A Knowledge-Driven Approach to Interpretable Compliance Deviation Analysis in Business Processes

A Knowledge-Driven Approach to Interpretable Compliance Deviation Analysis in Business Processes | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Knowledge-Driven Approach to Interpretable Compliance Deviation Analysis in Business Processes Changhong Zhou, Jipeng Song, Yanqing Song This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8295347/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 9 You are reading this latest preprint version Abstract Event logs of enterprise information systems capture rich knowledge regarding business process execution, yet extracting interpretable business semantics for compliance monitoring remains challenging. This study proposes a four-layer deviation analysis framework based on process mining. At its core lies a formalized knowledge base, which incorporates designed deviation mapping rules and classification algorithms to systematically transform abstract technical semantics into three explicit categories of business deviations—missing, out-of-order, and redundant—thereby generating deviation semantics that can be intuitively understood by business personnel. The knowledge-driven framework has been implemented as a plug-in for the ProM platform. Experiments on both synthetic and real-life logs, along with expert evaluations, demonstrate that the proposed method exhibits strong generalization capability and effective deviation detection performance in complex scenarios, significantly improving diagnostic efficiency. Furthermore, by establishing a correlation mapping between deviations and fraud risks, the study closes the audit loop from deviation identification to risk localization. This offers a knowledge-driven practical solution for compliance control and risk prevention in enterprise process management based on information systems. Information systems Knowledge-Driven Process mining Business processes Deviation detection Risk assessment Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 1 Introduction Currently, the operations of modern enterprises increasingly rely on complex information systems such as ERP and SCM[1]. These systems serve not only as the core pillars for executing business processes but also function as critical repositories of both implicit and explicit business knowledge. The massive volumes of event logs they generate contain rich operational knowledge, including compliance rules, process specifications, activity dependencies, and operational patterns[2]. Such knowledge-intensive log data lay the groundwork for data-driven business process compliance monitoring, anomaly detection, and operational optimization[3]. However, this also presents a fundamental challenge: how to effectively extract actionable knowledge from unstructured log data and bridge the semantic gap between technically detected deviations and business-interpretable explanations[4]. However, against the backdrop of digital transformation, the trend of cross-system integration in information systems and the increased complexity of business processes have rendered traditional compliance monitoring methods inadequate for covering end-to-end process segments[5]. This creates a risk that compliance issues in the execution of critical processes may be overlooked [6]. For instance, does the accuracy of financial transaction records truly reflect the underlying business operations? Can internal control measures effectively prevent errors or fraud? Confronted with complex, dynamic, and large-scale business data, there is a pressing need for more intelligent methods to automatically discern deviations between process execution and expected norms, and to provide precise business-semantic interpretations of such deviations. This is essential to ensure the compliance and effectiveness of business processes[7]. Furthermore, deviations arising during business process execution have become a key factor affecting organizational operational efficiency and compliance. Their effective identification and in-depth analysis constitute a core aspect of internal control work [8]. As digital transformation advances, corporate compliance requirements have also evolved beyond merely "verifying compliance" to further demand the ability to "explain causal chains" and "emphasize real-time monitoring and process optimization." This shift places higher demands on the intelligence and granularity of compliance monitoring. In this context, the emergence of efficient data analysis technologies, such as process mining, has become a vital tool for unlocking the knowledge value embedded within information system logs, offering new possibilities to address various challenges in enterprise information system compliance monitoring [4,9]. Leveraging its strengths in data analysis, process mining technology can perform "knowledge extraction" from event logs. This includes automatically extracting process models, deriving compliance norms, and utilizing conformance checking techniques to identify deviations between actual execution and predefined specifications [10,11]. These capabilities provide significant theoretical guidance for supporting anomaly diagnosis, business process optimization, and enabling comprehensive dynamic monitoring. However, although existing advanced conformance checking algorithms (such as the mainstream DPN-based alignment algorithm [12]) can quantify inconsistencies between logs and models, their outputs consist of large volumes of abstract technical data (e.g., move types). These results are difficult to directly map to specific deviation patterns at the business level (such as missing activities, incorrect ordering, etc.). This disconnect between technical semantics and business interpretation means there is no effective mechanism to transform such data into actionable "knowledge" thereby creating a critical "knowledge gap" in deviation identification. As a result, when enterprises attempt to identify massive process deviations, it becomes challenging to quickly pinpoint the root cause of issues. Additional human resources are required to interpret alignment results in order to discover corresponding anomalous deviations. This severely limits the automation and scalability of deviation detection, consequently impairing the efficiency and effectiveness of process optimization. To address the above issues, this paper proposes a four-layer deviation analysis framework based on process mining alignment techniques. The framework aims to systematically identify the most prevalent and common types of business process deviations—missing activities, out-of-order activities, and duplicate activities—by interpreting the abstract technical semantic knowledge derived from alignment algorithm results [8]. Specifically, this study extracts the characteristic knowledge of move types from alignment results and constructs mapping rules that translate these move types into specific deviation categories. A rule-driven deviation classification algorithm is then designed to convert alignment outputs into business-interpretable deviation semantics. To better apply this approach in practical business process management, a deviation analysis plugin integrated into the ProM platform [13] has been developed. This plugin supports the visualization and interactive exploration of deviation detection results, enabling auditors to quickly locate process anomalies. It provides compliance officers and related managers with an intuitive and efficient tool for deviation analysis, assisting them in investigating the root causes of deviations and offering end-to-end decision support for enterprises. Furthermore, based on the distribution characteristics of deviations in real-world scenarios, a correlation mapping between process deviations and fraud risks has been established, achieving an audit closed loop from deviation identification to risk localization. The core theoretical contribution of this work lies in constructing a formalized knowledge model—a rule base—for interpreting process compliance deviations. This model systematically transforms technical semantics into business knowledge, effectively bridging the previously mentioned "knowledge gap." It provides both theoretical foundation and practical solutions for business process compliance control and risk prevention. The structure of the subsequent chapters is as follows: Chapter 2 reviews related work; Chapter 3 elaborates on the methodology and framework design; Chapter 4 validates the method and demonstrates its application through experiments on synthetic logs and real-world cases; Chapter 5 concludes the study and outlines directions for future research. 2 Related work 2.1 Process mining Process mining is a novel interdisciplinary research field lying at the intersection of computational intelligence, data mining, as well as process modeling and analysis [14]. Its research scope mainly encompasses three aspects: process discovery, conformance checking, and process enhancement [15]. Process discovery technology constructs process models by extracting information recorded in event logs [16], while process enhancement improves or extends existing process models based on information derived from logs [15]. As one of the primary application areas, conformance checking quantifies deviations between event logs and process models. It reflects the degree to which actual behaviors recorded in event logs align with expected behaviors specified in the process model, thereby identifying potential anomalies in the process[17,18]. Meanwhile, process anomaly detection based on deviation measurement is a widely used and effective method in process mining. Its core lies in calculating deviation metrics between a given dataset and predefined or standard patterns to determine whether a system or process is in an abnormal state. This method holds significant application value across multiple domains, such as abnormal condition identification in industrial production lines and fraud detection in financial transactions[4]. In practical applications, it is necessary to formulate corresponding judgment criteria based on specific scenarios and domain knowledge, while integrating other anomaly detection methods to improve detection accuracy. 