Business Policies, Business Rules, and Rulebook Management
Let Us Be Well-Governed

by Ronald G. Ross

Excerpted with permission from Building Business Solutions:  Business Analysis with Business Rules, by Ronald G. Ross with Gladys S.W. Lam, An IIBA® Sponsored Handbook, Business Rule Solutions, LLC, October 2011, 304 pp.  URL:.  http://www.brsolutions.com/bbs

What is the most important element of governance in your business?  Business rules.  It's just common sense, but as they say, common sense sometimes isn't all that common.

What a Business Rule Is

Before jumping in too deeply, let's be sure you know what I mean by business rule.  I don't mean if-then-action statements like you find in most rule engines and expert systems.  As Don Baisley of the SBVR team famously said (about the 'action' part), "business people don't set variables and they don't call functions."  That's a good test.  Setting variables and calling functions is what software developers do to implement business rules.

Here then is our definition of business rule:

business rule:  a criterion used to guide day-to-day business activity, shape operational business judgments, or make operational business decisions.

Some people think of business rules as loosely formed, very general requirements.  Wrong.  Business rules have definite form, and are very specific.  Here are a few simple examples, expressed in RuleSpeak^®:^[1]

• A customer that has ordered a product must have an assigned agent.
  
  
• The sales tax for a purchase must be 6.25% if the purchase is made in Texas.
  
  
• A customer may be considered preferred only if the customer has placed more than $10,000 worth of orders during the most recent calendar year.

Business rules represent an important form of business communication and must make sense (communicate) to business people.  If some statement doesn't communicate, it's not a business rule.  Consider this example:  If ACT-BL LT 0 then set OD-Flag to 'yes'.  Not a business rule.

Consider another example:  An account must be considered overdrawn if the account balance is less than $0.  This statement communicates and therefore is a business rule.  Business rules can be technical, but only in terms of the company's know-how or specialized product/service, not in terms of IT designs or platforms.

Business rules are not about mimicking intelligent behavior; they are about running a business.  Mimicking intelligent behavior in a generalized way is far harder (an order of magnitude or more) than capturing the business rules of an organization.  Unfortunately, expert systems have generally focused on the former problem, causing considerable confusion among business practitioners.

SBVR^[2] makes several important points about business rules.

• A business rule always tends to remove some degree of freedom.  (If it doesn't, it's not a business rule but rather an advice.)
  
  
• A business rule gives well-formed, practicable guidance.  A practicable business rule or advice is sufficiently detailed and precise that a person who knows about it can apply it effectively and consistently in relevant circumstances to know what behavior is acceptable or not, or how something is understood.
  
  
• A business rule is always under business jurisdiction of your organization.  The point with respect to external regulation and law is that your organization has some choice about how to interpret regulations and laws for deployment into day-to-day business activity — and even whether to follow them at all.

Where Business Rules Come From

'Under business jurisdiction' naturally raises the question, "Where do business rules come from?"  Many business rules originally arise as interpretations of some law, act, statute, regulation, contract, agreement, business deal, MOU, business policy, license, certification, warranty, etc.

Among these, let's single out business policies for a closer look.  Like business rules, business policies always pertain to degrees of freedom for day-to-day business activity.  In general, business policies can address any of the concerns in Table 1, often in combinations (e.g., how many people are needed to produce a desired yield in the desired cycle time).

The difference from business rules is that business policies aren't immediately practicable.  They always require some amount of prior interpretation.  The Business Motivation Model^[3] (BMM) contrasts business policies and business rules this way:  "Compared to a business rule, a business policy tends to be less structured, less discrete, less atomic, less compliant with standard business vocabulary, and less formally articulated."

Business managers create business policies to control, guide, and shape day-to-day business activity.  In short, business policies are the stuff of governance — operational business governance.

