In recent years, Complex Event Processing (CEP) has emerged as a key technology that leading businesses use to differentiate themselves from competitors. Traditional enterprise software responds to atomic events in isolation. CEP allows enterprises to identify related events (or even the lack of expected events). When combined with powerful real-time analytics applied to those event patterns, important business trends -- which are not visible in the isolated items -- can be revealed. These revelations can help identify, in near real time, risks and opportunities that the enterprise can use to gain advantage. However, those insights will not actually yield advantage unless related processes are in place, or can be put in place quickly, to effect business action. Business Process Management (BPM) software is designed to enable precisely this sort of agile, on-the-fly action.

The combination of CEP and real-time analytics natively integrated with a BPM platform delivers what Gartner, Inc. has termed “Intelligent Business Operations.” Gartner first defined this concept in a June 2011 report, stating,

Companies in many different industries are improving their effectiveness and efficiency by making certain aspects of their operations more intelligent. Intelligent business operations are a style of work in which real-time analytic and decision management technologies are integrated into the transaction-executing and bookkeeping operational activities that run the business. Intelligent business operations are becoming increasingly practical because of the growing amount of data generated by sources inside and outside the company, and because of the wide availability of software tools to process that data immediately.”

Linking Events, Process Creates Advantage

CEP systems monitor the many data streams flowing through an organization and, based on business rules, search for specific relationships between the individual events that may signal the occurrence of some larger event. CEP systems can not only identify unexpected occurrences, but also the absence of expected events.

In any modern large enterprise, there are millions of messages flowing through the systems. They are not neatly sequenced and categorized, and they have many independent sources and destinations. This is often described in the CEP literature as the “Event Cloud” to signify the lack of order and structure. CEP systems examine the data flowing through the cloud and identify relationships that may be important to the enterprise. Early identification positions the organization to respond before the risk does harm or before the opportunity goes away.

This advantageous visibility can only be turned into actual business advantage through fast and appropriate business action. CEP systems can be powerful in identifying events, but the organization must still respond to them in a timely manner. BPM systems provide the natural complement for resolution of events identified by CEP. Traditional BPM systems are best at automating well-understood and defined business processes, while CEP systems are designed to identify the unexpected. However, more advanced BPM systems are increasingly good at handling a combination of structured and unstructured processes in what is commonly thought of as Adaptive or Dynamic Case Management Scenarios. This type of BPM software leverages real-time collaboration, ideally through a Facebook-style Social BPM interface, uniting process with systems of record and document stores. This instant collaboration within the BPM interface allows both structured and ad hoc process to keep moving forward effectively.

Explicit linkage between the triggering event and the resulting process response provides a comprehensive audit trail and evidence as to why a particular instance was handled in a particular manner. This is especially important documentation for those cases handled without human intervention. The same information can also be used to refine both the event identification rules and the response strategies. In particular, analysis of “false positives” can allow the organization to reduce them and concentrate its resources on issues with real impact.

An organization based on “Intelligent Business Operations” will use a single platform that integrates events, analytics and process. This allows a unified view of all activity related to any particular business event or process participant. It extends the value of the alert sent from the CEP system by allowing that new information to be analyzed in the right context and acted on appropriately. The selected response should depend not only on the immediate triggering event, but also on a complete picture of the relationship with the customer, supplier, partner or business unit involved.

When the CEP system identifies an event, one or more of several actions may be required:

  • A new process may be started to respond to the event. This may be completely automated, or may involve human decision making.
  • A currently active process may be modified. The modification may involve cancellation of some tasks, addition or activation of new tasks.
  • A currently active process may be suspended or canceled.
  • In some cases, compensating processes may be initiated to unwind activities affected by the response to the event.

Note that all of these actions will themselves generate new events back into the event cloud for further analysis by the CEP system, and potentially further action through the process platform.

Example: Retail Banking

We will illustrate the concepts above with a simplified example from the banking industry. Financial services have been the leaders in many technology areas including BPM, Analytics and CEP. In this example, we will assume that the bank uses BPM for the following customer-facing business processes:

  • Loan Approval
  • Credit Card Approval
  • New Account On-Boarding
  • Account Termination
  • Customer Cross Selling

In addition, the bank has implemented a CEP system for detection of fraud and money laundering. The system tracks the following transactions:

  • Credit card purchases
  • Account withdrawals and deposits
  • Loan and credit card payments
  • Loan and credit card delinquencies
  • Account opening and closing

Certainly they were monitoring all of these before, but expect that with CEP, they will get better and earlier information. Note that all of these are low-level and normal banking activities. It is combinations of these independent events, in particular patterns, that signify higher level events. One example is improvements in credit card fraud detection through the monitoring of patterns regarding questionable transaction activities. When something is detected, the organization needs to take appropriate action. The specifics of the action will vary depending on the nature of the observed activities.

Depending on the amount at risk and the nature of the evidence, several obvious actions can be taken. First, the transaction can be blocked. If theft of the card is suspected, it can be frozen and a replacement card issued. This would also require a letter and possibly a phone call to the cardholder. In some cases, the bank might notify law enforcement authorities.

All of these would be standard functionality of the credit card systems and would not require BPM, but with BPM the bank can go further. It can identify any current loan or credit applications and modify those processes to add an additional investigative step for the loan officer. It can also score the importance of the client and allocate extra resources to high value customers.

Without CEP, there would be no way for the loan officer to know about the possible credit card fraud to consider it in the loan decision. To take advantage of the information identified by the CEP system, additions to the existing BPM processes are required. It will be necessary to modify or suspend active loan and credit card approval processes in response to possible fraud detection.

Requirements for the BPM System

For the BPM system to respond in real time to events identified by the CEP system, it must have capabilities not found in many current BPM products.

  • It must have the ability to deliver asynchronous ad hoc messages to running process instances, independent of their state. At a minimum, it should support JMS and Web services over http.
  • It must be able to identify all active processes involving the participants in the triggering event.
  • It must have the ability to modify active process instances at any point in their execution. Modifications can be simple, such as suspending or terminating the process, but also required is the ability to add and delete tasks in the process instance, without otherwise altering its current state. Other possibilities include escalating priorities, reassigning tasks or altering deadlines.
  • These modifications must be performed in response to the incoming message, without human intervention.
  • The system must support completely automated straight-through processing as well as mixed automated and manual processes. It must provide real-time notification mechanisms so that people can respond quickly to unexpected events.

The simplistic approach of including decision points and pre-defined alternate process flows cannot provide the real-time response which is one of the main benefits of CEP. Many systems with static, compiled process definitions cannot provide the necessary flexibility.

CEP + BPM = Intelligent Business Operations

CEP and BPM are complimentary tools which can allow businesses to identify and respond quickly to unexpected events. CEP can identify the events as they are happening, and flexible BPM can provide immediate response to them, while maintaining the business’s defined processes and policies. Organizations that try to implement CEP without using BPM to automate the handling of the identified events are unlikely to achieve the expected benefits. Similarly, CEP extends the benefits of BPM by coupling it more tightly to the enterprise. The combination provides more value than the sum of the components implemented separately.

According to Gartner,

Companies implementing intelligent business operations should evaluate the strengths and limitations of three alternative sources of technology: acquiring an integrated suite, such as an advanced BPM suite (BPMS); assembling a collection of point products from one or more vendors; or purchasing packaged applications with integrated real-time analytics.”

The easiest and least-expensive approach is to build your intelligent organization on a BPM platform that provides all three integrated components of process, events and analytics.

Editor's Note: You may also be interested in reading: