Embedding governance risk and compliance (GRC) elements in business process modeling

An understanding of an entity's business processes preconditions the assessment of process-level's risks and control. Despite the importance, there has been little work in the integration of governance, risk and compliance issues with how the business process models are designed and deployed. This paper intends to look at and elaborate the available business process modeling grammars showcasing the integration between risks and controls aspects with business process models. Given that process models were among the artifacts generally found in many system developments, integrating risk and control consideration onto business process models is believed to help analysts and designers to better accommodate the governance dimensions of system development. Selected studies were discussed from a viewpoint of approach of integrating risk elements with business process models. Two streams of approach were identified: those that embed the risks and control elements as part of formal design, and those that embed the elements as part of user analytical purpose.