Analysis of Regulation and Compliance at Qatar National Bank

This report provides a comprehensive analysis of Qatar National Bank's (QNB) compliance with financial regulations, specifically focusing on Law No. 13 of 2012 on financial matters in Qatar. It examines QNB's strategies for conforming to established rules, policies, and standards, including projects planned to meet compliance guidelines. The report delves into the importance of allocating adequate budgets for compliance, highlighting its role in combating financial crime, reducing money laundering, facilitating enforcement measures, and managing overwhelming global regulations. It discusses the application of automatic data collection, content classification, task assignment, and collaboration in compliance management. The report also addresses the challenges faced by compliance officers, such as the volume of regulatory changes and limited resources, and explores strategies like automating processes and centralizing management of social media and cloud apps to reduce compliance costs and enhance efficiency. Furthermore, it examines the rising costs of compliance, the need for a strong compliance culture, and the importance of risk assessments. The report concludes by outlining key challenges, including AI control, GRC frameworks, and regulatory alignment, and emphasizes the need for organizations to adapt and strengthen their compliance functions to meet the evolving regulatory landscape.

Public Document
Regulation and Compliance in Qatar National Bank
Professor
Institution
Course
Date

Public Document
The paper focuses on jurisdiction outlined in Law no. 13 of 2012 on financial matters in
Qatar. The whole project analyses how Qatar National Bank conforms to the policies of
regulation and compliance. Therefore, compliance is the process of conforming to a particular set
of established rules and guidelines such as specifications, policies, and standards. Qatar National
Bank has an additional number of projects that have been planned to meet compliance
guidelines.
Why to allocate adequate budget on compliance cost?
The aim is to meet the following aspects;
 First of all, compliance cost will help to fight financial crime.
 Investing in compliance is a right aspect to reduce money laundering.
 Compliance cost will facilitate enforcement measures in the organization.
 Compliance will provide penalties to be incurred when stakeholders interferes with
outlined principles.
Therefore, compliance offers a way out for organizations by enabling them to manage
the overwhelming regulations that come from all corners of the globe.1 Here, there is the
application of an automatic data collection process that looks into and carefully analyze
regulatory policies in an organization. There is also the aspect of content classification and
summarization. This involves sorting out of lengthy procedures and identifying all obligations
that must be attended to. In addition to this, there is task assignment and collaboration. 2This
includes identifying who does what in an organization I relation to compliance issues, the overall
1 Butler, Tom, and Robert Brooks. "On the role of ontology-based RegTech for managing risk
and compliance reporting in the age of regulation (2018): 19-33.

Public Document
workflow, and collaboration between different expertise in making sure that compliance is fully
observed in an organization.
The volume of regulatory change, tracking, and implementation is considered as one of
the most significant challenges faced by most compliance officers. In most cases, organizational
change management is defined in four key phases which are; identification, review,
implementation, and validation. Identification is often accompanied by compulsory advocacy
activities that are mostly outside the scope of the regulatory change management team involved.
3This is then followed by a review that entails a preliminary study of the regulatory event
identified therein. Here, the applicability and the potential impact of the regulatory event is
addressed.4 The review often checks in to some of the affected areas and the individuals who will
be responsible for managing the actual change. Implementation is the third phase, and it
provides a precise analysis of the execution of the regulatory management change plan.
Validation is the last phase, and it incorporates all ongoing policies and program maintenance as
2 Cheng, Danny C., and Nathalie Rose Lim-Cheng. "An ontology-based framework to support
multi-standard compliance for an enterprise." pp. 1-6. IEEE, 2017.
3 Elhasnaoui, S., A. Chakir, M. Chergui, H. Medromi, and L. Moussaid. "Communication
System Architecture to Integrate Distributed Systems of an IT GRC Platform Based on Agent
Technology and Web Services." (2017): 86-95.
4 Ghiran, Ana-Maria, Robert Andrei Buchmann, and Cristina-Claudia Osman. "Security
requirements elicitation from engineering governance, risk management and compliance." pp.
283-289 Springer, Cham, 2018.

