Methods and systems for transaction compliance monitoring

Abstract

An automated transaction integrity monitoring system ( 100 ) operative to monitor electronic transactions of an enterprise and detect exceptions indicating noncompliance with enterprise policies. An extractor ( 140 ) obtains data from heterogeneous data sources such as enterprise databases. A staging database ( 155 ) caches data from the data sources. A mapper ( 150 ) maps enterprise data into an enterprise ontology used to express enterprise policies. A knowledge base ( 165 ) stores computer-executable policy statements, extractor data, and mapper data. A monitoring database ( 175 ) stores data mapped in the enterprise ontology. A collaborative reasoning engine (CORE) ( 160 ) executes policy statements against the monitoring database and determines exceptions. An exceptions database ( 185 ) stores exceptions from CORE. A case management system ( 190 ) provides for analysis and tracking of exceptions.

1 . A system for monitoring transactions of an enterprise stored in one or more enterprise applications associated with the enterprise to determine possible lack of compliance of a particular transaction with one or more predetermined compliance policies of the enterprise, comprising: 
 a data extractor coupled for data communications with one or more enterprise systems for extracting a selected subset of information about a monitored transaction and storing the selected subset of information in a monitoring database;    a transaction analysis engine for executing one or more computer-executable compliance policy statements against the monitoring database; and    a reporting component for providing an output corresponding to an exception indicating a possible lack of compliance with a policy reflected by the one or more compliance policy statements.    
     
     
         2 . The system of  claim 1 , wherein the reporting component comprises a user interface operative for displaying information relating to exceptions, entities associated with exceptions, and support entities associated with either exceptions or with an entity that triggered an exception.  
     
     
         3 . The system of  claim 1 , further comprising a normalizing component for normalizing the selected subset of information from the enterprise system against a monitoring ontology and storing normalized data corresponding to the selected subset of information in the monitoring database.  
     
     
         4 . The system of  claim 3 , further comprising a knowledge base for storing the policy statements, extraction information utilized by the data extractor, a monitoring ontology, and mapping information.  
     
     
         5 . The system of  claim 1 , further comprising a staging database for caching information received from an enterprise database prior to storage in the monitoring database.  
     
     
         6 . The system of  claim 1 , further comprising a component for adding metadata to the selected subset of information about a monitored transaction from the enterprise database to form a monitoring entity that is stored in the monitoring database.  
     
     
         7 . The system of  claim 6 , wherein the metadata comprises revision information that allows comparison of different versions of an entity over a period of time, 
 whereby the occurrence of changes over time to data in the enterprise database are detected and preserved, so that multiple sequential versions of particular monitored entities are preserved.    
     
     
         8 . The system of  claim 6 , wherein the metadata comprises a timestamp and actor identification information.  
     
     
         9 . The system of  claim 1 , further comprising an exceptions store for storing a plurality of exceptions.  
     
     
         10 . The system of  claim 1 , further comprising a case management system for storing a plurality of related exceptions, and providing a management and reporting function based on information from the plurality of related exceptions.  
     
     
         11 . The system of  claim 1 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, and further comprising a mapper operative to normalize information from disparate databases via by a common ontology so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.  
     
     
         12 . The system of  claim 1 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         13 . The system of  claim 12 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         14 . The system of  claim 13 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         15 . The system of  claim 12  wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         16 . The system of  claim 12 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to the monitored transaction.  
     
     
         17 . A method for monitoring transactions of an enterprise stored in one or more enterprise applications associated with the enterprise to determine possible lack of compliance of a particular transaction with one or more predetermined compliance policies of the enterprise, comprising the steps of: 
 extracting a selected subset of information about a monitored transaction from one or more enterprise systems;    storing the selected subset of information in a monitoring database;    executing one or more computer-executable compliance policy statements against the monitoring database; and    providing an output corresponding to an exception indicating a possible lack of compliance with a policy reflected by the one or more compliance policy statements.    
     
     
         18 . The method of  claim 1 , wherein the output is provided via a user interface operative for displaying information relating to exceptions, entities associated with exceptions, and support entities associated with either exceptions or with an entity that triggered an exception.  
     