2.2 Overview of Deviation Classification The standardization of business process deviation classification serves as a key link connecting technical detection results and business interpretations. Existing classification systems in academic research can be categorized into two types: theoretically driven (model structure-based) and domain-driven (application scenario-based)[19]. The theoretically driven classification focuses on technical detectability. For example, Adriansyah et al. [20] proposed six categories of control-flow deviations (e.g., skipping, insertion, and replacement), while García-Bañuelos et al. [21] addressed task-level anomalies based on natural language descriptions. Although highly systematic, such methods often lack support from business semantics and struggle to align with the cognitive needs of practical domains like auditing. In contrast, the domain-driven classification places greater emphasis on integrating industry-specific cognitive frameworks. Hosseinpour and Jans [8] innovatively integrated the theoretical framework of control-flow deviations with empirical research methods, conducting a systematic investigation into the classification behaviors of experienced auditors regarding 62 types of deviations. They thus concluded that auditors and compliance professionals identify deviations primarily based on three core dimensions: Missing activity, Wrong order, and Repeat activity. Therefore, this study adopts this three-dimensional classification system as the framework for subsequent analysis. 2.3 Abnormal deviation detection In the execution of business processes, anomaly detection aims to identify deviant executions by distinguishing non-conforming behavior from normative behavior. As a critical component of process mining, conformance checking techniques employ specific metrics to quantify the alignment degree between observed behavior in event logs and expected or normative behavior specified in process models[22]. By contrasting modeled behavior with observed behavior, these techniques detect, pinpoint, and explain deviations [23,24]. This dual-capability framework serves both to identify non-compliant executions with diagnostic insights and to evaluate process model quality [25]. Consequently, research on conformance checking constitutes a primary focus for detecting deviations between process models and event logs. Early conformance checking research predominantly employed model-driven approaches to enhance process model expressiveness for anomaly detection. For instance, Rozinat et al[26]. introduced token-based replay, which simulates token flow through process models to identify activities in event logs not covered by the model. While this technique diagnoses deviation locations via missing/remaining token counts—enabling continuation through token insertion—it risks falsely enabling subsequently unexecutable activities, thereby generating misleading diagnostics. Subsequently, Weijters et al.[27] designed Heuristics Nets, incorporating activity frequency and contextual relationships to detect deviations. Although this method improved detection efficacy to some extent, it exhibited high false-positive rates when handling concurrent behaviors. To address deviation detection in concurrent processes, Leemans et al.[28] developed the Inductive Miner algorithm. This approach directly generates process trees with priority structures from event logs and identifies anomalous activities through structural comparisons (e.g., missing subtrees). However, the method demonstrates sensitivity to noisy logs and lacks precision in localizing anomalous behavior. Later, Swinnen et al.[29] applied fuzzy mining techniques to discover models from logs, comparing them against predefined models to identify deviations and quantify divergence levels. Agrawal [30]and Jans et al.[31]adopted similar association rule mining methods to analyze high-frequency behavioral deviations, both relying on manual comparison to assess divergence from original models—an approach incurring substantial labor and time costs. These methods typically enhance existing process models via discovery techniques, evaluating deviation severity through comparison with reference models. Nevertheless, practitioners can only broadly identify anomalous activities within models, failing to map these deviations precisely to individual case trajectories for granular analysis. Crucially, deviation identification remains heavily dependent on manual post-hoc comparison and judgment. This limitation not only reduces practical efficiency but also constrains scalability, indicating significant room for methodological advancement. Addressing this challenge, van der Aalst and Adriansyah[32] initially proposed a conformance deviation detection technique based on alignments, which subsequently evolved into the de facto standard for conformance checking. This method was further applied in Literature [33]. Its core principle involves comparing an individual process execution trace against paths in the model to identify an