Public Document
a whole.5 This entails establishing a profound and robust regulatory monitoring process. This is
undertaken to identify all potential changes and have them addressed by the assigned individuals
within the timeframe provided. Also, it includes setting up a process to facilitate the handoffs of
vital information that is overseen by a proper audit trail. The volume of activities in regulatory
change management is quite enormous, and this creates challenges for most compliance officers.
Modern trends indicate that the pace, as well as the scope of regulatory change, continues
to be unabated. 6 Limited resources, coupled with the drive to minimize costs within a regulated
business, has also created more challenges to compliance officers in an organization. This is so
because compliance officers are forced to work extra hard to counter the challenges associated
with the whole aspect of following and abiding by the stipulated regulations as per various
provisions of the law. This often makes it almost impossible to have a proper compliance team in
an organization because of limited resources. 7Over the last decades, there have been significant
changes in both regulatory and compliance landscapes, and as such, compliance costs have
increased tremendously. Creating a compliance culture in an organization is one of the ways to
5 Gill et al "Policy/rule engine, multi-compliance framework and risk remediation." U.S. Patent
10,021,138, issued July 10, 2018.
6 Govindji, Shree, Gabrielle Peko, and David Sundaram. "A context adaptive framework for IT
governance, risk, compliance and security." pp. 14-24. Springer, Cham, 2017.
7 Gozman, Daniel, and Wendy Currie. "Managing governance, risk, and compliance for post-
crisis regulatory change: A model of IS capabilities for financial organizations." pp. 4661-4670.
IEEE, 2015.

Public Document
eradicate inefficiency in accordance with related activities, but there should be enough resources
to make this happen.
Having a compliance team that performs all compliance activities requires so many
resources that are not always available for most organizations. 8As a result, firms need to
strengthen as well as re-shape their compliance functions to manage the significant increase in
compliance activities. As a result of inadequate resources, compliance officers have to undertake
several measures to meet all the compliance requirements in an organization. Some of the
activities undertaken by compliance officers to ensure that ends meet comprise of; periodically
conducting compliance risk assessments, providing regular training and learning opportunities to
the compliance team and creating as well as maintain a compliance culture in an organization.
Compliance officers have to conduct compliance risk assessments to match the
compliance requirements of the organization. It is a requirement that compliance teams
undertake compliance risk assessments regularly. Through such assessments, the team will
identify problems and risks an organization is facing and what steps can be taken to deal with the
issues. 9It is important to note that risk assessment is a very time-consuming process but is
considered as one of the best ways of identifying risks and thus having enough time to deal with
them. Limited resources tend to limit an organization's ability to carry out a risk assessment and
thus hindering the whole compliance activity in the process. It is recommended that an
8 Haddad, Hossam. "Internal Controls in Jordanian Banks and Compliance Risk." (2016): 17-31.
9 Iguer, Hajar, Hicham Medromi, Adil Sayouti, and Saadia Tallal. "Including EAS-SGR IT Risk
framework in an IT GRC global framework." pp. 525-533. Springer, Singapore, 2015.

Public Document
organization invest so much on its compliance team as it is vital for the survival of an
organization.10
Some strategies can be adopted to enhance better compliance and reduce compliance
costs and volumes to a very great extent. Some of the proposed methods of doing so are;
automating processes, secure access to the Web, and the central management of social media as
well as cloud apps. First and foremost, automating most of the processes in the organization
tends to reduce the overall effort required by teams. Automation also tends to ensure consistency.
This is so because automation ensures the same set of procedures and processes followed to the
later and in the same way each time. 11A secure access to the Web is as well another issue that
can be adopted to cut down compliance costs. Even though the Web is considered a fundamental
aspect of the productivity of most organizations around the globe, it also poses a very significant
exposure to risks of all sorts.
Scholars indicate that at least 75% of all web-based attacks often target flaws that could
otherwise be used to launch attacks in an organization. It is recommended that organizations
should have a closer examination of how the secure web browser could mean for the
organization. 12The central management of social media and cloud apps is essentially an
10 Kholkar, Deepali, and Vinay Kulkarni. "A Case Study on Modeling and Validating Financial
Regulations Using (Semi-) Automated Compliance Framework." p. 288. Springer, 2018.
11 Mansfield-Devine, Steve. "Data governance: Going beyond compliance." (2017): 12-15.
12 Mayer, Nicolas, Béatrix Barafort, Michel Picard, and Stéphane Cortina. "An ISO compliant
and integrated model for IT GRC (Governance, Risk Management and Compliance)." pp. 87-99.
Springer, Cham, 2015.