     
         19 . The method of  claim 1 , further comprising the steps of normalizing the selected subset of information from the enterprise system against a monitoring ontology and storing normalized data corresponding to the selected subset of information in the monitoring database.  
     
     
         20 . The method of  claim 3 , further comprising the step of storing the policy statements, extraction information utilized in the extracting step, a monitoring ontology, and mapping information in a knowledge base.  
     
     
         21 . The method of  claim 1 , further comprising the step of caching information received from an enterprise database in a staging database prior to storage in the monitoring database.  
     
     
         22 . The method of  claim 1 , further comprising the step of adding metadata to the selected subset of information about a monitored transaction from the enterprise database to form a monitoring entity that is stored in the monitoring database.  
     
     
         23 . The method of  claim 6 , wherein the metadata comprises revision information that allows comparison of different versions of an entity over a period of time, 
 whereby the occurrence of changes over time to data in the enterprise database are detected and preserved, so that multiple sequential versions of particular monitored entities are preserved.    
     
     
         24 . The method of  claim 6 , wherein the metadata comprises a timestamp and actor identification information.  
     
     
         25 . The system of  claim 1 , further comprising the step of storing a plurality of exceptions in an exceptions store.  
     
     
         26 . The system of  claim 1 , further comprising the steps of storing a plurality of related exceptions in connection with a case management system, and providing a management and reporting function based on information from the plurality of related exceptions.  
     
     
         27 . The method of  claim 1 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, and further comprising the step of normalizing information from the heterogeneous databases via by a common ontology so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.  
     
     
         28 . The method of  claim 17 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         29 . The method of  claim 28 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         30 . The method of  claim 29 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         31 . The method of  claim 28  wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         32 . The method of  claim 28 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to the monitored transaction.  
     
     
         33 . A system for monitoring transactions of an enterprise stored in one or more enterprise systems associated with the enterprise to determine possible lack of compliance of a particular transaction with one or more predetermined compliance policies of the enterprise, comprising: 
 a data extractor for extracting a selected subset of information about a monitored transaction from an enterprise system;    a mapper for normalizing data corresponding to the selected subset of information in a monitoring database;    a transaction analysis engine for executing one or more computer-executable compliance policy statements against the data stored in the monitoring database and determining an exception; and    a reporting component for providing an output corresponding to the exception as indicating a possible lack of compliance with a policy reflected by the one or more compliance policy statements.    
     
     
         34 . The system of  claim 33 , wherein the data extractor is operative to effect an initial master extraction to obtain an initial selected subset of information corresponding to one or more monitored transactions, and thereafter operative to extract changed information.  
     
     
         35 . The system of  claim 34 , wherein the data extractor comprises one or more of the following: a programmatic extractor, a log extractor, a resync extractor, and an external data source extractor.  
     
     
         36 . The system of  claim 33 , wherein the extractor obtains data from disparate data sources.  
     
     
         37 . The system of  claim 33 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, and wherein the mapper is operative to normalize information from the heterogeneous databases via by a common ontology so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.  
     
     
         38 . The system of  claim 33 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         39 . The system of  claim 38 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         40 . The system of  claim 39 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         41 . The system of  claim 38 , wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         42 . The system of  claim 38 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to a monitored transaction.  
     
     
         43 . A method for monitoring transactions of an enterprise stored in one or more enterprise systems associated with the enterprise to determine possible lack of compliance of a particular transaction with one or more predetermined compliance policies of the enterprise, comprising the steps of: 
 extracting a selected subset of information about a monitored transaction from an enterprise system;    normalizing data corresponding to the selected subset of information in a monitoring database;    executing one or more computer-executable compliance policy statements against the data stored in the monitoring database and determining an exception; and    providing an output corresponding to the exception as indicating a possible lack of compliance with a policy reflected by the one or more compliance policy statements.    
     
     
         44 . The method of  claim 43 , wherein extracting step comprises an initial master extraction to obtain an initial selected subset of information corresponding to one or more monitored transactions, and thereafter extracting changed information.  
     
     
         45 . The method of  claim 44 , wherein extracting step is effected by one or more of the following computer software components: a programmatic extractor, a log extractor, a resync extractor, and an external data source extractor.  
     
