Annotated Bib.: Enhancing Business Impact Analysis and Risk Assessment Applying a Risk-Aware Business Process Modeling and Simulation Methodology

[1] S. Tjoa, S. Jakoubi, and G. Quirchmayr. Enhancing business impact analysis and risk assessment applying a risk-aware business process modeling and simulation methodology. In ARES, pages 179–186. IEEE Computer Society, 2008.

The paper starts by giving some statistics and numbers to show how risks and incidents can affect business process, and explain how that the two domains of BPM and Risks does not have an integration, which made the authors to introduce ROPE (Risk-Oriented Process Evaluation) methodology, which was introduced in a previous paper. This paper is only to show the application of the ROPE methodology and the benefits of using it.

In the next section it briefly explained the ROPE methodology and its five iterative processes: Strategic Decision Process, Re-Engineering Process, Resource Allocation Process, Workflow Management Process, and Performance Evaluation Process. It also explained its three layers: TIP (Threat Impact Process) layer, CARE (Condition, Action, Resource and Environment) layer, and BP layer.

The paper then used business impact analysis (BIA) to compare between the ROPE methodology and other standards and widely accepted good practice guidelines. Then used risk assessment to also compare ROPE to other standards and guidelines. Then section 5 was dedicated to show how applying the ROPE methodology would enhance BIA and Risk assessment; the paper presented two case studies for each aspect to prove the strength of the ROPE methodology.

The paper conclude that based on the case studies the ROPE methodology supporting a business impact analysis leads to succeeding benefits, as well as using the ROPE methodology supporting a risk assessment.

Relation to research on hand, the paper proves the usefulness of the ROPE methodology, which can be used to integrate risk in modelling, along with providing a methodology to integrate Risk; the paper also provides a technique that can be used to prove our methodology. On the other hand we can make use of the ROPE methodology to integrate other security aspects.