Public Document
extension of the risk that the Web can bring about. In this particular case, however, social media
and cloud apps are tools that increase risks, particularly for compliance. Regarding this,
organizations are required to have policies and methods that would centrally manage and
monitor cloud apps and social media usage to ensure that there are no cases of compliance
violations whatsoever. 13
As depicted earlier, the possible way of creating and maintaining a compliance culture is
by conducting a regular risk assessment. Some other methods that can be appropriate in creating
and keep a compliance culture are by aligning all compliance functions, lobbying effective
technology, and working alongside internal departments, among other issues. It is, however,
essential to note that while effective techniques of creating a functioning compliance team are
well known, creating this with limited resources is impossible. 14
In the past decade, there has been a tremendous rise in trade requirements and
regulations. There is no doubt that the increase in such regulations is primarily intended for
investor security and protection. Still, the consequence of high compliance costs and workloads
is becoming a burden for most organizations.15
Compliance cost and challenges facing the organization
13 Mayer, Nicolas, Eric Grandry, Christophe Feltus, and Elio Goettelmann. "Towards the ENTRI
framework: security risk management enhanced by the use of enterprise architectures." pp. 459-
469. Springer, Cham, 2015.
14 Nicho, Mathew, Shafaq Khan, and M. S. M. K. Rahman. "Managing information security risk
using integrated governance risk and compliance." pp. 56-66. IEEE, 2017.

Public Document
The compliance cost
According to the classwork, compliance cost comprises the salaries for those working in
compliance as well as the time and money spent to meet a certain objective in the organization.
Most of these costs incurred by the organization changes as well as the regulations in industries
increases. 16The idea is that compliance costs in the company can be experienced as a result of
various aspects.
Breaking down the compliance cost of the organization.
According to the financial reports of the company, compliance costs comprise the
conduct costs as well as the regulatory risk. In some articles, authors have described compliance
costs as those ongoing prices that follow the rules as they are in the company. For example, if we
all take an example of a publicly-traded company, compliance costs may comprise elements such
as environmental assessments among others.17
Changing costs of the compliance in the company.
According to the notes shared in the meeting, we tend to realize that in the global world,
compliance is now shifting into the various dimension. Through this analogy, the approach has
15 Papazafeiropoulou, Anastasia, and Konstantina Spanaki. "Understanding governance, risk and
compliance information systems (GRC IS): The experts view." (2016): 1251-1263.
16 Spanaki, Konstantina, and Anastasia Papazafeiropoulou. "The implementation of governance,
risk, and compliance IS: Adoption lifecycle and enterprise value." (2016): 302-315.
17 Zarrabi Jorshari, F. "A semantic based framework for software regulatory compliance." PhD
diss., University of East London, 2016.

Public Document
threatened most of the organization not leaving apart our company of interest. The idea is that
compliance costs are now handling different jurisdictions and also regulations within the market
place. For example, in countries such as U.S compliance costs tend to look the total operations
experienced by the company thus ensuring no cases of noncompliance.
Besides, the company is now turning to the large enterprise level. According to the chief
officer the organization has complied with the effective compliance costs that help in meeting the
anticipated objectives. 18The aim of joining the enterprise level systems is to lower the headcount
that is needed when dedicating to a unit of compliance.
Challenges faced in compliance costs.
In the current world, business enterprises are now facing huge challenges. The major
concern today is to focus on compliance to ensure the organization meets the objectives. Most of
the organizations are expecting the amount of regulatory system to increase in the next five
years. 19 With all these ideas in our minds lets focus on those problems facing the compliance
costs. Therefore, some of the challenges that must be avoided by the board of directors in the
company include;
Inability to control the Artificial Intelligence (AI) systems.
18 Sunkle, Sagar, Deepali Kholkar, and Vinay Kulkarni. "Model-driven regulatory compliance: A
case study of “Know Your Customer” regulations." pp. 436-445. IEEE, 2015.
19 Vunk, Mikhel, Nicolas Mayer, and Raimundas Matulevičius. "A framework for assessing
organisational IT governance, risk and compliance pp. 337-350. Springer, Cham, 2017.

