Back Office / Source date:

Process Mining Arrives: Seeing What Actually Happens

Event-log analysis replaced workshop guesswork by revealing the real paths transactions take.

Illustration of analysts arranging transaction event cards into a main sequence and a returning branch on a worktable.

Ask a finance director how their invoice approval process works and you will get a confident answer with a diagram attached. Invoice received, matched to purchase order, routed to budget holder, approved, scheduled for payment. Five steps, four days, one exception path. Run the same question through the event logs in the ERP and you get something else entirely. Two hundred and forty distinct process variants. A median of eleven steps. Nineteen percent of invoices looping back to an earlier stage at least once. A cluster of transactions that skip the matching step altogether because a configuration exception was added in 2011 and never reviewed. And a long tail of cases taking forty days, almost all of them routed through one approver who is frequently travelling. Process mining — reconstructing how a process actually ran from the timestamps and identifiers that transactional systems record anyway — reached commercial maturity around this point, and its first contribution to most organizations was uncomfortable. It showed people that their documented process was a description of intent, not behaviour.

Why the Documented Process Is Always Wrong

This is not because people are careless. It is structural. Process documentation is produced at a moment in time, usually during an implementation, by a small group describing what should happen. From that day forward, reality diverges. Exceptions are granted and become habits. Workarounds emerge when the system blocks something legitimate. Staff turnover carries away the reasoning and leaves the behaviour. Business changes — new entities, new product lines, new regulations — create paths nobody documented. Local variants appear because one office does it differently and always has. Interview-based process mapping inherits all of this. You are asking people to describe their own behaviour, and people describe the normal case, omit the exceptions they handle automatically, and reconstruct a tidier version than the one they perform. This is not dishonesty; it is how memory works. Event log analysis has no such filter. It reports what the system recorded: which steps occurred, in what order, how long each took, who performed them, and how many times each path was taken. The gap between that and the documentation is where the cost lives.

What It Actually Finds

Rework loops. Transactions that return to a previous step — rejected, corrected, resubmitted. Rework is invisible in aggregate cycle time and expensive in effort, and it usually concentrates in a small number of causes: a specific supplier, a specific field, a specific approver's standards. Bottlenecks that are people, not steps. Waiting time frequently dominates processing time, and the wait usually attaches to individuals rather than stages. A single overloaded approver can add a week to the average, and no amount of step-level optimisation will find them. Variant explosion. A process the business believes has three paths has two hundred. Most variants handle a handful of cases each. Each one carries training cost, error risk and control ambiguity, and most exist for reasons nobody can now articulate. Control violations at scale. Purchase orders raised after the invoice arrived. Approvals given by someone outside the delegation of authority. Payments made without a matched receipt. Segregation of duties breached by a specific role combination. Auditors sample; process mining examines the entire population, which changes both the finding and the confidence in it. Automation targets with evidence. Which steps are high-volume, rule-based and consistent — and therefore worth automating — rather than which ones somebody believes are painful. And the gap between best and typical performance. When ten percent of cases complete in two days and the median is nine, the achievable target is not a benchmark from a consultancy; it is your own good cases, and the question is what those cases have in common.

The Honest Limitations

Process mining is genuinely useful and it is routinely oversold, so it is worth being clear about what it does not do. It only sees what the system records. Work that happens in email, in spreadsheets, in phone calls and in conversations is invisible. In many back office processes, a substantial share of the real effort lives exactly there, and the mined process looks efficient because the messy part is off-system. This is the single largest source of misleading conclusions. Data quality determines the output. Missing timestamps, ambiguous case identifiers, system-generated batch events that look like user actions, and bulk updates that compress a week of work into one timestamp all distort the picture. Preparing the event log honestly is most of the work. It describes, it does not explain. Knowing that nineteen percent of invoices loop is not the same as knowing why. The diagnosis still requires talking to the people doing the work — process mining tells you which conversation to have, which is valuable, but it does not replace it. Variant count is not automatically a problem. Some variation is legitimate response to genuinely different circumstances. Standardising every path is a real risk of these programmes: it produces a process that handles the common case elegantly and the unusual case not at all. And it can be used badly. Event logs identify individuals. A tool that shows who is slow, who reworks most and who deviates from the standard path can be turned into surveillance very easily, at which point people change their system behaviour to look good rather than to work well, and the data stops being reliable. How this is introduced determines whether it stays useful.

What an event log can and cannot tell youQualitative limitations condensed from the article. The illustration and table are not a mined customer process or measured audit finding.
What the log showsWhat still needs checking
Recorded system eventsOff-system email, spreadsheet and conversation work may be missing.
Sequences and timestampsCase identifiers, timestamp meaning and batch updates may distort the picture.
Where cases wait or returnPeople doing the work still need to explain why.
Different process pathsSome variation is legitimate and should not be standardised away.
Actions associated with individualsPrivacy, access and worker-monitoring safeguards need agreement.

Qualitative summary of this article's source text, not a measured outcome or performance estimate.

