Checking Traces for Regulatory Conformance

Abstract

We consider the problem of checking whether the operations of an organization conform to a body of regulation. The immediate motivation comes from the analysis of the U.S. Food and Drug Administration regulations that apply to bloodbanks -organizations that collect, process, store, and use donations of blood and blood components. Statements in such regulations convey constraints on operations or sequences of operations that are performed by an organization. It is natural to express these constraints in a temporal logic.There are two important features of regulatory texts that need to be accommodated by a representation in logic. First, the constraints conveyed by regulation can be obligatory (required) or permitted (optional). Second, statements in regulation refer to others for conditions or exceptions. An organization conforms to a body of regulation if and only if it satisfies all the obligations. However, permissions provide exceptions to obligations, indirectly affecting conformance.In this paper, we extend linear temporal logic to distinguish between obligations and permissions, and to allow statements to refer to others. While the resulting logic allows for a direct representation of regulation, evaluating references between statements has high complexity. We discuss an empirically motivated assumption that lets us replace references with tests of lower complexity, leading to efficient trace-checking algorithms in practice.Abstract. We consider the problem of checking whether the operations of an organization conform to a body of regulation. The immediate motivation comes from the analysis of the U.S. Food and Drug Administration regulations that apply to bloodbanks -organizations that collect, process, store, and use donations of blood and blood components. Statements in such regulations convey constraints on operations or sequences of operations that are performed by an organization. It is natural to express these constraints in a temporal logic. There are two important features of regulatory texts that need to be accommodated by a representation in logic. First, the constraints conveyed by regulation can be obligatory (required) or permitted (optional). Second, statements in regulation refer to others for conditions or exceptions. An organization conforms to a body of regulation if and only if it satisfies all the obligations. However, permissions provide exceptions to obligations, indirectly affecting conformance. In this paper, we extend linear temporal logic to distinguish between obligations and permissions, and to allow statements to refer to others. While the resulting logic allows for a direct representation of regulation, evaluating references between statements has high complexity. We discuss an empirically motivated assumption that lets us replace references with tests of lower complexity, leading to efficient trace-checking algorithms in practice. ⋆

Temporal Mode-Checking for Runtime Monitoring of Privacy Policies

“…To address this limitation, many logics and languages have been proposed for specifying privacy policies. Some examples are P3P [48,49], EPAL [50,51], Privacy APIs [52], LPU [53,54], past-only fragment of first-order temporal logic (FOTL) [10,11], predLTL [55], pLogic [56], PrivacyLFP [12], MFOTL [5][6][7], the guarded fragment of first-order logic with explicit time [4], and P-RBAC [57]. Our policy language, GMP, is more expressive than many existing policy languages such as LPU [53,54], P3P [48,49], EPAL [50,51], and P-RBAC [57].…”

A Default Temporal Logic for Regulatory Conformance Checking

“…In a companion paper [30], we identify a fragment of RefL motivated by a case study of the FDA CFR. The fragment assumes that by Id (ϕ) can be evaluated by using at most one of the laws referred to.…”

“…This assumption allows us to replace satisfiability tests with tests of lower complexity, and lets us scale up to runs with a large number of objects. In this paper, we have focussed on formally characterizing the semantics and complexity of RefL, and in [30], we focus on optimizations that are needed in practice.…”

Mind the gap: assessing the conformance of software traceability to relevant guidelines

“…The closest work is that by Dinesh et al, who used natural language processing (NLP) techniques to extract formal process representations from regulatory documents. They used these process representations to analyze an organization's conformance to the regulation [17]. However, the authors focused on analyzing activities explicitly logged in a database.…”