Public Document
In Qatar, the issue of AI is now threatening some of the organizations to comply with the
aspect of compliance costs. The idea is that there are a lot of changing continual and regulatory
issues in the field of business. Through this analogy, it becomes difficult for organizations to
meet the terms outlined in the compliance costs systems. Most of the technological systems work
on what is being programmed. 20Through this process, it becomes difficult for the technology to
do those activities that cannot be programmed. For example, in our banks when ATM stops
working then it means the bank will not operate unless someone fixes the problem immediately.
The idea is that most of these technological advancements are expensive to some of the
organizations. Through this analogy, most of the companies end up avoiding these costs.
Therefore, after all, organizations have to focus on the staff only since they are the ones who can
be consulted in any regulatory interaction process.
Lack of appropriate GRC frameworks
The idea is that most of the organizations are failing to prioritize critical tasks. Deviation
from meeting the GRC needs, shows how it becomes difficult to manipulate various aspects such
as auditing issues. A well-informed risk management aspect ought to mitigate those elements
that will necessitate the ability to reduce risk and losses incurred or anticipated by the company.
Inability to address issues from regulatory units and government systems.
20 Sunkle, Sagar, Deepali Kholkar, and Vinay Kulkarni. "Solving semantic disparity and
explanation problems in regulatory compliance-A research-in-progress report with design
science research perspective." pp. 326-341. Springer, Cham, 2015.

Public Document
The one thing we all ought to know is that management risk and compliance costs will
never end at all. The idea is that all regulatory units, as well as governmental systems, are always
making strict policies to control the business environment all the time. Not all organizations have
been in the position to comprehend the exact aspects needed by these regulatory units. It is the
responsibility of the organization to fight in all dimensions to meet the procedures and policies
governing the regulatory systems. For example, governments may increase taxes and at the same
time, the company fails to acknowledge the change.
Inability to align the GRC policies with the culture of the company.
The culture of governance has to start from the executive level in an organization. The
idea is that GRC has to initiate an appropriate corporate structure that meets the management
requirements and risks needed. 21Therefore, the issue is that change in an organization is dynamic
and companies don't have stipulated procedures to record the change. No ample information
disseminated ins some companies to track the changes needed in the GRC system.
How to address the compliance costs challenges in an organization.
Coming up with a proactive approach that can help to monitor important controls.
Most of the organizations are working hard enough to control the risk and losses. The
idea is that there must be protocols to control the regulatory units. The working operations ought
to be controlled carefully to meet the objectives of the GRC policies in any company. Through
21 Sunkle, Sagar, Deepali Kholkar, and V. Kulkarni. "Toward (Semi-) Automated End-to-End
Model-driven Compliance Framework." (2016): 33-38.

Public Document
this careful monitoring, it will be easy for the firms to generate appropriate strategies to tackle
high impact risk.22
Planning change management strategy to avoid financial crisis.
Not all organizations are in the position to comply with the increasing regulations in the
business. The idea is that it is vital to embrace and embed GRC policies in the corporate unit of
the firm. The issue of change management will gear the ability to align the culture of the firm
with the GRC policies.23
Finding appropriate integrations and the right partner to reduce risk.
Firms have to look at the right integration. According to the current research right
integration in an organization is a measure to raise the GRC programs as well as increasing the
level of efficacy all the time. By doing all these it becomes easy to fight the risk proactively. This
process can be aided by automating procedures, bringing data together and also handling
multiple tools as well as stakeholders in a specific location. 24
22 Sunkle et al "Solving semantic disparity and explanation problems in regulatory compliance-A
research-in-progress report with design science research perspective." 2015.
23 Mikhel, Vunk, Nicolas Mayer, and Raimundas Matulevičius. "A framework for assessing
organisational IT governance, risk and compliance." 2017.
24 Zarrabi Jorshari, F. "A semantic based framework for software regulatory compliance." 2016.

Public Document
Presentation
The idea is to secure the financial challenges that can be faced by the organization. Most of the
time compliance costs system such as GDPR aims at regulating all businesses selling either
services or goods. The root cause of the regulatory risk is the rules and the conduct cost
experienced by the organization. The CEO of the company has complied with the terms of the
GDPR as indicated by the chief officer. Through this analogy, it has become easy for the
organization to meet the needs and objectives of the compliance costs.
Changing the regulatory landscape in the banking and insurance firm in Qatar.
 Compliance frameworks will improve elements such as;
 1. Transaction Monitoring
Employing data analytics systems in all department.
Using a real-time AML compliance visual dashboard for the company.
 2. Understanding the customers
Proactively preparing AML functions and this can be done by staying informed of proposed regulations.
Implementing a global KYC and CDD governance program across the organization.
 3. Talent Management
 Coming up with well-structured human capital strategy to effectively compete for
resources in a highly dynamic and transient talent market.
 Using a role-based approach to AML compliance learning across the organization.
Requirements for the regulations
In field of finance and banking there a lot to consider when an organization is handling regulation and
compliance. Some of these includes;
1. Payment services directives in the bank
It will consider aspect such as
i. Improved customer authentication services.
ii. Improved transaction analysis processes.
iii. Issues such as dynamic linking
iv. Use of mobile App security measures.
2. Compliance to data protection and privacy policies.