     
         46 . The method of  claim 43 , wherein step of extracting comprises obtaining data from disparate data sources.  
     
     
         47 . The method of  claim 43 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, and wherein the step of normalizing comprises mapping information from the heterogeneous databases via by a common ontology into a schema of the monitoring database so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.  
     
     
         48 . The method of  claim 43 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         49 . The method of  claim 48 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         50 . The method of  claim 49 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         51 . The method of  claim 48  wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         52 . The method of  claim 48 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to the monitored transaction.  
     
     
         53 . A system operative for monitoring transactions of an enterprise stored in one or more enterprise systems, the transactions corresponding to one or more business transactions of the enterprise, and indicating possible lack of compliance of a business transaction with one or more predetermined policies of the enterprise, comprising: 
 a communications interface for coupling to the one or more enterprise databases for receiving data;    an extractor for extracting a selected subset of information about monitored transactions from an enterprise system via the communication interface, the selected subset of information corresponding to a predetermined selection of data fields from a predetermined selection of database tables storing business transactions;    an enterprise ontology store;    a mapper for normalizing the selected subset of information in accordance with the enterprise ontology by mapping the extracted selected subset of information into predetermined corresponding normalized data fields of a monitoring database;    a monitoring database for storing the normalized subset of information as a monitoring entity;    a knowledge base for storing one or more computer-executable policy statements, the policy statements representing one or more predetermined policies of the enterprise that apply to the data of monitoring entities;    a transaction analysis engine for executing one or more of the policy statements from the knowledge base against the monitoring entities in the monitoring database; and    an exceptions store operative in response to the determination from the execution of a policy statement of an exception to a predetermined policy, for storing information corresponding to the exception indicating a possible lack of compliance with the predetermined policy.    
     
     
         54 . The system of  claim 53 , further comprising an informational display for displaying information identifying monitoring entities that correspond to the exception.  
     
     
         55 . The system of  claim 53 , wherein the mapper is operative to associate version information with each monitoring entity, 
 whereby the occurrence of changes over time to data in the enterprise database are detected and preserved, so that multiple sequential versions of particular monitored entities are preserved.    
     
     
         56 . The system of  claim 53 , wherein a policy statement contains an expression of a sequential relationship between a plurality of business transactions, whereby the occurrence of a second type of business transaction occurring before a first type of business transaction corresponds to an exception.  
     
     
         57 . The system of  claim 56 , wherein the first type of business transaction is a purchase order, and the second type of business transaction is a payment.  
     
     
         58 . The system of  claim 53 , wherein the enterprise system includes a component operative for effecting predetermined enterprise system policies that are specific to the particular enterprise, and 
 wherein the predetermined policies effected by the computer-executable policy statements are operative to detect circumvention of the predetermined enterprise system policies.    
     
     
         59 . The system of  claim 58 , wherein the policy statements relate to a business activity sequence that can be overridden by an enterprise system user in circumventions of an enterprise system policy, whereby user overriding of policies in the enterprise database are detected.  
     
     
         60 . The system of  claim 53 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, 
 whereby information from disparate databases is normalized by the ontology so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.    
     
     
         61 . The system of  claim 60 , wherein the first heterogeneous database is an ERP database that includes one or more data fields corresponding to bank account information, and wherein the second heterogeneous database is an HR database that includes one or more data fields corresponding to a bank account information, and wherein the policy statement includes logic operative to compare bank account information associated with selected transactions in the ERP database with bank account information associated with selected transactions in the HR database.  
     
     
         62 . The system of  claim 61 , wherein bank account information in the ERP database is a vendor's bank account number, the bank account information in the HR database is employee bank account number, and the policy statement is operative to determine whether there is a correspondence between a bank account of a vendor and a bank account of an employee.  
     
     
         63 . The system of  claim 53 , wherein mapper is operative for storing the data of the selected subset associated with a data field identifier from the enterprise ontology, so that the extracted data is identified in accordance with the enterprise ontology.  
     
     
         64 . The system of  claim 53 , wherein the mapper is further operative for adding metadata to the normalized subsets of information prior to storage in the monitoring database as monitoring entities.  
     
     
         65 . The system of  claim 64 , wherein the metadata is selected from the group: version information, a transactional entity identifier, actor identification information, and a timestamp.  
     
