Aghakhani Ghazaleh
email: ghazaleh.aghakhani@uclouvain.be

Yves Wautelet
email: yves.wautelet@kuleuven.be

Manuel Kolp
email: manuel.kolp@uclouvain.be

Samedi Heng
email: samedi.heng@uliege.be

Integrating Risk Representation at Strategic Level for IT Service Governance: A Comprehensive Framework

Keywords: Strategic Risk, Risk Governance, Risk Appetite, Strategic Risk Modelling

Organizations tend to set and pursuit objectives against an environment which faces levels of uncertainty. The effect of these uncertainties on objectives can be positive (opportunity risk) or/and negative (hazard risk). With every decision made by people within a company, risks are created, modified, updated or deleted. Therefore, the way these decisions are made in terms of change management strategy as well as the information they are based on, influence how objectives are achieved and requirements fulfilled. Despite the importance of risk definition and risk taking at all organizational levels, organizations mostly consider risk at the management and operational levels. Risks nevertheless also need to be considered at the strategic (governance) level because they constitute what hampers an organization to achieve its strategy. This paper focuses on risk at the strategic level and for this purpose it enriches the Model Driven IT Governance (MoDrIGo) framework; the enriched framework allows to evaluate the alignment of business IT services with strategic objectives while balancing this alignment/support with the potential risk at governance level. All in all, the framework is applicable in broader governance scenarios. The relevance of MoDrIGo as starting point to build a risk-aware governance framework (compared to other similar methods) is mainly because of its service-orientation and its focus on software development issues. The enhanced framework thus provides a high-level risk overview that helps organizations to successfully perceive, detect and treat risks when pursuing their objectives.

Introduction

Organizations face an uncertain, increasingly complex and challenging environment. This has brought the concept of risk to a higher profile [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. In an organizational context, risk is usually referred to as anything that can influence the fulfilment of corporate objectives [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. Such risk may impede what the organization is seeking to achieve (hazard risk), cause uncertainty about the outcomes (control risk) or enhance their goal (opportunity risk) [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. Being ultimately responsible for the organization's business performance, value creation and decision making (all associated with risk), the Board of Directors (BoD) is responsible for managing such risk by governing risk through overseeing, directing, as well as setting policies and monitoring performance [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. On the other hand, every business decision involves risk [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. Organizations deliberately take risks in order to gain a positive return in the context of gaining competitive advantage. These risks can be considered as speculative risks or opportunities, and an organization has a specific appetite to invest in such risks [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. Balancing risk with acceptable reward for creating value without jeopardizing the organization has been a challenge for boards and senior management [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. Therefore, it is crucial to understand the corporate exposure to risk and govern it properly [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. According to [START_REF] Council | Risk governance guidance for listed boards[END_REF], "a sound risk governance allows for the articulation of how, in the context of its risks, a company is able to achieve its business objectives, formulate its value proposition, assess its risk tolerance, and design its processes with respect to the reasonable expectations of stakeholders"

Traditional risk management approaches do not necessarily detect future strategic risks or anticipate future performance. Hence, rather than creating value, they are more focused on its protection [START_REF] Serafin | Exploring strategic risk: 300 executives around the world say their view of strategic risk is changing[END_REF]. In previous approaches risk has been addressed rather at the operational and management levels; risk is often tackled well at the operational level by taking appropriate precautions and insurance against events such as fire, theft, vehicle damage, and employee accidents. More precisely, risks that are internal to the organization are usually identified from experience, brainstorming sessions or risk lists, registers and taxonomies. At the managerial level, risks tend to be less well-handled because they are not so obvious to recognize. Loss of profits following an incident, product liability, reputational loss, and failure of management information systems are examples of such risks. Risks at the strategic level, however, may not be identified at all, even by top management, which can lead to negative impacts on the achievement of the long term objectives leading to the failure of the overall strategy [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. In order to address this gap, this paper aims to address different aspects of risk treatment at the governance level. For that, we will enhance the Model-Driven IT Governance (MoDrIGo) framework of Wautelet [START_REF] Wautelet | A model-driven it governance process based on the strategic impact evaluation of services[END_REF], an existing model driven strategic framework, with risk concepts in order to better identify what are the different aspects of risk at the strategic level and better taking this into account for decision making.

Research Positioning and Objectives

Research Questions

The complex and fast evolution of the business environment has led to the emergence of a growing focus on risk management [START_REF] Frigo | Strategic risk management: A foundation for improving erm and governance[END_REF]. The focus is expanded to the broader, enterprise-wide risks faced by companies [START_REF] Frigo | Strategic risk management: A foundation for improving erm and governance[END_REF]. This especially includes strategic risks as their identification is important for the successful achievement of a business strategy [START_REF] Choi | When do companies need a board-level risk management committee[END_REF]. Being in the paradigm of Design Science Research, we aim to bring a solution/enhancement to the identified problem of strategic-level risk identification, representation and treatment. Subsequently, we will use the identified risks to balance business-IT service adaptation based on Business IT Alignment (BITA). For that, this paper aims to answer the following question: How can we use the identified risk concepts at the strategic level to balance business IT service adoption decisions based on BITA?

The Choice of MoDrIGo

The relevance of MoDrIGo for this research results from its internal qualities when compared to three other similar frameworks on the basis of five important criteria. We used google scholar to find these frameworks and narrowed the research by selecting frameworks that focus on BITA and that are goal-oriented or/and industry-adopted. We -ArchiMate [START_REF] Sales | Ontological analysis and redesign of risk modeling in archimate[END_REF] --SOARE [START_REF] Bleistein | Strategy-oriented alignment in requirements engineering: linking business strategy to requirements of e-business systems using the soare approach[END_REF] ---compared these frameworks based on five criteria that we assume crucial for a framework to embrace the strategic risk aspects: Stakeholder-oriented refers to the consideration of all parties that are impacted by the future success or failure of an organization. This is especially important for us as we should identify the stakeholders who are affected by risk (i.e. who are responsible to take risk, perceive risk, mitigate risk, treat risk, etc.).

(Strategy and goal)-oriented refers to the focus on the strategies pursued by an organization. It allows to model strategic goals desired by some stakeholders and aimed to lead the organization to an enhanced competitive position. Having such characteristic is crucial for a risk aware framework as it allows to capture the impact of risks on a strategic goal as well as the amount of risk that the organization is willing to take in order to achieve such goal.

Service-driven refers to the delimitation of a software system entities into coarsegrained elements called services. The latter do have a seamless and tightly integrated interaction [START_REF] Cherbakov | Impact of service orientation at the business level[END_REF]. Services are well suited elements for software governance on one side [START_REF] Wautelet | A model-driven it governance process based on the strategic impact evaluation of services[END_REF] but also for forward engineering (i.e. transformation) and traceability on the other side [START_REF] Wautelet | Business and model-driven development of bdi multi-agent systems[END_REF]. Being service-oriented, a framework thus allows to (i) use identified risk elements for (strategic) decision (acquisition of services in the infrastructure) and/or (ii) to take actions to mitigate risk within the service adoption/development [START_REF] Fugini | Service-oriented architecture for risk management[END_REF]. Support for BITA refers to the correspondence between business and IT objectives. This is especially important here because we are interested in how to trace the strategic risk at the tactical and operational levels.

Focus on Software Development Issues refers to the fact that rather than addressing problems at the enterprise architecture level, as mentioned earlier, we are focusing on services and functions with respect to the defined strategies and risk criteria.

Table 1 shows a comparative analysis of MoDrIGo with other frameworks. We can see that MoDrIGo outperforms the competing frameworks because it supports all the aforementioned criteria. For example, MoDrIGo supports BITA by making an explicit link between strategic and tactical levels. Therefore, enriching MoDrIGo helps understand the involvement of strategic risks in governance decisions of the BoD and the way the c-suite perceives and handles these risks.

Research Background

Mostly organizations develop a vision statement, or mission statement where they identify their functional goals and targets. This identification must be coupled by determining the minimum required risk that needs to be taken in order to achieve such goals and targets. In case of unrealistic required risk (i.e., too high), the goals should be adjusted or the company will automatically undergo an exceeding level of risk [START_REF] Duncan | Corporate governance, risk appetite and cloud security risk: A little known paradox. how do we square the circle?[END_REF].

