furthermore, IPCF helps determine the impact of compliance-related process modifications on business goals, including conflicting goals between stakeholders, and on policies. In addition, as policies sometimes apply differently to different types of organizations, a new profile for GRL, with suitable stereotypes, well-formedness constraints, and a modified analysis algorithm defined for GRL model families is used to evaluate the satisfaction level of individual goal models that are members of a larger family model. Finally, the proposed IPCF enables organizations to measure the level of business process compliance for one or multiple policies, and such measures can be visualized directly in URN models but also through interactive Business Intelligence portals, for a wider diffusion.

我國加入WTO後，保險市場加速開放，保險行銷亦走向多元化，而保險經紀人屬於保險行銷之一環，因此如何健全保險經紀市場以維護保險業之正常運作，並兼顧消費者權益，實係監理機關之一大課題。 2004年10月14日，美國紐約州檢察官史匹哲（Eliot Spitzer）正式起訴國際保險經紀人，此起訴案為保險經紀業界投入震撼彈，引發保險經紀人之利益衝突等問題。而我國亦隨之檢討保險經紀人於保險交易中，雙重代理及保單條件與再保條件不一致之問題。因此如何避免保險經紀人之利益衝突，並尋求解決之道，無疑係現階段各國監理機關之重要課題。 而本文以「論保險經紀人之自律規範與法令遵循」為題，嘗試先就保險經紀人之利益衝突之態樣、國內外案例及解決方法做一探討；其次再就美國、歐洲、巴塞爾銀行監理委員會及國際保險監理官協會等之法令遵循計畫做介紹，嘗試為我國保險經紀人之法令遵循制度勾勒完整之藍圖；再其次針對英國金融服務管理局、保險監理官協會、紐約州之保險經紀人自律規範為介紹，引導出我國保險經紀人自律規範之立法走向；最後做一評析與建議。 / Since the entrance into WTO, the market of insurance is opened speedily and the marketing of insurance also trends to diversify in Taiwan. To be a part of insurance marketing, it is essential for the regulatory to enhance the operation of market of insurance brokers regularly and protect the rights of consumers. In 14 Oct,2004, the New York Attorney General Spitzer filed a civil suit in State Supreme Court in Manhattan, bringing charges of fraud and antitrust violations against leading insurance broker Marsh & McLennan Cos. (MMC). This case shocked the industry of insurance brokers and emerged the scandals of conflict of interest. Therefore the fierce debate on dual brokerage and difference in condition during the process of insurance mediation was going on in Taiwan. So undoubtedly the most important task of the regulatory all over the world right now is to avoid the conflict of interest of insurance brokers and solve it . The main theme of this paper focuses on the issue of Code Of Conduct And Legal Compliance Of Insurance Brokers. In the first place, the forms of conflict of interest of insurance brokers in Taiwan and overseas are addressed and the solutions are suggested. Second, some models of the legal compliance are examined, including U.S., Europe, Basel Committee on Banking Supervision and International Association of Insurance Supervisors. And the structure of legal compliance of insurance brokers in Taiwan is established. Third, the codes of conduct of insurance brokers abroad, ex: the Financial Services Authority of UK, National Association of Insurance and the Insurance Department of New York State are introduced. Then the guidance of code of conduct of insurance brokers in Taiwan is proposed. As possible contribution to the reform of insurance brokers in Taiwan, some conclusive remarks and suggestions are submitted in the final place.

The Basel Committee on Banking Supervision has defined operational risk, legal risk and compliance risk. However, the definitions might not be adequate for countries with a hybrid legal system, such as South Africa. This study aims to provide a practical solution to the problems faced by countries with a hybrid legal system wishing to comply with the Basel Committee’s standards. It is argued that compliance, compliance risk and regulatory risk should all be viewed as constituent components of legal risk, and in turn necessarily also of operational risk in a hybrid legal system. Legal risk is a wide concept which includes all aspects of a legal system, while compliance risk is a narrower concept which only includes the codified aspects of a legal system. Legal risk therefore includes compliance risk. However, the opposite is not true as compliance risk does not include legal risk, and the two concepts are decidedly shown not to be synonymous in a mixed legal system. / Thesis (PhD (Law))--North-West University, Potchefstroom Campus, 2013.

The Basel Committee on Banking Supervision has defined operational risk, legal risk and compliance risk. However, the definitions might not be adequate for countries with a hybrid legal system, such as South Africa. This study aims to provide a practical solution to the problems faced by countries with a hybrid legal system wishing to comply with the Basel Committee’s standards. It is argued that compliance, compliance risk and regulatory risk should all be viewed as constituent components of legal risk, and in turn necessarily also of operational risk in a hybrid legal system. Legal risk is a wide concept which includes all aspects of a legal system, while compliance risk is a narrower concept which only includes the codified aspects of a legal system. Legal risk therefore includes compliance risk. However, the opposite is not true as compliance risk does not include legal risk, and the two concepts are decidedly shown not to be synonymous in a mixed legal system. / Thesis (PhD (Law))--North-West University, Potchefstroom Campus, 2013.