optimal match, thereby determining whether observed activities deviate from model-defined behavior. This approach provides detailed output at the process instance level.Subsequently, numerous researchers have conducted in-depth studies focusing on two primary directions: optimizing alignment algorithms[34,35,36] and applying them to diverse practical domains [37,38]. Representative work by Van der Aalst et al. [12] introduced the DPN alignment algorithm, which utilizes dynamic programming to optimize the matching path between an event trace and the model. It quantifies the conformance relationship through synchronous moves, model moves, and log moves. However, a significant limitation persists: The output of such alignment algorithms typically remains at the abstract level of move types (e.g., model move, log move), lacking systematic classification and interpretation of the underlying deviation behaviors. Manual interpretation of the deviation semantics is still required. This limitation significantly undermines the practical value of process mining in real-world business scenarios. This study aims to analyze the distribution characteristics of movement types in the alignment results of this algorithm, establish mapping rules from movement types to specific deviation types, and design a rule-driven deviation classification algorithm. Thereby, it converts alignment results into business-interpretable deviation semantics, provides business analysts with a more intuitive and efficient process deviation analysis tool, and offers decision support for enterprises. 3 Methodology 3.1 Methodology and Framework Design This study proposes a four-layer deviation analysis framework based on process mining technology (Figure 1). The first phase of the framework adopts the well-established DPN alignment algorithm [12]. The core idea of this algorithm is to align and match event logs recorded by information systems with the Petri net model of standard business processes. Through this operation, we can obtain the matching relationship between the process model and specific case traces, and identify the movement type of each activity (e.g., synchronous moves, log-only moves, or model-only moves). These movement types clearly reveal deviations between actual execution and expected standards. Ultimately, the analysis results of this phase serve as the input for the entire framework (Figure 2). The second and third phases constitute the core framework stages, establishing a formalized deviation knowledge base. This includes mapping rules from movement types to deviation types, upon which a rule-driven classification algorithm is constructed. This algorithm transforms alignment results into deviation categories with business semantics, covering three core deviation types commonly encountered in business process practices: Missing , Wrong order , Repeated [8]—which are used to identify unexecuted activities, abnormal sequencing, and redundant executions, respectively. Building on this, a deviation analysis plugin is developed on the ProM platform to realize deviation annotation, trace reconstruction, and visualization. This assists users in understanding the context of deviations, improves analysis efficiency, and supports process optimization. The final phase focuses on the associative analysis between deviations and risks, aiming to establish a mapping relationship between identified business deviations and potential fraud risks. By integrating information such as the type characteristics, occurrence scenarios, and business impacts of deviations, combined with risk knowledge in the auditing field, the corresponding relationship between deviations and risk points is initially constructed. This provides a foundation for subsequent risk quantitative assessment and disposal, thereby realizing an analytical closed-loop from process deviation identification to risk early warning. It helps compliance personnel and auditors accurately locate high-risk links and enhance the risk prevention and control effectiveness of information systems. 3.2 Deviation Identification and Interpretation The core work of this study focuses on the interpretation and analysis of deviations. To address this task, identification and interpretation algorithms are designed respectively and integrated into the "DPN Deviation Analysis" plugin of the ProM platform, supporting visual analysis. This plugin takes alignment results in xes format as input and outputs multi-dimensional deviation reports. The key attributes in the alignment results, which form the basis for the logical judgment of deviations, are first explained as follows: The "alignment:movetype" attribute identifies the movement type, with values including: ·alignment:movetype = 0 (Synchronous move): The activity exists and matches both in the log and the model; ·alignment:movetype = 1 (Log-only move): The activity only appears in the log, potentially representing a behavior that actually occurred but is not allowed by the model; ·alignment:movetype = 2 (Model-only move): The activity only appears in the model, potentially representing a behavior expected by the model but not actually executed. These movement types serve as crucial bases for identifying deviations such as missing activities, redundant activities, and incorrect sequencing. 