Risk Is A Strategic Issue

Business risks are uncertainties that negatively (failing to achieve or delayed objectives) or positively (leading to exceed or early achievement of objectives) influence the ability of an organization to achieve its objectives and goals. They relate to business objectives as risk-taking is a prerequisite to success. For that, it is necessary to exploit some risks to take advantage of strategic opportunities and mitigate the ones that threaten success. The threatening risks include threats of problems occurring (e.g., misappropriation of assets) or opportunities not occurring (e.g., failure to achieve strategic goals) [START_REF] Sobel | Aligning corporate governance with enterprise risk management[END_REF]. Different sources provide different definitions of risk. The key definitions are:

-ISO Guide 73 [START_REF] Standardization | Risk Management: Principles and Guidelines[END_REF]: "Effect of uncertainty on objectives. Note that an effect may be positive, negative, or a deviation from the expected. Also, risk is often described by an event, a change in circumstances or a consequence." -Institute of Risk Management (IRM) [START_REF] Irm | Risk management standard[END_REF]: "Risk is the combination of an event and its consequences. Consequences can range from positive to negative." -Orange Book from HM Technology [START_REF] Book | Management of risk principles and concepts[END_REF]: "Uncertainty of outcome, within a range of exposure, arising from a combination of the impact and the probability of potential events." -Institute of Internal Auditors (IIA) [START_REF] Iia | The role of internal auditing in enterprise-wide risk management[END_REF]: "The uncertainty of an event occurring that could have an impact on the objectives. Risk is measured in terms of consequences and likelihood."

More risk definitions are provided in other studies such as [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF], [START_REF] Frigo | Strategic risk management: A foundation for improving erm and governance[END_REF], [START_REF] Porter | Creating and sustaining superior performance[END_REF] and [START_REF] Coyle | Risk awareness and corporate governance[END_REF]. Given the large number of available definitions, organizations should be able to choose the definition that is most appropriate for their purposes [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. We essentially refer to the definition provided by ISO Guide 73 as the most relevant to our research because we believe that other than being positive or negative, risk can also refer to the deviation from the expected objectives.

Enterprise Risk Governance and Management

To study risk at the governance level, it is important to distinguish classical risk management activities from risk treatment undertaken at the governance level. According to the ISACA COBIT 5 framework [26], there is indeed a clear distinction between governance and management: "Governance ensures that enterprise objectives are achieved by evaluating stakeholder needs, conditions and opinions; setting direction through prioritisation and decision making; and monitoring performance, compliance and progress against agreed-on direction and objectives (EDM)" "Management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives (PBRM)"

Organizations are more and more interested in risk and risk management [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. At the board level, Strategic Risk treatment is a necessary core competency [START_REF] Frigo | Strategic risk management: A foundation for improving erm and governance[END_REF]. According to Charan [START_REF] Charan | Owning up: The 14 questions every board member needs to ask[END_REF], the BoD need to concentrate on the inherent risk that lies in the strategy and strategy execution: "Risk is an integral part of every company's strategy; when boards review strategy, they have to be forceful in asking the CEO what risks are inherent in the strategy. They need to explore [what ifs] with management in order to stress-test against external conditions such as recession or currency exchange movements". Business decisions and strategy both carry risk. Managing risk is thus an integral part of board's corporate governance [START_REF] Choi | When do companies need a board-level risk management committee[END_REF] but BoD is not directly in charge of risk management. However, its governance activities make a significant contribution to effective Enterprise Risk Management. This includes defining and communicating risk tolerance thresholds to senior management, which will guide them in their decisions, and making sure that the management's performance indicators together with the associated key risks are properly aligned with the organization's strategy and appropriately linked to stakeholder value [START_REF] Sobel | Aligning corporate governance with enterprise risk management[END_REF]. More precisely, the attitude of an organization towards risk can be implied from the leadership which can be determined by its BoD as well as from its corporate objectives and strategies. This allows the organization to set out the objectives it is trying to achieve, and the strategies it is adopting to achieve these objectives. The harder to attain the objectives and ambitions of a company are, the greater the risks it should take to achieve them [START_REF] Coyle | Risk awareness and corporate governance[END_REF].

Modelling Risk and Risk Related Concepts: Related Work

Risk and security models help companies develop guidance and take action in order to embrace opportunity and manage risk [START_REF] Band | Modeling enterprise risk management and security with the archimate R . Language[END_REF]. Prior researches have discussed risk modelling. Asnar and Giorgini [START_REF] Asnar | Modelling risk and identifying countermeasure in organizations[END_REF] model risk at the organizational level by extending the Tropos goal model. Likewise, Band et al. [START_REF] Band | Modeling enterprise risk management and security with the archimate R . Language[END_REF] make use of the ArchiMate standard to incorporate risk and security concepts at all levels. Mayer and Feltus [START_REF] Mayer | Evaluation of the risk and security overlay of archimate to model information system security risks[END_REF] also analyse security and risk overlay of the ArchiMate language. Other studies rather propose a set of guidelines to model risk concepts. For example, Giannoulis [START_REF] Giannoulis | Exploring risk-awareness in i* models[END_REF] propose a set of guidelines that help refine i* models based on risk. However, despite the importance of considering risk at the governance level, all the aforementioned models only focus on risk at the management level. We believe that, to the best of our knowledge, Wautelet (2020) [START_REF] Wautelet | Using the rup/uml business use case model for service development governance: A business and it alignment based approach[END_REF] is the only framework that also considers governance level aspects (in a meta-model) but it does not represent it graphically nor illustrate it.

Running Example: Risk Governance in Healthcare

In recent years, biomedical, normative, and technological changes have led healthcare organizations to implement clinical governance as a way to make sure that they can provide the best quality of care and thus increase efficiency in an increasingly complex environment. One of the most relevant aspects of clinical governance is risk management [START_REF] Cagliano | A systemic methodology for risk management in healthcare sector[END_REF]. The latter is particularly crucial in the healthcare industry as mismanaging risks may result in dire consequences such as fatalities [START_REF] Teoh | Implicit enterprise risk management: an it healthcare adoption case study[END_REF]. The aim is to decrease the probabilities and impacts of adverse events while increasing the probabilities and impacts of positive events [START_REF] Cagliano | A systemic methodology for risk management in healthcare sector[END_REF].

The recent evolution in healthcare systems regarding the digitization of patient medical records, healthcare provider collaborative workflows, improved regulation requirements, along with increasing healthcare data records, has motivated the healthcare industry to adopt innovative technologies [START_REF] Gbadeyan | It governance and risk mitigation approach for private cloud adoption: case study of provincial healthcare provider[END_REF]. Technology contributes greatly to enhance safety in healthcare processes. However, without a well-structured organization, it may add more complication to the existing working practices, resulting in fewer benefits than expected [START_REF] Cagliano | A systemic methodology for risk management in healthcare sector[END_REF]. Adopting new technologies in the healthcare industry is usually a slow process. This is because medical informatics take-off involve uncertainties and risks. For that, it is necessary to first identify and make a realistic evaluation of business risk and then develop strategies to manage these risks [START_REF] Teoh | Implicit enterprise risk management: an it healthcare adoption case study[END_REF].

As an innovative technology, cloud computing provides opportunities to boost healthcare services from the perspective of legality, management, technology, and security. However, it is crucial to assess the risks that arise from cloud computing before its adoption in healthcare projects [START_REF] Gbadeyan | It governance and risk mitigation approach for private cloud adoption: case study of provincial healthcare provider[END_REF]. When a health organization decides to move its services into the cloud, it should develop strategic planning to evaluate the new model's benefits and risks. Moreover, the organization should assess the capabilities of the model to achieve the objective and identify strategies designed for the implementation [START_REF] Kuo | Opportunities and challenges of cloud computing to improve health care services[END_REF].

To illustrate risk and risk taking within the healthcare industry, we consider an evolution of the Saint-Romain hospital previously presented in [START_REF] Wautelet | Developing a multi-agent platform supporting patient hospital stays following a socio-technical approach: Management and governance benefits[END_REF]. Let's now consider that its governance board is interested in adopting a new strategy, which is moving its services into the cloud. Besides presenting significant opportunities, use of cloud also involves uncertainties. As such, the more educated Saint-Romain executives and boards become about the benefits and risks of adopting cloud, the more effectively they can prepare their organization for the future.

The utmost goal of Saint-Romain is to remain timely, efficient, and cost effective, and to provide high-quality services. For that, Saint-Romain requires to invest in continuous and systematic innovation. The aim of adopting cloud computing is to improve healthcare services within Saint-Romain. Some of these improvements are listed below:

putting in place an on-demand, self-service Internet infrastructure that provides Saint-Romain users with seven-days-a-week, real-time data collecting and access to computing resources anytime from anywhere; reducing the setup expenses of the electronic health record, such as software, hardware, networking, licensing fees, and personnel; possessing a cost-effective and on-premise IT solution without the need to purchase or examine software or hardware, or to employ internal IT staff to service and maintain in-house infrastructure; overcoming major issues and difficulties in biomedical research data management such as data-handling problems, and unavailable or expensive computational solutions to research problems; automating the process of collecting patients' sensitive data through a network of sensors that are connected to legacy medical devices, and then storing, processing and distributing the data in a medical center's cloud; eliminating manual collection work as well as the possibility of typing errors.

