Collaborative audit framework

• US 7,246,137 B2
• Filed: 02/21/2003
• Issued: 07/17/2007
• Est. Priority Date: 06/05/2002
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Buchholz, Cristina, Paulus, Sachar, Schroer, Tom
• Primary Examiner(s): Wu; Yicun
• Application Number:
  US10/372,031
• Publication Number:
  US 20040006585A1
• Time in Patent Office: 1,607 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-206, 709/246, 715/784, 726/22
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

A framework for comprehensive auditing of applications involved in business processes in distributed application landscapes, including local, distributed and collaborative audit, is based on the concept of a collaborative “audit warehouse” that enables a central, tool-supported audit of cross-enterprise business processes. The interface for the audit data warehouse is defined in an intermediate format language with verification capabilities, such as XML (Extensible Markup Language). Applications in effect write audit data to audit data pools in the warehouse, e.g., in XML format transferred via http over the Internet. Alternatively, data is pulled from the applications by the warehouse automatically or on command. In one preferred paradigm individual enterprises have their own central audit data warehouses, each collecting data from applications both within and outside of the enterprise that owns the warehouse, in order to aggregate audit data for a given business process spanning potentially several distinct enterprises.

Claims

1. An auditing method for capturing audit data from various applications in collaborative business processes spanning several enterprises not under common control such as sharing the same network or security regime, comprising

establishing a central audit warehouse as a repository for audit data from the various applications associated with respective business processes comprising one or more commercial transactions each composed of a series of interrelated components created on applications in two or more of said independent enterprises, the corresponding audit data making up an audit trail for a series of events that transpired to carry out a given commercial transaction,

predefining a standardized format and communication protocol for communicating audit data of various types associated with an application to the audit warehouse,

extracting audit data at the application level in a native format different from said standardized format;

converting the audit data in said native format to the corresponding standardized format for the type of audit data,

transferring the audit data in the standardized format via an interface to the audit warehouse using the predefined communication protocol,

sorting standardized audit data by the individual commercial transaction to which the audit data relates; and

storing the sorted audit data at the audit warehouse according to the respective commercial transaction to which the audit data relates so that audit data relating to a given commercial transaction can subsequently be retrieved together to check for compliance with required procedures.

2. The method of claim 1, wherein the single predefined format is in the form of an open standard document type.

3. The method of claim 2 wherein said document type is an XML compliant document.

4. The method of claim 1 wherein the step of transferring said audit data to said warehouse is accomplished via the Internet.

5. The method of claim 4, wherein said document type is an XML compliant document.

6. The method of claim 1, wherein the step of extracting said audit data is accomplished by creating said audit data within the application itself in a format native to the application.

7. The method of claim 1, wherein the step of extracting said audit data is accomplished by obtaining audit data from the application via a collection interface associated with the application, but different from the interface for the warehouse.

8. The method of claim 1, wherein the step of transferring the audit data form the various applications is carried out by pushing data from the applications automatically to the warehouse.

9. The method of claim 3, wherein the step of transferring the audit data from the various applications is carried out by the audit warehouse automatically pulling data from the applications to the warehouse.

10. The method of claim 4, wherein the step of transferring the audit data from the various applications is carried out by ad hoc inquiries to the applications whereupon the requested audit data is sent to the warehouse.

11. The method of claim 5 wherein the ad hoc inquiries to the applications are initiated by an administrator of one of the various applications.

12. The method of claim 1, wherein the step of storing is carried out by associating selected audit data from various applications corresponding to sub-process steps of the commercial transaction.

13. The method of claim 1, further comprising providing at least one output interface from the warehouse.

14. The method of claim 13, wherein said output interface permits multiple participants in said collaborative business processes to query audit data in the warehouse.

15. The method of claim 1, further comprising providing an internal analysis interface for issuing runtime alerts for noncompliant audit data in the warehouse.

16. The method of claim 1, further comprising providing an interface for an external audit analyzer.

17. The method of claim 16, wherein said interface for an external audit analyzer issues audit reports in the form of XML compliant documents according to a prescribed DTD.

18. The method of claim 16, further comprising also providing an internal analysis interface for issuing runtime alerts for noncompliant audit data in the warehouse.

19. The method of claim 18, wherein the interface for issuing runtime alerts offers more restricted access than the interface for external audit.

20. An auditing method for capturing audit data from various applications in collaborative business processes spanning several enterprises not under common control such as sharing the same network or security regime, comprising

establishing a first central audit warehouse, under the control of one enterprise or of one group of interrelated enterprises as a repository for audit data from the various applications both within the one enterprise or one group of interrelated enterprises and also in distinct enterprises associated with one or more respective business processes, each comprising one or more distinct individual commercial transactions composed of a series of interrelated components created on applications in two or more of said enterprises, the corresponding audit data together making up an audit trail for a series of events that transpired to carry out a given commercial transaction

transferring audit data to the first warehouse from an application in a distinct enterprise, which has more limited access to data in the first warehouse than the one enterprise or one group of related enterprises, in a standardized format via an interface to the first audit warehouse using a predefined communication protocol, and

sorting standardized audit data by the commercial transaction to which the audit data relates;

and

storing the sorted audit data at the audit warehouse according to the respective commercial transactions to which the audit data relates so that audit data relating to a given commercial transaction can subsequently be retrieved together to check for compliance with required procedures.

21. The method of claim 20 further comprising

transferring audit data to the first warehouse from at least one application in the same enterprise or group of enterprises that controls said warehouse, and

in the first warehouse, storing in association with each other the data from various applications in the distinct enterprises that relate to a given commercial transaction.

22. The method of claim 20, wherein said interface between the first warehouse and an application in an enterprise that has more limited access to data in the warehouse is a restricted interface to avoid compromising secure data of the controlling enterprise.

23. The method of claim 20 further comprising

establishing a second central audit warehouse, under control of another distinct enterprise or of other groups of interrelated enterprises, as a repository for audit data from the various applications associated with the same given commercial transaction,

transferring audit data to the second warehouse from an application in a distinct enterprise, which has more limited access to data in the second warehouse than said other distinct enterprise or other group of related enterprises, in a standardized format via an interface to the audit warehouse using the a predefined communication protocol, and

sorting standardized audit data at the second warehouse by the commercial transaction to which the audit data relates;

and

storing the sorted audit data at the second audit warehouse according to the respective commercial transactions to which the audit data relates so that audit data relating to a given commercial transaction can be retrieved together from the second warehouse to check for compliance with required procedures.

24. The method of claim 23, wherein said interface between the first or second warehouse and an application in an enterprise that has more limited access to data in-the warehouse is restricted so as to limit access to secure data while the interface between the first or second warehouse and an application in an enterprise that controls the warehouse is not so restricted.