Submitted by Clebson Anjos (clebson.leandro54@gmail.com) on 2016-02-11T19:32:02Z No. of bitstreams: 1 arquivototal.pdf: 4976069 bytes, checksum: f6823a093e9be9d6a14113d2ff7e56f3 (MD5) / Made available in DSpace on 2016-02-11T19:32:02Z (GMT). No. of bitstreams: 1 arquivototal.pdf: 4976069 bytes, checksum: f6823a093e9be9d6a14113d2ff7e56f3 (MD5) Previous issue date: 2014-07-24 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - CAPES / In software development process, Requirements Engineering is responsible for identifying what are the objectives of the desired product, its features, activities and constraints, based on the understanding of the scenario where this product is used and/or expected behaviors by users. To interact directly or indirectly with the people, the products and the processes impacted by them, are required to comply with the legal regulations related and found in the legal rules or laws. At the organizational level, these regulations determine how business practices should be, which will be reproduced for their products/processes. The Legal Compliance is a requirement imposed on organizations by government departments and their non-compliance may result in legal and financial problems for these organizations. It is the role of Requirements Engineering dealing with legal compliance in these scenarios. In this context, the Nòmos framework extends the i* framework to achieve legal compliance requirements of information systems and business processes. Nòmos proposes a systematic and cohesive method to achieve this goal, from the execution of activities of elicitation, modeling and negotiation of requirements and laws. However, Nòmos was designed to be used in requirements models represented in i*. Since i* is not widely used in industry, dependence on i* can hurt the adoption of Nòmos as a process to achieve legal compliance in Requirements Engineering. In this sense, this work proposes to adapt the process of Nòmos, making it less dependent on i* and more flexible to be used with other modeling languages requirements. So, was created the GenNormas, in order to guide the acquisition of legal compliance of software requirements or business processes specified in other modeling languages, in addition to i *. Finally, to illustrate the use of our approach, it has been applied in the specification of a hypothetical system, connected to the e-commerce domain, applying GenNormas in requirements specification models, such as the Business Process Modeling Notation (BPMN), in Use Case Diagram and the User Stories. / No processo de desenvolvimento de software, a Engenharia de Requisitos é responsável por identificar quais são os objetivos do produto pretendido, suas funcionalidades, atividades e restrições, a partir do entendimento do cenário onde este produto será utilizado e/ou dos comportamentos esperados por seus usuários. Por interagirem direta ou indiretamente com as pessoas, estes produtos, e os processos impactados por eles, estão obrigados a cumprirem com as regulamentações jurídicas relacionadas e encontradas nas normas jurídicas ou leis. No âmbito organizacional, estas regulamentações determinam como devem ser as práticas de negócio, que serão reproduzidas por seus produtos/processos. A conformidade legal é uma exigência imposta às organizações pelos departamentos governamentais e o seu não-cumprimento pode acarretar transtornos judiciais e financeiros às organizações. É papel da Engenharia de Requisitos lidar com a conformidade legal nestes cenários. Nesse contexto, o Framework Nòmos estende o Framework i* para alcançar a conformidade legal dos requisitos de sistemas de informação e de processos de negócio. Nòmos propõe um método sistemático e coeso para atingir este objetivo, a partir da execução de atividades de elicitação, modelagem e negociação de requisitos e leis. Porém, Nòmos foi concebido para ser usado em modelos de requisitos representados em i*. Visto que o i* não é usada amplamente na indústria, a dependência do i* pode prejudicar a adoção do Nòmos como processo para alcançar a conformidade legal na engenharia de requisitos. Neste sentido, esta dissertação propõe adaptar o processo do Nòmos, tornando-o menos dependente do i* e mais flexível para ser utilizado com outras linguagens de modelagem de requisitos. Assim, foi criado o GenNormas no intuito de guiar a obtenção da conformidade legal de requisitos de software ou de processos de negócio especificados em outras linguagens de modelagem, além do i*. Finalmente, para exemplificar a utilização da nossa abordagem, ela foi aplicada na especificação de um sistema hipotético, ligado ao domínio do comércio eletrônico, aplicando o GenNormas em modelos de especificação de requisitos, como a Notação de Modelagem para Processos de Negócio (BPMN), no Diagrama de Caso de Uso e nas Estórias de Usuário.