Practical Guidance for a Process Mining Pilot

  • Start with one high-volume process with clean system data. Purchase to pay or order to cash usually have the most complete event logs.
  • Invest properly in event log preparation. Case identifiers, timestamps and activity definitions decide whether the analysis means anything.
  • Check what happens off-system before drawing conclusions. If the email and spreadsheet work is invisible, the mined process is a partial picture.
  • Use findings to direct interviews, not to replace them. The data shows where; people explain why.
  • Prioritise rework and waiting time over step duration. These usually dominate cycle time and are the easiest to fix.
  • Run conformance checking on control requirements across the full population. This is the highest-value audit application and it is chronically under-used.
  • Agree explicitly that this is not performance monitoring of individuals. Say it, mean it, and restrict access accordingly — otherwise behaviour adapts and data quality degrades.
  • Re-run the analysis after changes. The point is continuous visibility, not a one-off report that becomes as stale as the documentation it replaced.

The Regional Angle

Process mining in Gulf operations surfaces a distinctive set of findings, and a few distinctive complications. Multi-entity processes fragment in ways nobody sees. A group operating through mainland, free zone and Saudi entities typically runs what it believes is one purchase-to-pay process and is in fact running six, with different approval thresholds, different tax handling and different exception patterns. Mining across entities makes the divergence visible and usually shows that much of it is accidental rather than required by local regulation. Approval hierarchies are longer and more concentrated. Regional organizational structures frequently route more decisions upward, and mining tends to find a small number of senior approvers sitting on a large share of total waiting time. The fix is delegation redesign, not process automation, and the data makes that case in a way that opinion cannot. Government-portal steps introduce external waiting time. Processes involving e-invoicing clearance, wage protection submission, visa and labour processing, customs clearance or municipality approvals include waits that the organization does not control. Separating internal from external delay is essential; otherwise improvement targets are set against time that cannot be compressed. PRO-mediated steps are usually invisible. Government relations work — document collection, submission, follow-up, collection of results — happens largely off-system, and any HR or onboarding process mined without it will look dramatically faster than employees experience it. Instrumenting these handoffs is a prerequisite for meaningful analysis. Bilingual and transliteration inconsistency corrupts case identity. When a supplier or customer appears under several spellings, mining tools may treat one case as several or fail to link related events. Master data quality is not a separate initiative here; it determines whether the mining is valid. Calendar variation distorts duration measurement. Weekend days differ across countries in the region and have changed in recent years, and Ramadan working hours alter throughput for a month. Elapsed-time measurement without a proper working-calendar dimension produces misleading comparisons between entities and across periods. And documentation debt is typically larger. High workforce mobility means the person who designed the process left two employers ago. Mining is disproportionately valuable in this environment precisely because there is nobody left to ask, and the system log is the only reliable institutional memory.

Where It Went

The category grew substantially after 2014 and broadened in two directions. Task mining added capture of desktop activity, which addressed part of the off-system blind spot by recording what people actually do in spreadsheets and email clients — with obvious and unresolved privacy implications. And process mining converted from a diagnostic project into a monitoring capability, running continuously against live data rather than producing a study. It also became the standard front end for automation programmes. The early wave of robotic process automation failed frequently because organizations automated the process they believed they had; mining made it possible to automate the one they actually had, and to identify which variants were worth automating at all. The current chapter involves AI in two roles. As an analysis layer, it lowers the skill barrier — asking why invoices from one supplier group take three times as long, in plain language, rather than constructing the query. That is a genuine democratisation of a technique that previously required a specialist. As a subject of analysis, it is more interesting. Organizations are inserting AI into operational processes — document extraction, coding suggestions, automated approvals, first-line query handling — and mining is one of the few techniques capable of showing what those interventions actually do to the end-to-end process. Early results frequently show a familiar pattern: an automated step is faster, and downstream rework increases enough to erase the gain. The organizations measuring the full process see it. The ones measuring the automated step report a success. Which is precisely the lesson from 2014, arriving again. The documented process — now the intended AI workflow — is not the real one, and the only way to know the difference is to look at what the system recorded.

Common Questions

What is process mining?

A technique that reconstructs how a business process actually ran by analysing the event logs transactional systems already produce — case identifiers, activity records and timestamps — showing real sequences, durations, variants and deviations rather than a documented intent.

Why does it disagree with our process documentation?

Because documentation records what was designed, and reality diverges immediately through exceptions, workarounds, staff turnover, business change and local variation. Interview-based mapping inherits the same problem, since people describe the normal case and omit exceptions they handle automatically.

What is its biggest limitation?

It only sees what the system records. Work performed in email, spreadsheets and conversations is invisible, so processes with substantial off-system effort look far more efficient in the analysis than they are in practice.

What does it find in GCC operations specifically?

Unintended divergence between entities in multi-jurisdiction groups, waiting time concentrated in a few senior approvers, external delay from government portals that cannot be compressed, invisible PRO-mediated steps, case-identity errors caused by inconsistent transliteration, and duration distortion from differing weekends and Ramadan hours.


Process Mining Pilot — Outpace reconstructs your real process from your own event logs, then shows you where the time and the risk actually sit.

Continue reading

Talk to OPS

Start with the operating problem.