3.2.1 The Knowledge Base: Formal Definitions of Deviation Patterns This section formally defines and identifies three types of core deviations based on the four-layer deviation analysis framework (Figure 1). The constructed knowledge base primarily consists of the following three core inference rules, which systematically map patterns in alignment sequences to business deviations. Let L denote the event log, M denote the Petri net model, and σ = denote the optimal alignment sequence between L and M , where m i represents the i-th activity in the alignment result. Specifically, m i .activity denotes the name of the i-th activity in the optimal alignment sequence; m i .type denotes the movement type of the i-th activity (synchronous move, log-only move, or model-only move); m i .position denotes the position of the i-th activity in the case trace; and m i .caseId denotes the case ID of the i-th activity. The formal definitions and identification processes for the three types of deviations are as follows: (1) Identification of "Missing Activity" Deviations The missing activity refers to an activity that should be executed but is not actually performed (Figure 3). In other words, such activities exist in the process model but are not implemented in the actual case trace. In Figure 3, when an activity (e.g., t3 in the example) is present in the model trace but does not appear in the log trace, the alignment result will display a purple "model-only move" activity at the corresponding position in the log trace. This activity represents a "missing activity"—i.e., an activity defined in the model but not recorded in the actual execution of the log. Therefore, the formal definition of the "missing activity" deviation is as follows: • Definition 1: "Missing Activity" Deviation (Missing) For any activity mi σ , it is termed a "missing activity" deviation if the following conditions are satisfied: m i .type = 2 m i .activity = {τ} (where τ denotes an invisible activity) This is referred to as the “Missing activity” deviation. Based on this logic, this study has designed a deviation identification algorithm for "missing activities" (with the pseudocode provided below). In the process of identifying "missing activity" deviations, it is necessary to perform special processing or filtering on τ activities (tau activities). τ activities represent invisible events in the model (e.g., control nodes in parallel, selection, or loop structures), rather than actual business activities that occur in practice, and thus do not appear in real case traces. If they are mistakenly judged as "missing", the analysis results will deviate from the actual business execution situation. Filtering τ activities helps improve the accuracy and interpretability of deviation analysis, allowing the analysis to focus on real business operation deviations.The pseudocode is as follows: Algorithm1: Identify Missing Activity Deviations Input: Alignment between event log and process model Output: Set of missing activity deviations 1 Function IdentifyMissingActivities(alignment): 2 missingDeviations = empty list 3 for each move in alignment: 4 if move.type == MODEL_MOVE and move.activity != "tau": 5 deviation = new Deviation() 6 deviation.type = "MISSING" 7 deviation.activityName = move.activity 8 deviation.position = move.position 9 deviation.caseId = move.caseId 10 missingDeviations.add(deviation) 11 return missingDeviations (2) Identification of "Wrong Order" Deviations The identification of "wrong order" deviations is a critical component in control-flow analysis. It is designed to detect cases where the actual execution order of case traces in the log is inconsistent with the sequence specified by the process model. The identification of wrong order primarily relies on the Log Move type in the alignment results. A Log Move (alignment_moveType=1) is generated when an activity exists in the log but cannot be matched with the current position in the model, which typically indicates that the execution of this activity at the current position is inconsistent with the model's specifications. Therefore, the formal definition of the "wrong order" deviation is as follows: • Definition 2: "Wrong Order" Deviation For any activity m i σ , it is termed a "wrong order" deviation if the following conditions are satisfied: m i .type = 1 (Log Move); 2. j i, such that m j .activity m i .activity ; ，such that m j .activity m j .activity m i .activity Then it is called the "Wrong Order" Deviation. When the algorithm detects that an activity’s movement type is Log Move, the activity appears for the first time in the current case trace, and the activity will not appear in the form of a Synchronous move thereafter, the algorithm will compare its position in the case trace with the corresponding position in the predefined model trace. If the positions are inconsistent, the algorithm determines that the activity has a wrong order