Despite the aforementioned benefits associated with adopting cloud computing, Saint-Romain encounters three key areas of risks: misalignment of cloud initiatives with business strategies, over-reliance on cloud service providers, and loss of control over high-value information. For Saint-Romain, avoiding such clinical risk is of high importance since if something goes wrong, this may lead to patient harm or possibly even death. Therefore, with respect to challenges and opportunities, the clinical governance of Saint-Romain should decide on how much clinical risk it is willing to accept so that the adopted cloud projects stay aligned with their strategies. In other words, the board of Saint-Romain should determine the cloud services that are appropriate to their healthcare based on their goals, risk appetite and tolerance.

The first step towards determining the risk appetite is to identify the assets that can incur risk such as healthcare reputation, patient trust, staff loyalty and personal experience, service delivery, cloud service management interface, network (connections, etc.), personal data, etc. The second step involves identifying likelihood and impact of events that could happen in case these assets are exposed to risk. Obviously, Saint-Romain does not consider to accept risks that exceed a certain level (i.e., risk tolerance).

5 The Risk-Aware MoDrIGo Framework

Risk-Aware MoDrIGo Meta-Model

Based on the literature study, some of the important concepts with regards to strategic risk modelling are identified and listed below. Each concept is illustrated on the case described in Section 4:

Strategic risk

Description: According to Frigo and Anderson [START_REF] Frigo | What is strategic risk management?[END_REF], strategic risks refer to both external and internal events and scenarios that prevent organizations to achieve their strategic objectives. Moreover, it is generally accepted that the best risk definition is the one that concentrates on risks as events (see definitions provided by ISO 31000 and IIA). Upon the occurrence of an event, the risk is materialized. Thus, a risk can be referred to as "an unplanned event with unexpected consequences".

Based on the type of consequence, it is common to classify risks into two types: opportunity (or speculative) risks, and hazard (or pure) risks. Organizations seek to embrace opportunity risks and mitigate hazard risks [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. Risks are often taken by organization to achieve a reward. In order to launch a new product, an organization decides to accept a certain level of risk by putting some of its resources at risk [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF]. ISACA [START_REF]Isaca: The Risk IT Framework[END_REF] emphasises that "taking on more risk means grabbing potential opportunities". Illustration: In Figure 1, the strategic risk is demonstrated as class Strategic Risk, a subclass of class Risk, and based on inheritance, it is either a Hazard Risk or an Opportunity Risk. Other types of risks such as operational (i.e., Operational Risk) and tactical (i.e., Tactical Risk) are also demonstrated in the meta-model but their detailed representation stays out of the scope of this paper.

Example: For Saint-Romain, misinformation, losing patient data, developing an undesirable reputation, not being able to offer high patient care, etc. are all strategic hazard risks that will negatively impact the strategic objectives of Saint-Romain.

On the other hand, personalised and responsive service, keeping wait time to minimum, real time information sharing between doctors and patients are examples of opportunity risks that could have a positive impact on the strategic objectives of Saint-Romain.

Digital context

Description: Today organizations are facing a fast paced, ever-changing world where digitization has been considerably changing individual, organizational and societal behaviour. The BoD plays a key role within the company to adapt to the changing strategic context. The growing momentum of digital transformation continues to influence society and organizations and thus continuously changes the strategic context of organizations. This shows the need for organizations to react to opportunities and threats of the changing context in order to strengthen or maintain their sustained competitive advantage [START_REF] Bankewitz | Digitalization and boards of directors: A new era of corporate governance?[END_REF]. Therefore, it is necessary to include digital context within the meta-model to address this issue. Here, digital context refers to different technological enablers such as big data, machine learning, IoT, algorithm-driven data analytical and processing capabilities, blockchain, artificial intelligence, crowd/sensor approaches, cloud, etc. through which information flows increase.

Illustration: In the meta-model, digital context is demonstrated as Digital Context class in grey color.

Example: In the case of Saint-Romain, adoption of cloud computing and integrating it with the healthcare activities, objectives, etc. not only impacts strategic objectives (formulating new objectives, modifying and eliminate some), it also creates, eliminates, or changes risks and opportunities. In case of other emerging digital contexts, such as mobile technologies and big data analytics, Saint-Romain would have different risks, opportunities, and strategic objectives.

Key Risk Indicators (KRI)

It is hard to measure the effectiveness of risk policy without considering KRIs and comparing them over time [START_REF] Peček | Methodology of monitoring key risk indicators[END_REF]. According to Coleman [START_REF] Coleman | Risk strategies: dialling up optimum firm risk[END_REF], KRIs are measurements or statistics that can yield a perspective of an organization's risk position.

The effective development of these KRIs has the goal to identify the relevant metrics that result in useful insights regarding potential risks that may influence the organization's objectives [START_REF] Beasley | Developing key risk indicators to strengthen enterprise risk management-how key risk indicators can sharpen focus on emerging risks[END_REF].

Illustration: In the meta-model, KRI is demonstrated as Key Risk Indicator class in blue color.

Example By considering the impact and likelihood of a risk (as two examples of KRI), Saint-Romain is able to oversee possible risk.

Risk impact and the consequence

Description: One of the important KRIs considered by risk managers, is the impact or the consequence that a risk can incur if materialized. The impact is considered as the way a risk affects the organization and its objectives. It represents the residual, net or current level of the risk. The impact of an event is reduced via the controls that are in place [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF].

Illustration: In the meta-model, the risk impact and the consequence is demonstrated as Impact class in blue color.

Example: In Saint-Romain, losing patient's vital data (i.e., risk) may result in losing patient's confidence in health service (i.e. impact of the risk).

Likelihood

Description: Another important KRI, is the likelihood or the probability of risk occurrence. According to Hopkin [START_REF] Hopkin | Fundamentals of risk management: understanding, evaluating and implementing effective risk management[END_REF] likelihood is a broader word than, but includes frequency. It refers to the possibilities of an unlikely event happening.

Illustration: In the meta-model, the likelihood is demonstrated as Likelihood class in blue color.

Example: In Saint-Romain, losing patient's vital data (i.e., risk) may result in losing patient's confidence in health service (i.e. impact of the risk). The likelihood of losing patient data will be low (high) if the staff are (not) well trained with in using new systems in place.

Risk response and treatment

Description: For each identified risk within the risk profile, a decision must be made -within risk tolerance limit -on the way this risk needs to be treated [START_REF] Al-Ahmad | A code of practice for effective information security risk management using cobit 5[END_REF].

Treating a risk changes the likelihood, impact and the magnitude of consequences, both negative and positive, to achieve a net increase in profit [START_REF] Purdy | Iso 31000: 2009-setting a new standard for risk management[END_REF]. There are several treatment options or more precisely risk responses: risk avoidance, risk acceptance, risk transfer/sharing and risk mitigation [START_REF] Al-Ahmad | A code of practice for effective information security risk management using cobit 5[END_REF][START_REF]Isaca: The Risk IT Framework[END_REF]. ISO 31000 also defines other options to deal with both risks that have upside and/or downside consequences. It includes: "removing risk source", "taking or increasing the risk in order to pursue an opportunity", "changing the likelihood", "changing the consequences" [START_REF] Purdy | Iso 31000: 2009-setting a new standard for risk management[END_REF]. The treatment plans are then based on these treatment options [START_REF] Al-Ahmad | A code of practice for effective information security risk management using cobit 5[END_REF][START_REF]Isaca: The Risk IT Framework[END_REF] (i.e., link between risk response and risk treatment and risk). Defining risk response has the goal of aligning risk with the defined risk appetite [START_REF]Isaca: The Risk IT Framework[END_REF].

Illustration: In the meta-model, the risk response is demonstrated as Risk Response class in blue color. The realization of this response is done through risk treatment illustrated as Risk Treatment class in green color.

Example: In the case of Saint-Romain, when the healthcare realizes that there are cyber-attack risks involved with cloud adoption, as possible responses, it can only host the non sensitive and nonessential data of its patients on Cloud Service Provider, or deploy encryption over these data.

Risk appetite

Description: Risk appetite refers to the amount and type of risk that a company is willing to take or more precisely managers are willing to 'bet' to meet their strategic goals [START_REF] Duncan | Corporate governance, risk appetite and cloud security risk: A little known paradox. how do we square the circle?[END_REF][START_REF] Coyle | Risk awareness and corporate governance[END_REF]. The tolerable deviation from the level determined by the risk appetite and business objectives is referred to as risk tolerance [START_REF]Isaca: The Risk IT Framework[END_REF]. The more severe the business impact of an event -resulting from an asset being exposed to risk -the less the risk appetite.

Illustration: In the meta-model, the risk appetite is demonstrated as Risk Appetite class in grey color. Its main attribute is risk tolerance.

Example: For Saint-Romain, patient safety is a top priority. As such, it is not willing to accept any risk that comprises the safety of patients in the pursuit of its strategic objectives (eg. when patient experience indicators show a decrease in quality or when poor bed management or poor clinical records management impact patient safety). On the other hand, the hospital has a greater appetite when it comes to risks that may have impact on organizational issues (eg. failure to maintain the development of the organizational culture). Finally, Saint-Romain will accept highest risk level when it comes to pursuing innovation and challenging current working practices. Likewise, Saint-Romain has greatest appetite for reputational risks in terms of its desire to take opportunities where positive gains are anticipated (eg. failure to acquire share of new market). Risks that score outside of risk appetite (based on risk type, likelihood, impact, etc.) will be registered and reported to be reviewed at the clinical board.