Public Document
The idea is that business opportunities are everywhere and at the same time the regulations are
ready to control them. Most of the companies seem solid at the surface.
With all these ideas in our minds it will be easy to focus on those problems facing the
compliance costs. The best thing is to focus on the impact of these challenges in an
organization.

Public Document
The budget will help us to terminate all these barriers to compliance. It is now clear that most of
the managers have not identified how to deal with changing governmental strategies. Through
this analogy, it becomes difficult for the company to meet the GRC terms hence incurring huge
costs.
Analysis of the project vs number of staff
The following sections will help us meet the principles of compliance;
Green
 Analyzing the compliance framework
 Determining the corporate governance
Yellow
 Identifying business inputs in compliance cost.
 Identifying the data security measures
Red
 The risk of non-compliance
 Review of the policies
Responsibilities of compliance function
 Ensuring conformity between the internal and external laws as well as regulations.
i. approval of compliance policy (if in accordance with legislations and regulations);
ii. compliance with management in accordance with compliance measures;
iii. communicating to all staff, including partners and service providers, about compliance policy;
iv. disclosure of ethical conduct as a bank culture.
 Facilitating effective strategies for identifying risk.
 Enhancing implementation of internal controls that provides companies a room for protection
from the risks.
Providing an opportunity to gear business integrity.

Public Document
Through this careful monitoring, it will be easy for the firms to generate appropriate strategies
to tackle high impact risk.
All these elements work on improving the risk and loss experienced and anticipated in any
financial institution. The idea is to control issues such as embezzlement of funds, corruption.
Money laundering and financial crimes. The management body should focus on how to induce
these aspects in all departments all the time.
Why this is important
Compliance is critical tool for bank managers in;
i. Information processing.
ii. Security purposes thus controlling financial issues such as money laundering.
iii. Risk management processes.
iv. Ethical conduct and other controls in the institution.
v. In data readability processes.
It is necessary for the employees;
i. Helps them to have responsible behaviors all the time.
ii. Enhances good working environment in the institution.
iii. Helps workers to be focused and meet the goals.
iv. Helps them to comply to internal policies and the requirements
v. Motivate workers to avoid unethical and illegal practices within the institution.

Public Document
Bibliography
Butler, Tom, and Robert Brooks. "On the role of ontology-based RegTech for managing risk and
compliance reporting in the age of regulation." Journal of Risk Management in Financial
Institutions 11, no. 1 (2018): 19-33.
Cheng, Danny C., and Nathalie Rose Lim-Cheng. "An ontology-based framework to support
multi-standard compliance for an enterprise." In 2017 International Conference on Research and
Innovation in Information Systems (ICRIIS), pp. 1-6. IEEE, 2017.
Elhasnaoui, S., A. Chakir, M. Chergui, H. Medromi, and L. Moussaid. "Communication System
Architecture to Integrate Distributed Systems of an IT GRC Platform Based on Agent
Technology and Web Services." International Journal of Soft Computing 12, no. 2 (2017): 86-
95.
Ghiran, Ana-Maria, Robert Andrei Buchmann, and Cristina-Claudia Osman. "Security
requirements elicitation from engineering governance, risk management and compliance."
In International Working Conference on Requirements Engineering: Foundation for Software
Quality, pp. 283-289. Springer, Cham, 2018.
Gill, Jasvir Singh, Inderpal Ricky Arora, Srinivasa Kakkera, and Subrat Narenda Singh.
"Policy/rule engine, multi-compliance framework and risk remediation." U.S. Patent 10,021,138,
issued July 10, 2018.
Govindji, Shree, Gabrielle Peko, and David Sundaram. "A context adaptive framework for IT
governance, risk, compliance and security." In Context-Aware Systems and Applications, and
Nature of Computation and Communication, pp. 14-24. Springer, Cham, 2017.