     
         66 . The system of  claim 53 , further comprising an exceptions management system for collecting information relating to a plurality of exceptions.  
     
     
         67 . The system of  claim 66 , wherein the exceptions management system is associated with a case management system that stores information relating to a plurality of related exceptions.  
     
     
         68 . The system of  claim 53 , wherein the exceptions management system is operative for storing status information in association with an exception indicating a status of processing of the exception.  
     
     
         69 . The system of  68 , wherein the status information is one of the group comprising detected, under review, dismissed, and fixed.  
     
     
         70 . The system of  claim 53 , further comprising a component operative for linking a plurality of transactions by retrieving additional information corresponding to other transactions based on predetermined information obtained from one or more exceptions.  
     
     
         71 . The system of  claim 53 , further comprising a program module operative for determining relationships between entities as a function of associations between entities and transactions.  
     
     
         72 . The system of  claim 53 , further comprising a temporary staging database coupled between the extractor and the mapper, and wherein the mapper is operative on data stored in the staging database for its mapping operations, 
 whereby computationally intensive tasks of identifying changed entities and normalizing can be performed without adverse impact on the source enterprise system.    
     
     
         73 . The system of  claim 53 , wherein the extractor is responsive to data provided by a programmatic interface with an enterprise database that provides no direct query capability.  
     
     
         74 . The system of  claim 53 , wherein the extractor is responsive to data provided in a log file from an enterprise database.  
     
     
         75 . The system of  claim 53 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         76 . The system of  claim 75 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         77 . The system of  claim 76 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         78 . The system of  claim 76  wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         79 . The system of  claim 75 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to monitored entities.  
     
     
         80 . A computer-implemented method for monitoring transactions of an enterprise stored in one or more enterprise systems associated with an enterprise, the transactions corresponding to one or more business transactions of the enterprise, to determine possible lack of compliance of a particular business transaction with one or more predetermined policies of the enterprise, comprising the steps of: 
 extracting a selected subset of information about monitored transactions from an enterprise system, the selected subset of information corresponding to a predetermined selection of data fields from a predetermined selection of database tables storing business transactions;    normalizing the selected subset of information into an enterprise ontology by mapping the extracted selected subset of information into predetermined corresponding normalized data fields of a monitoring database;    storing the normalized subset of information in the monitoring database as a monitoring entity;    storing one or more computer-executable policy statements in a knowledge base, the policy statements representing one or more predetermined policies of the enterprise that apply to the data of monitoring entities;    executing one or more policy statements from the knowledge base against the monitoring entities in the monitoring database; and    in response to the determination from the execution of a policy statement of an exception to a predetermined policy, providing an output corresponding to an exception indicating a possible lack of compliance with the predetermined policy.    
     
     
         81 . The method of  claim 80 , further comprising the step of displaying information identifying the monitoring entities that correspond to the exception.  
     
     
         82 . The method of  claim 80 , further comprising the step of associating version information with the monitoring entities so as to facilitate comparison of different versions of the same entity over time, 
 whereby the occurrence of changes over time to data in the enterprise database are detected and preserved, so that multiple sequential versions of particular monitored entities are preserved.    
     
     
         83 . The method of  claim 80 , further comprising the steps of: 
 associating a timestamp with each monitoring entity;    storing the timestamp in the monitoring database in association with the monitoring entity; and    preserving a temporal record of a plurality of timestamped monitoring entities relating to a particular set of information in the monitored database.    
     
     
         84 . The method of  claim 80 , wherein a policy statement stores an expression of a sequential relationship between a plurality of business transactions, whereby the occurrence of a second type of business transaction occurring before a first type of business transaction corresponds to an exception.  
     
     
         85 . The method of  claim 84 , wherein the first type of business transaction is a purchase order, and the second type of business transaction is a payment.  
     
     
         86 . The method of  claim 80 , wherein the enterprise system includes a component operative for effecting predetermined enterprise system policies that are specific to the particular enterprise, and 
 wherein the predetermined policies effected by the computer-executable policy statements are operative to detect circumvention of the predetermined enterprise system policies.    
     