Le souci du respect de la législation applicable en matière de Santé et de Sécurité au Travail (SST) est longtemps resté absent des politiques managériales des entreprises, et ce quelle que soit leur taille. Cependant, sous l'effet de pressions légales, économiques, sociales ou encore en raison du développement de référentiels normatifs dans ce domaine (exemples : OHSAS 18001), les employeurs sont incités à développer des dispositifs de maîtrise de la conformité légale plus ou moins complexes. Cependant, la mise en œuvre de véritables Systèmes de Maîtrise des Conformités (SMC) implique le déploiement de ressources humaines, financières, temporelles, méthodologiques mais également technologiques importantes. Pour faire face à cette situation, différentes catégories de prestataires de services proposent désormais des solutions de suivi et de gestion de la conformité. Malgré cela, l'étude de l'état des pratiques d'entreprise en matière de maîtrise des conformités légales SST montre que ces dernières sont encore extrêmement hétérogènes et que des besoins en matière de méthodes ou encore d'outils de consolidation des données (rapports de conformité, plans d'actions, ...) apparaissent nettement. En s'appuyant sur ces éléments de contexte, ce travail de recherche propose la modélisation d'un Système de Maîtrise des Conformités répondant aux besoins exprimés par de nombreuses entreprises afin de gérer des aspects tels que la veille réglementaire, les évaluations de conformité ou encore la gestion des plans d'actions. Afin d'évaluer l'intérêt et la pertinence du modèle proposé, plusieurs expérimentations ont été conduites en entreprise. Une synthèse des résultats obtenus est présentée à la fin de ce travail. / The problematic of legal rulings concerning Occupational Health and Safety atwork (OHS) was absent from companies management policies for a long time, regardless of their size. However, because of legal, economic, social pressures and the development of normative references in the field of OHS (such as OHSAS 18001), employers are encouraged to develop more or less complex compliance management devices. Nevertheless, the implementation of a real Compliance Management System (CMS) forces to deploy important human, financial, time, methodological and technical resources. To face this situation, different categories of services providers henceforth propose monitoring and management solutions. Despite this, the study of companies state practices in the field of mastering OHS legal compliance shows that these practices are extremely heterogeneous and that needs concerning methods and data consolidation tools (compliance reports, action plans…) clearly appear. Based on these context elements, this research work proposes the modelling of a Compliance Management System responding to needs expressed by many companies to deal with aspects such as regulatory monitoring, compliance assessment and action plans management. To evaluate the interest and the relevance of the proposed model, several experimentations were conducted in companies. A synthesis of the results obtained is presented at the end of this research work.

This paper investigates how audio monitoring systems should be designed, in the context of smart cities and in accordance with Swedish legislation. Audio monitoring for smart cities is promising and have previously shown great potential. However its opportunities are still relatively unexplored. ShotSpotter is one of several examples of audio monitoring in the context of smart cities. In the US only, the system has successfully been used to alert and locate shootings in over 90 cities. However, the technology is surrounded by controversies and there has been debate whether audio monitoring systems are compatible with law. Compatibility is critical since incompatibility could result in severe sanctions. Research related to this paper has been conducted according to the Design Science research strategy. The research resulted in design guidelines for audio monitoring systems, for law enforcement purposes, in accordance with Swedish law. The design guidelines are based upon existing audio monitoring systems, previous research and empirical data. The empirical data consists of 12 interviews with experts in law, phonetics and digital forensics. Additionally, the design guidelines have been evaluated by an expert in a criteria-based evaluation interview. Results of the research shows that it is, in fact, possible to design audio monitoring systems, in the context of smart cities, in accordance with Swedish legislation. The design guidelines can be applied in the development of audio monitoring systems with law enforcement purposes. With some modification, they can also be used for audio monitoring systems with other purposes. / Uppsatsen syftar till att undersöka hur ljudövervakningssystem inom ramen för smarta städer- konceptet bör utformas i enlighet med svensk lagstiftning. Ljudövervakning för smarta städer har visat på stor potential och ännu är dess möjligheter outforskade. ShotSpotter är ett av flera exempel på ljudövervakning inom ramen för smarta städer. Systemet har med framgång använts för att uppmärksamma och lokalisera skottlossningar i över 90 amerikanska städer. Det råder dock debatt huruvida ljudövervakningssystemet är kompatibelt med lagstiftning. Denna kompatibilitet är kritisk då det motsatta kan resultera i stränga påföljder och därmed utgöra direkta hinder för implementation. Forskning i relation till uppsatsen har genomförts inom ramen för forskningsstrategin Design Science. Forskningsprocessen har mynnat ut i designriktlinjer för hur ett ljudövervakningssystem med brottsbekämpande syfte bör utformas i enlighet med svensk lagstiftning. Designriktlinjerna baseras på befintliga ljudövervakningssystem, tidigare forskning och omfattande empiriskt underlag. Det empiriska underlaget utgörs av 12 intervjuer med olika typer av experter inom juridik, fonetik och IT- forensik. Designriktlinjerna har med framgång utvärderats i en kriteriebaserad expertintervju. Av forskningsresultatet att döma är det möjligt att utforma ljudövervakningssystem för smarta städer i enlighet med svensk lagstiftning. De framtagna designriktlinjerna kan användas vid utveckling av ljudövervakningssystem med brottsbekämpande syfte. Med viss modifikation kan de även användas för ljudövervakningssystem med andra syften.