Within Figure 1, the MoDrIGo meta-model is enriched with the constituting elements described above. Note that different colors are applied on this meta-model to better distinguish different levels (of decision-making, goals, plans, etc.) within an organization.

The elements that are associated with the governance/strategic level are colored in grey while the ones that are at the tactical level are colored in orange. To show the activities that are considered at the operational level, the green color is chosen. Finally, the color blue indicates the elements that can be associated to all three levels.

Model-based Representation of Risk at the Strategic and Management

Levels of MoDrIGo Figure 2 shows an enhanced governance model of MoDrIGo's strategic level representation with (strategic) risk elements. The aim of modelling such representation is that first, it represents the elements that play a key role at the strategic level of an organization (here the Saint-Romain healthcare) and second, it represents the impact of the risk identification at the management level representation (here the Bed Management service) onto the business strategies. The blue arrow going from the service to the strategic objective represents the generation of an opportunity risk and the red arrow represents the generation of a hazard risk. Following is the explanation of each of the constructs in the Figure : hazard risk refers to the risks that negatively affect Saint-Romain's strategic objectives and is represented by an hexagon with letter "H". On the other hand, opportunity risk refers to risks that positively affect the strategic objectives of Saint-Romain and is represented by an hexagon with letter "O". The interconnecting link between these risks and the strategic objective is shown by the contribution link, taken from i*, that can either represent a positive (opportunity risk) or a negative (hazard risk) influence. Digital context, represented by a rectangle, demonstrates new emerging technologies such as cloud computing, mobile technology, etc. The link between this construct and the risks is represented by the i* contribution link. The "help" link demonstrates how an opportunity risk or a hazard risk can be improved by adopting the digital context, while the "hurt" link shows how adopting the digital context aggravates the risk. This is especially important as today, organizations are more and more striving for digital transformation. The consequence of the hazard or opportunity risks, illustrated by a diagonal snip rectangle, represents the consequence that a particular hazard risk or opportunity can have if materialized. The relation between the risks and the consequence is illustrated by an open arrow. Risk appetite, represented by an eight point star or octagram, is one of the key concepts when it comes to board risk-taking and risk oversight. The association link from the risk appetite to the strategic objective shows the amount of risk that an organization is willing to take in the pursuit of such a strategic objective. Finally, the blue cloud in bold represents the bed management service (Figure 3) as an operationalization.

With the new added constructs at the governance level, we are able to model, first, the elements that affect the strategy such as risks and opportunities, and second, the risk acceptance level of BoD regarding the achievement of a particular strategic objective. This is important as it helps organizations avoid taking too much risk with regards to the achievement of their objectives and thus to prioritise significant risks. Taking into account the strategic objective "provide high quality care service", with the new constructs, it is now possible to first show the negative and positive risks that affect this strategic objective. "A personalized and responsive service" has a strong contribution (i.e. make) to satisfice this strategic objective while "loss of patient data" has a negative contribution sufficient enough to deny it. Moreover, providing high quality, effective and safe services with the aim to improve the well-being, health, and independence of the population served by Saint-Romain is its main strategy. We can discuss that the hospital is not willing to accept risks that limit its ability to fulfill such objective. Being the top priority, patient safety is associated with the lowest level of risk appetite. Regarding patient experience and quality care, Saint-Romain will accept a higher, yet low, level of risk (as long as it maintains patient safety as well as service improvements and quality care). Hence, the overall risk appetite of the hospital is quite low. As soon as these risks exceed a certain level that can result in jeopardising patient safety, poor quality care or non-compliance with standards, they are reported. Finally, considering cloud computing as digital context is important as it shows how this technology can aggravate or improve the existing risks and indirectly influence the strategy. In other words it can either put in place facilities that can help in achieving this strategic objective or hindering it by aggravating the existing risks or creating new ones. Here, cloud computing can aggravate data loss. This is because sensitive patient data might be stolen for fraudulent purposes. On the other hand, using cloud improves personalised and responsive services by providing real-time information sharing.

Figure 3 illustrates the management level representation of MoDrIGo (the bed management service) enhanced by relevant risk elements. The aim is to study the impact of the enhancement at the management level on the fulfillment of organizational strategies. At this level, we take into account the opportunity risk (represented with a blue hexagon) and the hazard risk (represented with a red hexagon) that are associated with each of the management level elements and can influence (represented by the threatening link) the strategic objectives. Following such representation, it is possible to see how risk can be escalated to the strategic layer and jeopardize the involved strategy. For example, the task "stay planning" is associated with the opportunity risk keep waiting time to minimum, which helps to the achievement of the strategic objective "Enhance patient experience". On the other hand, the goal record planning is associated with hazard risk data breach which, has a negative influence on the fulfillment of both strategic objectives increase overall safety of patients and enhance patient experience. The ability to treat risks is another important enhancement brought to MoDrIGo's managementlevel representation. This is represented by a green hexagon as a risk treatment and is connected to the hazard risk via the treatment link.

Discussion and Conclusion

In this paper we enriched the MoDrIGo framework with risk related concepts. The enhanced MoDrIGo framework sheds light on two important factors. The first one refers to the importance of considering risk at the strategic level of an organization and its influence on the strategic objectives. This allows the BoD to first perceive and iden-Despite the advantages of the resulting risk aware framework in recognizing risk at strategic and management level, the framework has the limitation to rapidly grow within large cases. Future work includes enhancing the framework to deal with scalability issues. This way we can fine-tune the framework and tackle the issues it faces such as scalability. The latter is one of the important issues that we consider to work on for the future improvement of the framework. We plan to overcome such problem by making use of modularity and separation of concerns (e.g. having different views). More precisely having a case tool that allows to roll up and drill down on the basis of strategic objectives.

Fig. 1 .

 1 Fig. 1. Risk-aware MoDrIGo Meta-Model.

Fig. 2 .

 2 Fig. 2. Risk-aware Business Strategic-level Representation

Table 1 .

 1 A comparative analysis of MoDrIGo and other competing methods

	Criteria

tify the negative and positive aspects of risks that could impact the achievement of objectives and second to determine the amount of risk they are willing to accept in order to achieve their strategic objectives. The second factor refers to the significance of recognizing risks at the managerial level and their impact on the fulfillment of their strategic objectives. The extension was first applied to the meta-model of MoDrIGo, then to its governance level representation and finally for the sake of traceability to the management-level representation. Based on the Saint-Romain example, we can discuss the main contributions provided by the resulting enhanced risk-aware governance framework:

-Risks are involved every time the BoD seeks to achieve its objectives. When instantiated, the risk-aware MoDrIGo framework allows C-level executives to understand the risk concerns of every decision in relation to strategic objectives. -It is crucial that the BoD takes an adequate amount of risk that it assumes necessary to achieve a particular strategic objective. This is done by defining risk-taking elements such as risk-appetite and risk tolerance that control and mitigate risks. The higher the priority of an objective for an organization, the greater the risk it is willing to take for such objective. -By enhancing the management level representation of MoDrIGo with the relevant risk concepts, we ensure the traceability between the governance and the management levels. This is done by studying the impact of the enhancement at the managerial level on the fulfillment of organizational strategies.


Giancarlo Guizzardi
email: giancarlo.guizzardi@unibz.it

Tiago Prince Sales

João Paulo

A Almeida
email: jpalmeida@ieee.org

Geert Poels
email: geert.poels@ugent.be

Relational Contexts and Conceptual Model Clustering

Keywords:

In recent years, there has been a growing interest in the use of reference conceptual models to capture information about complex and sensitive business domains (e.g., finance, healthcare, space). These models play a fundamental role in different types of critical semantic interoperability tasks. Therefore, it is essential that domain experts are able to understand and reason with their content. In other words, it is important for these reference conceptual models to be cognitively tractable. This paper contributes to this goal by proposing a model clustering technique that leverages the rich semantics of ontology-driven conceptual models (ODCM). In particular, the technique employs the notion of Relational Context to guide automated model breakdown. Such Relational Contexts capture all the information needed for understanding entities "qua players of roles" in the scope of an objectified (reified) relationship (relator).

Introduction

In recent years, there has been a growth in the use of reference conceptual models, in general, and domain ontologies, in particular, to capture information about complex and critical domains [START_REF] Guizzardi | Ontological patterns, anti-patterns and pattern languages for next-generation conceptual modeling[END_REF]. However, as the complexity of these domains grows, often so does the sheer size and complexity of the artifacts that represent them. Moreover, in sensitive domains (e.g., finance, healthcare), these models play a fundamental role in different types of critical semantic interoperability tasks, therefore, it is essential that domain experts are able to understand and accurately reason with the content of these models. The human capacity for processing unknown information is very limited, containing bottlenecks in visual short-term memory and causing problems to identify and hold stimuli [START_REF] Moody | The physics of notations: toward a scientific basis for constructing visual notations in software engineering[END_REF]. Therefore, there is an evident need for developing adequate complexity management mechanisms for reference conceptual models.