Public Document
Gozman, Daniel, and Wendy Currie. "Managing governance, risk, and compliance for post-crisis
regulatory change: A model of IS capabilities for financial organizations." In 2015 48th Hawaii
International Conference on System Sciences, pp. 4661-4670. IEEE, 2015.
Gozman, Daniel, and Wendy Currie. "Managing governance, risk, and compliance for post-crisis
regulatory change: A model of IS capabilities for financial organizations." In 2015 48th Hawaii
International Conference on System Sciences, pp. 4661-4670. IEEE, 2015.
Haddad, Hossam. "Internal Controls in Jordanian Banks and Compliance Risk." Res. J. Financ.
Acc 7 (2016): 17-31.
Iguer, Hajar, Hicham Medromi, Adil Sayouti, and Saadia Tallal. "Including EAS-SGR IT Risk
framework in an IT GRC global framework." In International Symposium on Ubiquitous
Networking, pp. 525-533. Springer, Singapore, 2015.
Kholkar, Deepali, and Vinay Kulkarni. "A Case Study on Modeling and Validating Financial
Regulations Using (Semi-) Automated Compliance Framework." In the Practice of Enterprise
Modeling: 11th IFIP WG 8.1. Working Conference, PoEM 2018, Vienna, Austria, October 31–
November 2, 2018, Proceedings, vol. 335, p. 288. Springer, 2018.
Kholkar, Deepali, Sagar Sunkle, Suman Roychoudhury, and Vinay Kulkarni. "A Model-driven
Regulatory Compliance Framework."
Mansfield-Devine, Steve. "Data governance: Going beyond compliance." Computer Fraud &
Security 2017, no. 6 (2017): 12-15.

Public Document
Mayer, Nicolas, Béatrix Barafort, Michel Picard, and Stéphane Cortina. "An ISO compliant and
integrated model for IT GRC (Governance, Risk Management and Compliance)." In European
Conference on Software Process Improvement, pp. 87-99. Springer, Cham, 2015.
Mayer, Nicolas, Eric Grandry, Christophe Feltus, and Elio Goettelmann. "Towards the ENTRI
framework: security risk management enhanced by the use of enterprise architectures."
In International Conference on Advanced Information Systems Engineering, pp. 459-469.
Springer, Cham, 2015.
Nicho, Mathew, Shafaq Khan, and M. S. M. K. Rahman. "Managing information security risk
using integrated governance risk and compliance." In 2017 International Conference on
Computer and Applications (ICCA), pp. 56-66. IEEE, 2017.
Nicho, Mathew, Shafaq Khan, and M. S. M. K. Rahman. "Managing information security risk
using integrated governance risk and compliance." In 2017 International Conference on
Computer and Applications (ICCA), pp. 56-66. IEEE, 2017.
Papazafeiropoulou, Anastasia, and Konstantina Spanaki. "Understanding governance, risk and
compliance information systems (GRC IS): The experts view." Information Systems
Frontiers 18, no. 6 (2016): 1251-1263.
Spanaki, Konstantina, and Anastasia Papazafeiropoulou. "The implementation of governance,
risk, and compliance IS: Adoption lifecycle and enterprise value." Information Systems
Management 33, no. 4 (2016): 302-315.
Sunkle, Sagar, Deepali Kholkar, and V. Kulkarni. "Toward (Semi-) Automated End-to-End
Model-driven Compliance Framework." ModSym+ SAAAS@ ISEC 2016 (2016): 33-38.

Public Document
Sunkle, Sagar, Deepali Kholkar, and Vinay Kulkarni. "Model-driven regulatory compliance: A
case study of “Know Your Customer” regulations." In 2015 ACM/IEEE 18th International
Conference on Model Driven Engineering Languages and Systems (MODELS), pp. 436-445.
IEEE, 2015.
Sunkle, Sagar, Deepali Kholkar, and Vinay Kulkarni. "Solving semantic disparity and
explanation problems in regulatory compliance-A research-in-progress report with design
science research perspective." In Enterprise, Business-Process and Information Systems
Modeling, pp. 326-341. Springer, Cham, 2015.
Vunk, Mikhel, Nicolas Mayer, and Raimundas Matulevičius. "A framework for assessing
organisational IT governance, risk and compliance." In International Conference on Software
Process Improvement and Capability Determination, pp. 337-350. Springer, Cham, 2017.
Zarrabi Jorshari, F. "A semantic based framework for software regulatory compliance." PhD
diss., University of East London, 2016.