deviation (Figure 4). The pseudocode is as follows: Algorithm 2: Identify Wrong Order Deviations Input: Alignment between event log and process model Output: Set of wrong order deviations 1 Function IdentifyWrongOrderDeviations(alignment): 2 wrongOrderDeviations = empty list 3 observedActivities = empty set 4 for each move in alignment: 5 if move.type == LOG_MOVE: 6 activity = move.activity 7 if existsInFutureModelMoves(activity, alignment, move.position) 8 and activity not in observedActivities: 9 deviation=new Deviation("WRONG_ORDER", activity, move.position, 10 move.caseId) 11 wrongOrderDeviations.add(deviation) 12 if move.hasLogActivity(): 13 observedActivities.add(move.activity) 14 return wrongOrderDeviations 15 Function existsInFutureModelMoves(activity, alignment, currentPosition): 16 for i = currentPosition to alignment.length - 1: 17 if alignment[i].hasModelActivity() and alignment[i].activity == activity: 18 return true 19 return false (3) Identification of "Repeated Activity" Deviations "Repeated Activity" deviation (Repeat) refers to an activity that occurs more times in actual execution than specified by the process model. In algorithm design, a multi-level, comprehensive judgment strategy is adopted to identify "Repeated Activity" deviations. First, the formal definition of the "Repeated Activity" deviation is given as follows: • Definition 3: "Repeated Activity" Deviation (Repeated) For any activity , it is termed a "Repeated Activity" deviation if the following conditions are satisfied: m i .type = 1 (Log Move); ，such that When the movement type of an activity in the event log is determined to be a Log Move (movetype=1), the algorithm triggers a two-way verification mechanism combining forward tracking and backward tracing to implement the identification process of repeated activity deviations. First, the system retrieves historical case traces to verify whether the activity exists in previous execution instances in the form of synchronous moves. If confirmed, the activity is marked as a "Repeated Activity" deviation (Figure 5); otherwise, it is classified as a potential "Wrong Order" deviation, and the corresponding "Wrong Order" identification and verification mechanism is triggered for in-depth analysis. Second, when the system retrieves historical case traces and finds that the activity exists in subsequent execution instances and appears in the form of synchronous moves, it is also identified as a "Repeated Activity" deviation (Figure 6). This two-way verification identification mechanism improves the accuracy of identifying Repeated Activity deviations. It fully accounts for the complexity of loop structures in process models, avoids false positives, and enhances the overall accuracy of deviation analysis. In summary, the identification of Repeated Activity deviations is a critical component in process deviation analysis, requiring a balance between accuracy and sensitivity. For detecting repeated activities within Log Moves, potential "Repeated Activity" deviations are quickly located by prioritizing checks on the historical occurrence count of the activity and locking in repeated execution instances that fail to match the model’s expectations. The pseudocode is as follows: Algorithm 4: Identify Repeated Activity Deviation Input: Aligned trace (alignedTrace) Output: List of repeat deviations (repeatDeviations) 1 Function DetectRepeatDeviations(alignedTrace): 2 Initialize activityCounts = {} 3 Initialize repeatDeviations = [] 4 For each event in alignedTrace: 5 moveType = GetMoveType(event) 6 activityName = GetActivityName(event) 7 If moveType == 0: // Synchronous move 8 If activityCounts[activityName] > 0: 9 AddDeviation(repeatDeviations, activityName) 10 activityCounts[activityName]++ 11 Else if moveType == 1: // Log move 12 If activityCounts[activityName] > 0 OR HasFutureSyncMove(event, activityName): 13 AddDeviation(repeatDeviations, activityName) 14 activityCounts[activityName]++ 15 Return repeatDeviations 16 Function HasFutureSyncMove(event, activityName): 17 currentIndex = GetEventIndex(event) 18 For i = currentIndex+1 to traceLength-1: 19 futureEvent = GetEvent(i) 20 If GetMoveType(futureEvent) == 0 AND GetActivityName(futureEvent) == 21 activityName: 22 Return true 23 Return false 24 Function AddDeviation(repeatDeviations, activityName): 25 deviation = CreateDeviation(activityName, "Activity was repeated") 26 repeatDeviations.Add(deviation) 4 Experimental Design As a core component of process conformance checking, the effectiveness of the deviation identification and interpretation technology proposed in this study needs to be systematically verified through experiments in terms of accuracy, efficiency, and interpretability. This chapter aims to validate the quantitative algorithm performance of the system as well as its innovative value at both theoretical and practical dimensions through multi-dimensional evaluations on synthetic logs and real-world business data. The experiments are based on a public dataset from the BPI Challenge 2019, and synthetic datasets were constructed based on the content of this dataset. The case describes an enterprise’s Purchase-to-Pay (P2P) process, with data sourced from the information system of a Dutch coatings and paint company. The company focuses on the partial purchase order processing procedures of 60 of its subsidiaries, covering multiple stages including procurement management, goods receipt, and invoice processing. 