Trace selection and allocation for log-move audit of business process directly-follows graphs

Abstract

The auditing of business process execution may involve investigating selected process instances (traces) to identify the root causes of discrepancies. Discrepancies are unexpected business process behavior. Such discrepancies might reveal fraud, inefficiencies, or a model that does not reflect the process execution. One such discrepancy is consecutive activities in the event log that the business process model does not predict, called log-moves. In this work, we investigate strategies to select the minimum cost set of traces from the event log such that each log-move appears in at least one selected trace. A trace cost is any measure of effort required to audit it, such as the estimated required time. We also investigate how to distribute the selected traces among the auditors in order to balance the total costs allocated to them. We provide a mixed integer programming (MIP) formulation and a greedy algorithm for this problem, and empirically evaluate these solution approaches using two real-world datasets. The CPLEX solver finds the optimal solution of the MIP formulation for all instances in less than 75 min but presents exponential growth of execution time as we increase the number of auditors. On the other hand, the greedy heuristic has simple implementation, does not require an external solver, has polynomial time, and typically loses less than 15% of the solution quality for our datasets. The log-moves are obtained from the Directly-Follows Graph (DFG) of the business process model and event log; therefore, the model may be represented by any notation that allows the DFG extraction. For the particular case of business processes modeled as Process Trees, we provide an efficient algorithm for the DFG extraction. We also make no assumptions on how the business process model was built, either manually or by a process mining algorithm.