1. Towards a Generic On Line Auditing Tool (OLAT)
Akhil Kumar, Marc Verdonk (Deloitte)
Jan Martijn, Kees, Wil

2. Performance information
Decision-making manager
Responsible manager
Corrective action
Auditor
Alarm
Online portal
Assurance information
Alarm
Follow-up
Audit results
Performance information
Continuous Auditing Tool
Continuous Control Monitoring Tool
Assurance
Process Management Software
Assurance
Process
Control framework

3. Requirements for the OLAT
Business rules
(incl external laws)
Business process
OLAT
Information system
Information
rules
feedback

4. Requirements for OLAT: context
The IS should be the official source of data,
all official events are recorded in the IS
all decisions or commitments made by people have to be recorded and confirmed by the IS before they are valid
The IS should never delete or update a record in the database; only additions with time stamps
The OLAT should be independent of the IS, which means:
it should be based on the source data of the IS
it should evaluate the business rule with its own algorithms

5. Requirements for the OLAT: assurance
Three levels of assurance
Detective: the log satisfies the business rules
Prospective: detective plus the process model discovered from the log satisfies the business rules
Corrective: detective plus (human) correction measures
Preventive: controls that prevent events in the real process to avoid business rule violations.

6. Design of the OLAT: functions
The Monitor should record the events with the corresponding data:
The input from external sources together with the data presented to them before and after the input.
This data will be stored in a event datawarehouse (or log)
Three computational functions for auditing:
Rule evaluation on the traces in the log by: LogLogic, LTL checker, checker or SQL queries: Detective
Discovery of the process model and analysis of potential paths: Prospective
History-based Petri nets: transition guards: Preventive

7. Design: Architecture

8. Design: Data model

9. Challenges for the future
Generation of the Event Database Schema from the Business Rules
Can we translate all relevant business rules to predicate logic on the model?
How generic can we make the Monitor as a service?
With the Monitor we can create a learning system: start with a flower net as process model in the information system and by mining we discover business rules that can be used as guards!