4.1 Data Preprocessing To ensure the accuracy of the analysis, the experiment identifies and confirms the start and end marker events for each case. It takes "Create Purchase Order Item" as the case starting point and "Clear Invoice" as the endpoint, ensuring each case includes both start and end events—incomplete cases are excluded. Additionally, external process activities (e.g., "SRM:Create") whose operational logic and workflows are often independent of the enterprise’s internal processes are excluded, with 7 core activity nodes retained ultimately. Given that the dataset is concentrated after 2017, the analysis period is limited to December 1, 2017, to February 1, 2019, to enhance timeliness and data representativeness. In the description of BPIC-2019, the event log is divided into four independent yet interrelated data flows (DF1-DF4). Among these, this study selects the data and processes of the more complete and rigorous three-way matching mode (DF1) as the experimental data (Table 1). Table 1 DF1 Data Stream Information Dataset attributes Value Case 9,102 Event 119,436 Activity 7 Case duration (median) 79.5d Case duration (average) 86.7d Variant 1272 Begin time 2018.2.1 End time 2019.1.17 Table 2 Abbreviations for core activities Activity Abbreviation Record Goods Receipt GR Record Service Entry Sheet SES Record Invoice Receipt IR Clear Invoice CI Vendor creates invoice VI Create Purchase Order Item Create PO Remove Payment Block RPB 4.2 Synthetic Data Experiments To systematically evaluate the accuracy of the deviation classification algorithm in identifying three core deviations—missing activities, out-of-order activities, and duplicate activities—this study constructed a controlled experimental environment based on the BPIC-2019 Purchase-to-Payment (P2P) process log. By selecting seven core activity nodes from the log (as shown in Table 2), a reference Petri net model was generated using the Inductive Miner algorithm (noise threshold = 0.2) in the ProM platform (illustrated in Figure 7). Preset deviations were then injected to construct synthetic logs. This design retains the characteristics of real business processes while ensuring the quantifiable verification of deviation identification.. 4.2.1 Deviation Injection Based on the structural characteristics of the process model, the experiment designs four types of systematic deviation injection strategies: To verify the algorithm’s effectiveness, this study systematically constructs four typical process deviations: ·Missing activities simulate compliance loopholes by removing key control nodes (e.g., mandatory activities such as Goods Receipt (GR), Invoice Receipt (IR), and Clear Invoice (CI)), testing the algorithm’s ability to identify critical omissions; ·Wrong order disrupts activity timing sequences (especially violating strict sequential dependencies) to evaluate the detection effect of process logic violations; ·Repeated activities involve inserting redundant activities into non-cyclic paths (e.g., multiple GR operations in a single case) while retaining legitimate cycles, distinguishing between normal and abnormal repetitions; ·Mixed deviations superimpose the above multiple anomaly types to construct complex defect scenarios, aiming to test the algorithm’s comprehensive detection performance in addressing real-world complex process issues. Each type of deviation is designed for specific process anomaly patterns, collectively forming a complete algorithm verification framework. The experiment generates 500 cases in total, including 100 cases of missing activities, 100 cases of wrong order, 100 cases of repeated activities, 100 cases of mixed deviations, and 100 compliant cases. This hierarchical injection mechanism covers detection needs from basic anomalies to complex scenarios, providing a sufficient foundation for algorithm robustness evaluation. 4.2.2 Experimental Verification and Visualization Result Analysis For the verification of synthetic experiments, the "DPN Deviation Analysis" plugin is developed based on Java. It takes alignment results (in XES format) as input and outputs multi-dimensional deviation analysis reports. Experimental results are evaluated through deviation indicators on the visual analysis interface. The experimental results show that the plugin can accurately identify most deviation types and their distribution frequencies. As shown in Figure 8, the visualization interface clearly displays the statistical distribution of various deviations and case-level deviation details, with the three types of deviations labeled in different colors. Compared with the predefined deviation annotations, all cases were correctly identified except for Variant 22, achieving an overall F1-score of 0.93 (precision = 0.94, recall = 0.92). The "variant" refers to different process path patterns formed by differences in the execution order of activities and the included activities during business process execution. According to Tiffany Chiu et al.