One type of such complexity management mechanisms is conceptual model modularization or Conceptual Model Clustering (henceforth CMC) [START_REF] Akoka | Entity-relationship and object-oriented model automatic clustering[END_REF]. CMC is the process by which a model is fragmented into smaller interconnected parts [START_REF] Lozano | Ontology view extraction: an approach based on ontological metaproperties[END_REF], each of which can be more easily manipulated by a model user than the entire model. The greatest challenge in CMC is the process for module extraction, namely, coming up with adequate criteria for dividing the model into modules that ease model understanding.

Traditionally, different techniques have been used for module extraction (e.g., [START_REF] Akoka | Entity-relationship and object-oriented model automatic clustering[END_REF][START_REF] Lozano | A novel approach for extracting well-founded ontology views[END_REF]). However, almost the totality of these approaches address modularization in languages that are ontologically-neutral [START_REF] Guizzardi | The role of foundational ontologies for domain ontology engineering: An industrial case study in the domain of oil and gas exploration and production[END_REF] such as UML, ER diagrams or OWL 4 .While these languages may have a well-defined abstract syntax and a formal (logical) semantics, in general, they lack an ontological semantics. Consequently, the modularization techniques developed for them rely on criteria that leverage almost exclusively on the syntactical properties of the models, typically, topological ones [START_REF] Villegas Niño | A filtering engine for large conceptual schemas[END_REF].

In contrast, ontology-driven conceptual modeling (ODCM) languages are systematically designed to conform to an underlying ontological theory. In particular, an ODCM language contains exactly the modeling primitives that are necessary to represent the ontological distinctions put forth by its underlying ontology. ODCM approaches have enjoyed an increasing adoption by the Conceptual Modeling community as a number of independent results consistently show their benefits for improving the quality of conceptual models (e.g., [START_REF] Verdonck | Comparing traditional conceptual modeling with ontology-driven conceptual modeling: An empirical study[END_REF]). An example of an ODCM language is OntoUML [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF], whose primitives reflect the underlying UFO foundational ontology [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF].

In this paper, we leverage the ontologically well-founded semantics of OntoUML to propose a formal approach for automated modularization in conceptual models. The proposed approach breaks down an OntoUML model in a number of Relational Contexts. Intuitively, Relational Contexts are modules that capture all the information needed for understanding entities qua players of roles in the scope of an objectified (reified) relationship (ontological speaking, the so-called relators).

As reported in [START_REF] Teixeira | An ontology-based process for domain-specific visual language design[END_REF], Relators and Roles are clearly the most used OntoUML constructs in conceptual models. This is unsurprising, given the strong adoption of On-toUML/UFO in Business (Organizational/Social/Legal) domains [START_REF] Verdonck | Insights on the use and application of ontology and conceptual modeling languages in ontology-driven conceptual modeling[END_REF], as well as the fact that in these realms the bulk of the domain knowledge is concentrated in relationships and roles. As argued in [START_REF] Guizzardi | Objects and events in context[END_REF], specially in these realms, "we seldom interact with these entities qua-themselves, but we frequently conceive objects qua-playing-certainroles in given 'contexts'... For example, most of our interactions with other human beings and, hence, our conceptualizations of these interactions are thought in terms of roles such as parent, employee, student, president, citizen, customer, etc. Analogously, when thinking about, for instance, cars, we think about them as means of transportation, insurable items, work-related resources, product offerings, etc. Moreover, we often conceive these 'contexts' as relational ones: marriages, employments, enrollments, and presidential mandates are themselves concrete 'object-like' entities that define a scope in which ordinary objects play complementary roles interacting with each other". This view is also defended by other authors such as [START_REF] Baldoni | Interaction between objects in powerjava[END_REF], who go as far as to claim that "[r]oles are useful not only to model domains that include institutions and organizations. Rather, every object can be considered as an institution or an organization structured in roles".

The proposal advanced here is, thus, aimed at conceptual models in business (organizational, social and legal) domains, which form the bulk of the Information Systems discipline. For models that are centered on taxonomic relations (e.g., product types, biological taxonomies), we recommend alternative complexity management techniques, in particular, the static ontological views as proposed in [START_REF] Figueiredo | Breaking into pieces: An ontological approach to conceptual model complexity management[END_REF]. In fact, this paper can be seen as a companion to [START_REF] Figueiredo | Breaking into pieces: An ontological approach to conceptual model complexity management[END_REF] and [START_REF] Guizzardi | Ontology-based model abstraction[END_REF] in a general research program of defining ontologydriven complexity management theories, techniques and tools. While in these two papers the focus is on model recoding with ontology-design patterns, and on model abstraction, respectively, here we propose the notion of relationship-centric conceptual model modularization (or clustering).

The contributions of this paper are two-fold: (i) firstly, we proposed a formalization of the notion of Relational Context by leveraging on the theory of relators from UFO/OntoUML; We then use this notion to propose a strategy for relationship-centric modularization termed Relator-Centric Clustering; (ii) secondly, we provide an implementation of this strategy integrated in the OntoUML toolset.

The remainder of the paper is organized as follows. Section 2 positions our work in reference to related efforts; Section 3 briefly presents the OntoUML language and some of the ontological notions underlying it; Section 4 presents the contributions of this paper. Firstly, it defines the notions of Ontological Views, Relational Contexts, and Modular Breakdown. This is done both formally, in terms of a precise definition of these notions, as well as intuitively by making use of a running example in the domain of Car Rental. In addition, we report on an implementation of this approach as a plug-in to a model-based OntoUML editor. finally, Section 5 presents some conclusions of the presented approach and some intended directions for future work.

Complexity Management of Conceptual Models

The discipline of complexity management of large conceptual models (henceforth CM-CM) has been around for quite some time and has been represented in the literature by a series of different approaches and techniques. In fact, [START_REF] Villegas Niño | A filtering engine for large conceptual schemas[END_REF] claims that "one of the most challenging and long-standing goals in conceptual modeling... is to understand, comprehend and work with very large conceptual schemas".

The challenge and importance of this discipline lie in the following. On one hand, real information systems often have large and extremely complex conceptual models [START_REF] Villegas Niño | A filtering engine for large conceptual schemas[END_REF]. On the other hand, this complexity poses a serious additional challenge in the comprehension and, consequent, quality assurance of these models. For example, [START_REF] Sales | Ontological anti-patterns: Empirically uncovered error-prone structures in ontology-driven conceptual models[END_REF] reports on an empirical study conducted with a large and professionally constructed conceptual model. 5 In that study, the authors managed to show that the model contained 879 occurrences of error-prone structures (anti-patterns), 52.56% of which really introduced representation errors according to the creators of the model.

According to [START_REF] Villegas Niño | A filtering engine for large conceptual schemas[END_REF], the methods for CM-CM can be classified in three areas, namely, Clustering Methods, Relevance Methods, and Summarization Methods. Clustering is about classifying the elements of a conceptual model into groups, or clusters, according to some criteria (e.g., a similarity function); Relevance Methods are about the application of ranking functions to the elements of a model in order to obtain ordered lists (i.e., a ranking) of model elements according to their perceived relevance in representing the domain at hand; finally, Model Summarization is about producing from an original model a reduced version consisting only of the elements that are judged to be of more relevance for representing the domain at hand. In clustering methods, the goal is to break down a model in fragments such that the sum of these fragments should be informationally equivalent to the whole (i.e., to the original model). In contrast, relevance and summarization methods (including model abstraction) aim to produce partial views of the original model at hand. In other words, while clustering methods have lossless model transformations, the latter classes of methods are based on lossy transformations.

A drawback that is common to the majority of existing methods in all these classes is that they are based on classic conceptual modeling notations (e.g., UML, ER) [START_REF] Villegas Niño | A filtering engine for large conceptual schemas[END_REF], they are constrained to rely almost exclusively on syntactic (mainly topological) properties of the addressed models. These properties include closeness (a quantitative evaluation of the links among elements in the model) [START_REF] Francalanci | Abstraction levels for entity-relationship schemas[END_REF], hierarchical distance (length of the shortest relationship path between entities), structural-connective distance (elements are considered closer if they are neighbors in a hierarchy mereological or subtyping structure), or category distance (elements are considered to be closer if one subtypes the other) [START_REF] Akoka | Entity-relationship and object-oriented model automatic clustering[END_REF]. For example, [START_REF] Castano | Conceptual schema analysis: Techniques and applications[END_REF] proposes a (relevance) method based on the assumption that the number of attributes and relations characterizing an element in a model can be used as a (heuristic) measure of its relevance for that model. In the same spirit, [START_REF] Tzitzikas | How to tame a very large er diagram (using link analysis and force-directed drawing algorithms)[END_REF][START_REF] Tzitzikas | On ranking rdf schema elements (and its application in visualization)[END_REF] go as far as proposing PageRank-style algorithms to infer the relevance of elements in entity-relationship diagrams and RDF schemas (even ignoring the difference between association and subtyping relations). The problem with relying solely on these properties is that there is no guarantee that a model element satisfying some topological requirement (e.g., a node with more edges connected to it) by necessity represents the model's most important concepts. This is related to the work by [START_REF] Moody | A methodology for clustering entity relationship models: a human information processing approach[END_REF][START_REF] Moody | A decomposition method for entity relationship models: A systems theoretic approach[END_REF], that while criticizing existing CM-CM methods, referred to it as lack of cognitive justification.

