- Any business activity is performed only as prescribed and any unintended use of information (e.g., access to information resources unrelated to the work performed) would be impossible in principle.
- Organization and initial planning of business activities must be validated for the compliance with the formal rules of information security.
- Execution and operational planning of business activities must be constantly validated for the compliance with the formal rules of information security.
Control of access to an informational resource along the process
In simple cases, the control of access to an informational resource can be rigidly connected to the phases of the life cycle of the resource. The latter can be implemented as a business process. Explicit and executable business process is convenient because the whole dynamic of control access is embedded in the process.
Control of access to an informational resource within an activity
In more complex cases, information resources linked to specific business activities. An employee, appointed for the carrying out of a particular business activity, gets access to the information resources required for the carrying out this business activity, only for the duration of this business activity.
Separation of duty within a business process
Separation and imposition of duty among several business processes
In a general form, relationships between business activities should be established and formally registered. A non-inclusive list of such relationships is the following:
- Other activities which validate the results of the given activity.
- Other activities which define the governance for the given activity.
- Other activities which do the handling exceptional situations for the given activity (error handling, escalations, send for review and delegate).
- Other activities which audit the given activity (1st, 2nd and 3rd party audit).
- Other activities which evaluate the risks before the given activity.
- Other activities which evaluate the risks after the given activity.
- Other activities which certify the given activity (1st, 2nd and 3rd party certification).
- Other activities which do compensation (undo) for the given activity.
These relationships between activities define some limitations that roles and actors may carry out what activities: the same actor or a different actor from a different role or a different actor from the same role. For example, if the “Activity_B” validates the results of “Activity_A” then no actor should be in “Role_1” and “Role_2” simultaneously.
Management of risk along business processes
Managing any work by processes is the key business capability with allows to address the risk-related issues in a proactive manner. The risk is strongly related to how the business processes are carried out. By understanding a process (i.e. through being able to simulate it) the business may predict how the risk is changing during the execution of that process. The explicit description of processes permits to add a few “check-points” within any process to examine its risk-related “health”.
Business processes act as a skeleton to which the enterprise adds risk management (as shown on the picture below) – each usual activity is enriched by risk-related monitoring and evaluation.
The risk evaluation may initiate some risk mitigation processes. The risk evaluation may be as complex as necessary, and it may include simulations (e.g. value at risk and stress testing), and the conduct of statistical and scenario analysis.
Delenda est "vendor-centric BPM"