Enabling flexibility of business processes by compliance rules - a case study from the insurance industry