The Nuts and Bolts of Business Governance

Time for a reality check.  Are we on-target with respect to the real-world meaning of governance?  Here is how the Merriam-Webster Unabridged Dictionary (MWUD) defines govern [1a]: 

govern:  to exercise arbitrarily or by established rules continuous sovereign authority over; especially:  to control and direct the making and administration of policy in

So 'governing' a business involves coordinating how business policies and business rules are created (the making … of) and deployed (managed, distributed, and monitored) within day-to-day business operations (administration).

Based on the MWUD definitions for governance (1, 2a, 4a, and 5), we define business governance as follows:

governance:  a process, organizational function, set of techniques, and systematic approach for creating and deploying business policies and business rules into day-to-day business activity

The original decision to create a business policy or business rule is an example of a governance decision.  A governance decision is not an operational business decision because it is not real-time with respect to day-to-day business activity.

Governance decisions should be part of a special business process, the governance process, which also coordinates deployment and retirement of business rules.  The governance process is a series of business actions and checkpoints indicating who should be doing what (business roles), and when, with respect to deploying business policy and business rules.

Being Well-Governed

To support business governance you need a systematic approach, which is provided by a rulebook and a general rulebook system (GRBS).  These tools also provide the traceability needed to support compliance.

A rulebook is the collection of business policies, business rules, and advices for a business capability.  Like the rulebook of any game, a rulebook for a business capability enumerates all the DOs and DON'Ts (rules), along with the terms and definitions (vocabulary) needed to understand the rules.

Each participant in the game — whether player, coach, referee, or umpire, scout, spectator, or media person — is presumed to understand and adhere to the rules to the extent his or her role in the activity requires.  The rulebook sometimes suggests how to play the game to maximum advantage, but never dictates playing strategy.

Similarly, a rulebook for a business capability includes the business rules (and advices) needed to perform day-to-day operational business activity correctly or optimally, along with the structured business vocabulary (concept model) needed to understand the business rules correctly.

Each participant in the business activity is obligated to adhere to the business rules to the extent his or her role requires.  The rulebook never dictates business strategy, but should reflect, enforce, and measure it. 

Unlike the rules for a game, however, business rules change, often quite rapidly.  Therefore essential in effective rulebook management is retaining information about:

• original source(s),
• the what, who, when, and why of interpretation(s) from original source(s),
• business motivation (if not evident from the above),
• full history of modifications,
• how and where currently deployed.

Rulebook management comprises the skills, techniques, and processes needed to express, analyze, trace, retain, and manage the business rules needed for day-to-day business activity.  You should think of rulebook management as a pragmatic means to retain corporate memory.

Effective rulebook management requires a general rulebook system (GRBS), an automated, specialized, business-level platform.  Key features of a GRBS include rich, interactive support for structured business vocabularies (concept models) and comprehensive traceability for business rules (not software requirements).

Unlike a business rule engine (BRE) a GRBS is not run-time.  As an analogy, think of a GRBS as more or less like a general ledger system, except that a GRBS supports business managers and analysts.

We believe a GRBS is indispensable for better business governance for at least two reasons:

1. Its direct support for compliance and accountability.
   
   
2. Its potential for achieving true business agility. (If you can't put your fingers on your business rules quickly, how can you evaluate and change them?!)

As I started off saying in this discussion, all these ideas seem to me just common sense; we just need to make them more common.

References

[1]  We use RuleSpeak (free on www.RuleSpeak.com) to express business rules in structured natural language.

[2]  Semantics of Business Vocabularies and Business Rules (SBVR) is a standard initially released in December, 2007 by the Object Management Group (OMG).  The central goal of SBVR is to enable the full semantics of business rules and other forms of business communication to be captured, encoded, analyzed (for anomalies), and transferred between machines (thereby achieving semantic interoperability).   For more information about SBVR, see the SBVR Insider section on www.BRCommunity.com.

[3]  The Business Motivation Model (BMM) ~ Business Governance in a Volatile World.  [May 2010].  Originally published Nov. 2000.  Now an adopted standard of the Object Management Group (OMG).  See www.BusinessRulesGroup.org.