     
         87 . The method of  claim 86 , wherein the policy statements relate to a business activity sequence that can be overridden by an enterprise system user in circumvention of an enterprise system policy, whereby the method can be employed to monitor the overriding of policies in the enterprise database.  
     
     
         88 . The method of  claim 80 , wherein the enterprise systems comprise a plurality of heterogeneous databases that store information relating to business transactions of the enterprise, in which one or more predetermined data fields in a first one of the heterogeneous databases contains information relating to one or more predetermined data fields in a second one of the heterogeneous databases, 
 whereby information from disparate databases is normalized by a common ontology so as to provide for monitoring of business transactions that transcend the transactions stored in a single one of the enterprise's databases.    
     
     
         89 . The method of  claim 88 , wherein the first heterogeneous database is an ERP database that includes one or more data fields corresponding to bank account information, and wherein the second heterogeneous database is an HR database that includes one or more data fields corresponding to a bank account information, and wherein the policy statement includes logic operative to compare bank account information associated with selected transactions in the ERP database with bank account information associated with selected transactions in the HR database.  
     
     
         90 . The method of  claim 89 , wherein bank account information in the ERP database is a vendor's bank account number, the bank account information in the HR database is employee bank account number, and the policy statement is operative to determine whether there is a correspondence between a bank account of a vendor and a bank account of an employee.  
     
     
         91 . The method of  claim 80 , wherein the step of normalizing the data includes the step of storing the data of the selected set associated with a data field identifier from the ontology, so that the extracted data is identified in accordance with the enterprise ontology.  
     
     
         92 . The method of  claim 80 , further comprising the step of adding metadata to the normalized subsets of information prior to storage in the monitoring database as monitoring entities.  
     
     
         93 . The method of  claim 92 , wherein the metadata is selected from the group: 
 version information, a transactional entity identifier, actor identification information, and a timestamp.    
     
     
         94 . The method of  claim 80 , further comprising the step of collecting information relating to one or more related exceptions as a case.  
     
     
         95 . The method of  claim 80 , further comprising the step of collecting information relating to one or more support entities that are related to an entity that caused an exception.  
     
     
         96 . The method of  claim 80 , further comprising the step of storing status information in association with an exception indicating a status of processing of the exception.  
     
     
         97 . The method of  96 , wherein the status information is one of the group comprising detected, under review, dismissed, and fixed.  
     
     
         98 . The method of  claim 80 , further comprising the step of linking a plurality of transactions by retrieving additional information corresponding to other transactions based on predetermined information obtained from one or more exceptions.  
     
     
         99 . The method of  claim 80 , further comprising the step of determining relationships between entities as a function of associations between entities and transactions.  
     
     
         100 . The method of  claim 80 , further comprising the step of extracting the selected subset of information about monitored transactions to a temporary staging database, 
 whereby computationally intensive tasks of identifying changed entities and normalizing can be performed without adverse impact on the source enterprise system.    
     
     
         101 . The method of  claim 80 , wherein the step of extracting comprises receiving information provided by a programmatic interface with an enterprise system that provides no direct query capability to its database.  
     
     
         101 . The method of  claim 80 , wherein the step of extracting comprises receiving information provided in a log file from an enterprise system that contains the entire new entity or provides sufficient information for a query to obtain new data items only.  
     
     
         103 . The method of  claim 80 , wherein the step of extracting comprises receiving information in response to queries from an enterprise system for an initial set of entities, and 
 further comprising the step of determining from data in a staging database what information has changed since a master extraction.    
     
     
         104 . The method of  claim 80 , wherein the enterprise systems include one or more additional data sources that provide information supplemental to the monitored transactions.  
     
     
         105 . The method of  claim 104 , wherein the additional data sources include an information technology (IT) system infrastructure equipment that provides data corresponding to IT system utilization.  
     
     
         106 . The method of  claim 105 , wherein the IT system infrastructure equipment is selected from the group: file server, application server, firewall, router, intrusion detection equipment, authentication server.  
     
     
         107 . The method of  claim 104  wherein the additional data sources include an external data source that provides data ancillary to a particular monitored transaction.  
     
     
         108 . The method of  claim 104 , wherein a policy statement is operative on information from the additional data sources as well as information corresponding to monitored transactions.