riskaBPMN - a BPMN extension for risk assessment

Abstract

The growth in use of business processes (BP) in critical systems, vital to create or maintain business value in organizations, has driven the need and interest in assessing their risk. For assessing risk in BPs, one needs to characterize risk and its representation in BPs. To support risk characterization, we can find in the literature some proposals that enrich the BPMN language with risk information, such as risk events, likelihood, impact, and mitigation actions. However, none of them comprises risk assessment with a standard BPMN extension. In this work we define a BPMN extension, using its native extension mechanism, for quantitative risk assessment. It enriches BPMN with information about likelihood and consequences of failures, in terms of business value, in different granularities of processes fragments. In addition, we also consider a quantitative risk acceptance criterion, which will be used for risk evaluation.