Modeling and reconfiguration of critical business processes for the purpose of a business continuity management respecting security, risk and compliance requirements at Credit Suisse using algebraic graph transformation (Extended version)

Critical business processes can fail. A Business Continuity Management System is a special management system that will define how to recover from such failures and specifies temporary work-arounds to make sure a company is not going out of business in the worst case. However, because today's implementations are primarily organizational best-practice solutions, their security, risk and compliance issues in such a recovery situation are mostly unknown. Algebraic graph theory can be used as a formal method supporting employees when running business processes need to be reconfigured to recover from specific failures. The example discussed is a loan granting process in a real-world banking environment. Because such a process has to respect certain laws, regulations and rules even in emergency situations, we sketch how this can be done during the process reconfiguration by looking at security, risk and compliance issues, compatible with the graph technique. Furthermore, we show how the analysis can be extended to requirements concerning the information flow using the process algebra mCRL2