The method proposed here is a type of clustering method. However, in contrast with all the aforementioned approaches, our proposal focuses mainly on the ontological semantics [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF] of the elements represented in a conceptual model. As previously discussed, the idea is to use a formal and ontological notion of Relational Context (see section 4) as a clustering mechanism. Relational Contexts are built from a focal reified relationship (relator), and extrapolating from there on to the different roles played by entities in the scope of that relationship, the kinds defining the essential properties and identity principle characterizing the entities playing these roles, among other aspects.

This approach (detailed in section 4) is only made possible because it is based on a non-classical CM language, namely, the ODCM language OntoUML (briefly presented in section 3). There are three CM-CM methods in the literature that are based on the same language, namely, the approaches of (i) [START_REF] Figueiredo | Breaking into pieces: An ontological approach to conceptual model complexity management[END_REF], (ii) [START_REF] Guizzardi | Ontology-based model abstraction[END_REF], and (iii) [START_REF] Lozano | A novel approach for extracting well-founded ontology views[END_REF][START_REF] Lozano | Ontology view extraction: an approach based on ontological metaproperties[END_REF]. The first method is the one that is closer to work presented here, since it is also a clustering method and, hence, a lossless approach. What is presented there is an approach for what the authors name Model Recoding. The method takes a conceptual model and produces a series of views constituted by ontological design patterns centered around general (as opposed to model specific) ontological constructs. So, for example, it groups all the kinds of things the model in one view, all the roles played by things in a relational context in another view, etc. So, instead of breaking down the model into clusters that correspond to what one could intuitively call sub-domains, that approach brakes down the model in terms of general ontological categories. In contrast, the approaches of [START_REF] Guizzardi | Ontology-based model abstraction[END_REF] and [START_REF] Lozano | A novel approach for extracting well-founded ontology views[END_REF][START_REF] Lozano | Ontology view extraction: an approach based on ontological metaproperties[END_REF] differ from the approach presented here since these are approaches for model summarization and hence lossy approaches. Finally, [START_REF] Lozano | A novel approach for extracting well-founded ontology views[END_REF][START_REF] Lozano | Ontology view extraction: an approach based on ontological metaproperties[END_REF] also differs from our approach since it requires user input in selecting a set of entities in the model that are of particular relevance. Our approach, instead, is a fully automated one, which we argue is an important feature in methods dealing with large-scale models.

A Whirlwind Introduction to UFO and OntoUML

OntoUML is a language whose meta-model has been designed to comply with the ontological distinctions and axiomatization of a theoretically well-grounded foundational ontology named UFO (Unified Foundational Ontology) [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF][START_REF] Guizzardi | Towards ontological foundations for conceptual modeling: The Unified Foundational Ontology (UFO) story[END_REF]. UFO is an axiomatic formal theory based on contributions from Formal Ontology in Philosophy, Philosophical Logic, Cognitive Psychology, and Linguistics. A recent study shows that UFO is the second-most used foundational ontology in conceptual modeling and the one with the fastest adoption rate [START_REF] Verdonck | Insights on the use and application of ontology and conceptual modeling languages in ontology-driven conceptual modeling[END_REF]. That study also shows that OntoUML is among the most used languages in ontology-driven conceptual modeling.

In the sequel, we briefly explain a selected subset of the ontological distinctions put forth by the Unified Foundational Ontology (UFO). We also show how these distinctions are represented by the modeling primitives of OntoUML (as a UML profile). For an in-depth discussion, philosophical justifications, formal characterization and empirical support for these categories one should refer to [START_REF] Guarino | We need to discuss the relationship": Revisiting relationships as modeling constructs[END_REF][START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF].

Take a domain in reality restricted to endurants [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF] (as opposed to events or occurrents). Central to this domain we will have a number of object Kinds, i.e., the genuine fundamental types of objects that exist in this domain. The term "kind" is meant here in a strong technical sense, i.e., by a kind, we mean a type capturing essential properties of the things it classifies. In other words, the objects classified by that kind could not possibly exist without being of that specific kind.

Kinds tessellate the possible space of objects in that domain, i.e., all objects belong to exactly one kind and do so necessarily. Typical examples of kinds include Person, Organization, and Car (see Figure 1; stereotypes reflect the correspondence between the UML profile and UFO 6 ). We can, however, have other static subdivisions (or subtypes) of a kind. These are naturally termed Subkinds. As an example, the kind 'Person' can be specialized in the subkinds 'Man' and 'Woman' (Figure 1). Object kinds and subkinds represent essential properties of objects (they are also termed rigid or static types [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]). We have, however, types that represent contingent or accidental properties of objects (termed anti-rigid types [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]). These include Phases (for example, in the way that 'being a living person' captures a cluster of contingent intrinsic properties of a person, or in the way that 'being a puppy' captures a cluster of contingent intrinsic properties of a dog) and Roles (for example, in the way that 'being a husband' captures a cluster of contingent relational properties of a man participating in a marriage, or that 'being a rental car' captures contingent intrinsic properties of a car participating in a car rental, see Figure 1). In other words, the difference between the contingent properties represented by a phase and a role is the following: phases represent properties that are intrinsic to entities (e.g., 'being a puppy' is being a dog that is in a particular developmental phase; 'being a living person' is being a person who has the intrinsic property of being alive; 'being an available car' is being a car that is functional and, hence, can be rented); roles, in contrast, represent properties that entities have in a relational context, i.e., contingent relational properties (e.g., 'being a husband' is to bear a number of commitments and claims towards a spouse in the scope of a marital relationship; 'being a student' is to bear a number of properties in the scope of an enrollment relationship with an educational institution.) Kinds, Subkinds, Phases, and Roles are categories of object Sortals. In the philosophical literature, a sortal is a type that provides a uniform principle of identity, persistence, and individuation for its instances [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]. To put it simply, a sortal is either a kind (e.g., 'Person') or a specialization of a kind (e.g., 'Student', 'Teenager', 'Woman'), i.e., it is either a type representing the essence of what things are or a sub-classification applied to the entities that "have that same type of essence".

Relators (or relationships in a particular technical sense [START_REF] Guarino | We need to discuss the relationship": Revisiting relationships as modeling constructs[END_REF]) represent clusters of relational properties that "hang together" by a nexus (provided by a relator kind). Moreover, relators (e.g., marriages, enrollments, presidential mandates, citizenships, but also car rentals, employments, and car ownerships, see Figure 1) are full-fledged Endurants. In other words, entities that endure in time bearing their own essential and accidental properties and, hence, first-class entities that can change in a qualitative manner while maintaining their identity.

As discussed in depth in [START_REF] Guarino | We need to discuss the relationship": Revisiting relationships as modeling constructs[END_REF], relators are the truth-makers of relational propositions, and relations (as classes of n-tuples) can be completely derived from relators [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]. For instance, it is 'the marriage' (as a complex relator composed of mutual commitments and claims) between 'John' and 'Mary' that makes true the proposition that "John is the husband of Mary". Relators are existentially dependent entities (e.g., the marriage between John and Mary can only exist if John and Mary exist) that bind together entities (their relata) by the so-called mediation relations -a particular type of existential dependence relation [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]. As discussed in depth in [START_REF] Guarino | We need to discuss the relationship": Revisiting relationships as modeling constructs[END_REF], like in the MERODE approach [START_REF] Snoeck | Enterprise information systems engineering[END_REF] (but here for ontological reasons), all domain relations in business models (the so-called material relations) can be represented exclusively by employing relators and these existential dependence relations (mediation).

Objects participate in relationships (relators) playing certain "roles". For instance, people play the role of spouse in a marriage relationship; a person plays the role of president in a presidential mandate; a car plays the role of a rental car scope of a car rental, see Figure 1. 'Spouse' and 'President' (but also typically student, teacher, pet) are examples of what we technically term a role in UFO, i.e., a relational contingent sortal (since these roles can only be played by entities of a unique given kind). There are, however, relational and contingent role-like types that can be played by entities of multiple kinds. An example is the role 'Customer' (which can be played by both people and organizations), see Figure 1. We call these role-like types that classify entities of multiple kinds RoleMixins.

Views, Relational Contexts, and Relator-Centric Clustering

In this section, we present a formal definition of our structure of ontological views, which are then used to formally define our notion of Relational Context (RC) and of Relator-Centric Clustering (RCC). Built over UFO's distinctions and for the OntoUML language, the approach presented here proposes rules to extract modules (clusters) from a conceptual model expressed in OntoUML.

Basic Definitions

Let a Model M be a graph defined such that M = Θ , Σ , Φ , where Θ = {C 1 ..C n } is the (non-empty) set of concepts in the model M), Σ = {r 1 ..r n } is the set of directed relations in the model and Φ = {gs 1 ..gs n } is the set of Generalization Sets in the model. Let CT (Concept Type), RT (Relation Type) and GST be domains of types such that CT = {SORTAL, NON-SORTAL, KIND, SUBKIND, PHASE, ROLE, ROLEMIXIN, RELATOR}, RT = {MEDIATION, SUBTYPING}, and GST = {PHASE-PARTITION, SUBKIND-PARTITION} . Now, let < be partial order relation defined in CT in the following way to reflect the specializations in the taxonomy of types in UFO: KIND < SORTAL, SUBKIND < SORTAL, ROLE < SORTAL, PHASE < SORTAL, ROLEMIXIN < NON-SORTAL. Finally, we define a number of auxiliary functions:

-C(M) is a function that maps a model M to its associated set Θ ; -R(M) is a function that maps a model M to its associated set Σ ; -GS(M) is a function that maps a model M to its associated set Φ; -E HasType T is a relation connecting an element E to a type T in the following manner: if E is a concept, then T ∈ CT ; if E is a relation then T ∈ RT , and if E is a generalization set, then E ∈ GST . We should also add that for any two types T and T such that T < T , if E HasType T then E HasType T ; t(r) is a function that maps a relation r to the target (destination) of that directed relation; s(r) is the complementary function that maps a relation r to the source (origin) of that directed relation; r gs connects a relation r with a generalization set gs such that r HasType SUB-TYPING and: if gs HasType PHASE-PARTITION then s(r) HasType PHASE; if gs HasType SUBKIND-PARTITION then s(r) HasType SUBKIND. Moreover, for any two relations r 1 and r 2 such that r 1 gs and r 2 gs, we have that t(r 1 ) = t(r 2 ).

As expected, we have that for every model M and every relation such that r ∈ R(M), we have that both s(r) ∈ C(M) and t(r) ∈ C(M). Moreover, every generalization set gs ∈ GS(M) is such that all r gs implies that r ∈ R(M).

For example, let M be the model depicted in We also define the following auxiliary function:

-K(C) mapping a sortal C to its unique supertyping KIND, i.e., we have that

K(C) = C iff C HasType KIND and IST * (C,C ). (Notice that if C is a KIND, then C = C .)
Again, using the model M of Figure 1 as an example, we have that, for instance, K(CarAgency) = Organization and K(PersonalCustomer) = Person.

View

Let M and M be models as previously defined. It follows that M is a view of M (symbolized as V (M, M ) iff:

-

C(M) ⊆ C(M ) and -R(M) ⊆ R(M ) and -GS(M) ⊆ GS(M ).
Notice that, given our definition of a model, we have that all r ∈ R(M) are such that s(r) ∈ C(M) and t(r) ∈ C(M), but also that for all r GS(M) we have that r ∈ R(M). In other words, M is necessarily an original subgraph of M .

The views we are ultimately interested in are the so-called Relational Contexts (RC), which will be defined in sub-section 4.6. Nevertheless, before we reach that, we need to establish two types of auxiliary views: Sortal Identity Paths and Non-Sortal Identity Paths. They are used later to support the definition of Relational Contexts. SIP is a generic parameterizable view definition that, given a sortal type c, it provides with a view that includes that type and all its supertypes (if any) until its corresponding kind is reached. Taking the model of Figure 1 and picking, for instance, Personal Customer as focus type, the corresponding SIP would be constituted by the types that generalize Personal Customer, i.e., Adult, Living Person, and, finally, Person. Later, we use SIP to determine which supertypes should be included in a Relational Context, namely those that reveal the nature of the entities in the context. The intention of the NSIP can explained as follows. Take a non-sortal type c in the model M , this view should include: (i) c itself and all its non-sortal subtypes; (ii) the first sortal specializing c as well as the path from this sortal to the unique kind providing its identity principle [START_REF] Guizzardi | Ontological foundations for structural conceptual models[END_REF]. Taking the model of Figure 1 and picking, for instance, Customer as focus type, in the corresponding NSIP, we have, besides the rolemixin Customer, the sortals that immediately specialize it (the roles Personal Customer and Corporate Customer) as well as the supertypes of each of these sortals that are in the path between them and their kinds (Person and Organization, respectively, in this case).

Relational Context

We define that M is a Relational Context of M with focus on a relator type rel, where (rel HasType RELATOR) (symbolized as RC(M, M , rel)) iff the following conditions are satisfied:

-V (M, M ); -c ∈ C(M) iff: • c = rel, or • there is a r ∈ R(M) and t(r) = c, or • there is a view M and a c ∈ C(M) such that (SIP(M , M , c ) or NSIP(M , M , c ))
and c ∈ C(M ), or • there is a gs ∈ GS(M) and a r gs and s(r) = c, or r ∈ R(M) iff:

• (r HasType MEDIATION and s(r) ∈ C(M)) or • (r HasType SUBTYPING and s(r) ∈ C(M)) and ((t(r) HasType RELATOR) or t(r) ∈ C(M)), or • there is a gs ∈ GS(M) such that r gs gs ∈ GS(M) iff:

• gs HasType PHASE-PARTITION and there is an r such that r gs and r ∈ R(M), or • gs HasType SUBKIND-PARTITION and for all r such that r gs then r ∈ R(M).

Now, this definition can benefit from some unpacking. The Relational Context (RC) starts by (naturally) including the focal relator rel (c = rel). In addition, it includes all types that are connected by that relator via MEDIATION relations (henceforth, mediated types) ((r ∈ R(M) and t(r) = c) and (r HasType MEDIATION and s(r) ∈ C(M))). For example, if we take the relator Car Rental as focus, the corresponding RC would also include the types of entities that are bound by instances of Car Rental in that context, i.e., Customer and Rental Car.

Furthermore, this RC should include in this context all the types going from these mediated types to their respective kinds. The rationale here is that in order to understand the nature of the entities connected by instances of the relator at hand, one must understand what kinds of things those entities essentially are, i.e., what sort of principle of identity they obey. In case any of these mediated types c is a sortal, then the RC will include all types in its SIP (c ∈ C(M) and there is and a view M such that SIP(M , M , c ) and c ∈ C(M )). So, in this example, for the sortal type Rental Car, it would include also the types Available Car and Car. In contrast, if any of the mediated types is a Non-Sortal, then the relational context will include all types in its NSIP (c ∈ C(M) and there is a view M such that NSIP(M , M , c ) and c ∈ C(M )). The rationale here is analogous. However, since different instances of a non-sortal might take their identities from different kinds, in order to understand that context, we need to include all the information in the identity path between that non-sortal mediated type and the relevant kinds. For instance, for a Car Rental Relational Context, we need to understand the notion of Customer and, in order to understand this notion we have to understand the notions of Personal Customer and Corporate Customer. Finally, in order to understand the latter, we need to understand Organizations, and to understand the former, the notions of Adult, Living Person and Person. After all, instances of Personal Customer are adult living people.

Besides the types in SIP and NSIP of mediated types, the Relational Context should also include all types that appear in phase partitions standing in the path between a mediated type and its identity supplier (i.e., its associated kind). The idea is that these types offer a contrast background that helps in the clarification of the semantics of the types in these paths. For example, in the Car Rental context, in order to understand that personal customers must be living adults, it is important to understand that they cannot be other alternatives of instances of Person, namely, living children, living teenagers, as well as deceased person. In particular, given the anti-rigidity of these types (phases), all instances of living person can cease to be so, thus, becoming deceased people, in which case they can no longer play the role of Personal Customer. Formally, if one of the subtyping relations in a (N)SIP is part of a phase partition, then that phase partition generalization set is included in the view (gs HasType PHASE-PARTITION and there is an r such that r gs and r ∈ R(M)). Additionally, all other types that share the common supertype in that generalization set are also included in the view (there is a gs ∈ GS(M) and a r gs and s(r) = c), and so are all these supertyping relations in that same generalization set (r HasType SUBTYPING and t(r) ∈ C(M) and (there is a gs such that gs ∈ GS(M) and r gs)). Notice that subkind partitions are only included (a posteriori) if all subtyping relations comprising it are already included in the view (e.g., gender in an RC with Car Rental as the focus).

Furthermore, we include in a relational context all subtyping relations involving two types included in that view (r HasType SUBTYPING and s(r) ∈ C(M) and t(r) ∈ C(M)). Finally, we include all supertypes of relators already included in the view (r HasType SUBTYPING and s(r) ∈ C(M) and t(r) HasType RELATOR). This is because a subtype inherits all the properties of its supertypes, and thus to understand the context of a sub-relator we must understand the general notion (e.g., to understand 'foreign marriage' as a 'marriage' recognized abroad, we must understand 'marriage' as a relation binding spouses).

Relator-Centric Clustering

We are now in position to define the notion of a Relator-Centric Clustering:

-RCC Definition: a Relator-Centric Clustering of a model M is a set of views symbolized as RCC(M) = {M 1 ..M n } such that for every M i ∈ RCC(M) there is a type rel such that rel ∈ C(M) and RC(M i , M, rel).

Figure 2 depicts the application of this notion of RCC to the model of Figure 1. Here we represent each Relational Context using UML packages and name these packages with the homonymous focal relator. As one can observe, the original model can be broken down into four contexts, namely: the Car Rental, the Marriage, the Car Ownership, and the Employment contexts. Each of these modules contains a view of the original model with all the information required to understand each of the contexts.

The Car Rental RC shows the roles (and role mixin) directly mediated by the Car Rental relator (Responsible Employee, Rental Car, Customer). The kinds involved are made explicit: Person, Car and Organization (when playing the role of Corporate Customer). Important business rules the model imposes on a Car Rental are revealed: only an Adult (a Living Person) can rent a car, and only a car that is in the Available Car phase can be rented. A similar observation can be made for the Marriage RC, as it reveals that the original model reflects a heteronormative setting and with gender in static classification. Finally, the Car Ownership and the Employment RCs are examples of simpler views, as the path from directly mediated entities to the involved kinds is short.

We implemented this approach for relational context identification and relator-centric clustering in Javascript as a service within ontouml-js 7 , an open source library we have been developing for OntoUML. Currently, this library supports programatically manipulating OntoUML models, automatically verifying their syntax, and automatically transforming them into OWL specifications compatible with gUFO (the reference implementation of the Unified Foundational Ontology in OWL [START_REF] Almeida | gUFO: A lightweight implementation of the Unified Foundational Ontology (UFO)[END_REF]). These services are then made available to final users via the OntoUML plugin8 for Visual Paradigm.

Final Considerations

In this paper, we propose a formal approach for conceptual model clustering by leveraging on the ontologically well-founded semantics of the modeling language OntoUML. In particular, we rely on the theory of relators underlying OntoUML to present a full formal account of the notions of Relational Context and Relator-Centric Clustering. An RCC is a model modular breakdown in terms of a number of adequate RCs. Each RC, in turn, captures all the information needed to understand the maximal scope of objects in the way they participate in certain relationships. The approach is formally characterized (claim to formal precision) and it is based on a well-founded ontological theory of relators (claim to ontological adequacy).

Additionally, we have reported on a fully implemented plug-in tool for a Model-Based OntoUML Editor that automates this approach (claim to practical realizability). Following the formal characterization of this framework, the algorithm implementing it is a deterministic one (i.e., it generate the same RCC for a given model in every execution) and, in the worst possible case, the algorithm would execute a total of (n en r ) * n r operations (where n e is the total number of model elements in the model and n r is the total number of classes stereotyped as relators). So, even in the worst possible case, the algorithm is tractable (claim to computational efficiency and scalability). In practice, n r is on average circa 6% of n e (as observed by analyzing 54 OntoUML models in different domains in the OntoUML repository [START_REF] Sales | Ontological anti-patterns: Empirically uncovered error-prone structures in ontology-driven conceptual models[END_REF][START_REF] Teixeira | An ontology-based process for domain-specific visual language design[END_REF]), and RCs are often largely disjoint with minimal intersections only in the level of kinds. In other words, in practice, the algorithm will often execute approximately n e steps as the different RCs tessellate the original model. Despite these encouraging results, we intend to subject it to a more comprehensive and systematic analysis and series of tests.

In [START_REF] Almeida | Events as entities in ontology-driven conceptual modeling[END_REF], the authors present an approach for representing reified events (occurrences) as first-class citizens in structural conceptual models. In those models, events have their own properties and can form taxonomic and temporal ordering structures. Moreover, objects participate in these events playing a number of 'processual roles' (e.g., the roles of victim and perpetrator in a crime). As an extension of the approach presented here, we intend to characterize contexts and clusters centered around this notion of events.

The notion of Relational Context proposed here bears a resemblance also to the notion of Frames in C.J. Fillmore's Frame Semantics [START_REF] Fillmore | Frame semantics[END_REF]. In fact, we first considered using the term Ontological Frame (or Relational Frame) for this notion. Frames, in that tradition, are patterns that describe situations, events or relationships and in which elements appear playing interconnected and mutually dependent (semantic) roles. However, unlike our approach, frames have the primary goal of providing a background structure for the interpretation of lexical terms. RCs, in contrast, have as primary goal ontological transparency, focusing on connecting the entities playing complementary roles in the scope of bundles of relational properties (relators) to their identity-providing kinds.

Finally, in order to properly evaluate the cognitive effectiveness of these contributions, we are already in the process of designing a series of empirical studies. The core focus concerns speed and recall in obtaining information from the business conceptual model, as well as naturalness to domain experts of the resulting breakdowns.

Fig. 1 .

 1 Fig. 1. A conceptual model in OntoUML in which relators are highlighted.

Figure 1 .

 1 Then, C(M) amounts to exactly the types represented there, while R(M) includes all the mediation and UML subtyping relations. Finally, GS(M) amounts to the generalization sets: gender (a subkind partition comprising the subtyping relations connecting Man to Person, and Woman to Person); developmental status (a phase partition comprising the subtyping relations connecting Child to Person, Teenager to Person, and Adult to Person); Life Status (a phase partition comprising subtyping relations connecting Living Person to Person, and Deceased Person to Person); Operational Status (a phase partition comprising subtyping relations connecting Available Car to Car, and Under Maintenance Car to Car).

4. 2

 2 Direct Subtyping and (Indirect) Subtyping Let the functions ST (C,C ) (symbolizing that C is a direct subtype of C ), ST * (C,C ) (symbolizing that C is a subtype of C ) and IST * (C,C ) (symbolizing that C is an improper subtype of C ) be defined as follows: -ST (C,C ) iff there is an r such that r HasType SUBTYPING and s(r) = C and t(r) = C ; -ST * (C,C ) iff ST (C,C ) or there is a C such that ST (C,C ) and ST * (C ,C ); and, -IST * (C,C ) iff ST * (C,C ) or C = C .

4. 4

 4 Sortal Identity Path We define that a view M is a Sortal Identity Path of M based on a focus type c (symbolized as SIP(M, M , c), where c HasType SORTAL iff: -V (M, M ) and c ∈ C(M) iff (IST * (c, c ) and IST * (c , K(c)) and r ∈ R(M) iff r HasType SUBTYPING and s(r) ∈ C(M) and t(r) ∈ C(M).

4. 5

 5 Non-Sortal Identity Paths We define that the view M is a Non-Sortal Identity Paths of M based on a focus type c (symbolized as NSIP(M, M , c), where c HasType NON-SORTAL iff: -V (M, M ) and c ∈ C(M) iff IST * (c , c) or (there is a c such that IST * (c , c) and IST * (c , c ) and IST * (c , K(c ))) and r ∈ R(M) iff r HasType SUBTYPING and (s(r) ∈ C(M)) and (t(r) ∈ C(M))).

Fig. 2 .

 2 Fig. 2. An RCC for the model of Figure 1 organized as (Onto)UML packages.

There is a long debate in philosophy regarding the ontological neutrality (or lack thereof) of formal languages. We simply mean here that they commit to a simple ontology of formal structures (e.g., that of set theory) in which sorts of types and relations are undifferentiated.

This model consisted of 3,800 classes,

datatypes, 1,918 associations, 3,616 subtyping relations, 698 generalization sets, 865 attributes, i.e., navigable association ends[START_REF] Sales | Ontological anti-patterns: Empirically uncovered error-prone structures in ontology-driven conceptual models[END_REF].

The model of Figure1is used here for illustration purposes only, as it is a much simplified version of a proper model in this domain. For example, in a more realistic model, we would have cases of "relators mediating relators" (e.g., a car rental mediating a car ownership and an employment). The example avoids these for the sake of space limitations. Our formal definition of RCC (see section 4.7), however, has no such a limitation, thus, addressing these cases that result in nested contexts (i.e., contexts including other contexts).

See source code at https://github.com/OntoUML/ontouml-js.

See source code at https://github.com/OntoUML/ontouml-vp-plugin.

Acknowledgments

We are grateful to Ricardo A. Falbo (in memoriam) for the spark that led to this investigation. This research is partially funded by the NeXON Project (UNIBZ). J.P. Almeida is funded by CAPES (grant number 23038.028816/2016-41) and CNPq (grants numbers 312123/2017-5 and 407235/2017-5).