[39], cases of the same variant share an identical path trajectory. For example, two process instances following the path " Create PO-VCI → GR → IR → CI " are regarded as the same variant. Among Variant 22, 20 cases were misidentified, with the case trajectory being " Create PO-GR-RSE-GR-RSE-IR-GR-RSE-IR-CI ". Analysis of its alignment results reveals that the first occurrence of the "Record Goods Receipt (GR)" activity was incorrectly labeled as a Log Move instead of a Synchronous Move, even though the activity actually exists in the Petri net model. Further analysis indicates that this error stems from the cost optimization mechanism of the alignment algorithm: when searching for the optimal matching, the algorithm determined that labeling this activity as a Log Move (due to its first occurrence not conforming to the expected sequence in the model) resulted in a lower comprehensive cost than marking it as a Synchronous Move and introducing additional Model-only Moves, thereby leading to identification deviation. Notably, the algorithm exhibits excellent identification capability in various mixed deviation scenarios. Taking Variant 18 as an example, this scenario presets the missing of the "GR" activity and the repetition of "IR + RPB", and the plugin successfully identified both deviations simultaneously. In addition, for the trajectories of some variants, the algorithm not only accurately detected the predefined deviations but also made correct judgments on the predefined cyclic structures. This fully verifies that the algorithm maintains reliable analysis and identification capabilities even in complex scenarios involving the coupling of multiple types of deviations. 4.3 Real Log Experiments To verify the generalization ability and practical value of the proposed method in complex business scenarios, this study conducts a systematic experimental evaluation based on the real event logs from BPIC-2019 (adopting the three-way matching subset DF1). The experimental design focuses on two core objectives: verifying the deviation classification framework’s ability to identify three core deviations (missing activities, wrong order, and repeated activities) in real business processes; and evaluating the interpretability of the structured reports and visual interaction mechanism for business users. 4.3.1 Experimental Setup The experiment uses the BPIC-2019 log dataset preprocessed in Section 4.1. Consistent with the synthetic experiments, the Inductive Miner algorithm (with a noise threshold of 0.2) is applied to generate a Petri net process model as the normative benchmark. On this basis, the three-layer deviation analysis framework proposed in this study (based on conformance checking alignment technology) is applied to the real dataset. 4.3.2Experimental Results and Analysis The experiment directly executes the "DPN Deviation Analysis" plugin, outputting a visualization interface with four functions: global summary, deviation distribution details, case-level details, and variant analysis panel (Figure 9). In the summary panel, the statistical data on the left shows that among 9,102 detected cases, 52.3% (4,761 cases) have at least one type of deviation, indicating significant compliance risks in real procurement processes. The dominant deviation type is repeated activities (accounting for 67.1%), mainly concentrated in the "Record Goods Receipt (GR)" and "Record Service Entry Sheet (SES)" links within non-cyclic structures; wrong order accounts for 32.9%, typically manifested as "advance Clear Invoice (CI)" or "delayed Vendor Create Invoice (VCI)"; missing activities are extremely rare, with only 4 cases detected across the entire dataset. This distribution characteristic reveals the coexistence of high-frequency operational redundancy and demand for process flexibility in real business scenarios. Meanwhile, the pie chart on the right intuitively presents this distribution feature. The case detail view (Figure 10) provides fine-grained analysis capability, supporting retrieval by case ID and visualizing deviation details of individual cases. Through trace reconstruction technology, the plugin reconstructs the case execution sequence and marks deviation positions with color coding: red indicates wrong order (e.g., "CI, which should be executed at the end, is performed in advance"), blue indicates repeated activities (e.g., "two consecutive SES activities"), and yellow indicates missing activities (e.g., "unexecuted IR"). This function enables auditors to quickly locate abnormal nodes in specific cases, significantly improving the efficiency of root cause analysis. 4.3.3 Expert Evaluation To verify the advantages of the proposed method in terms of business interpretability and decision support value, this study designs an expert evaluation experiment. Three audit experts familiar with the Purchase-to-Pay (P2P) process are invited to assess the accuracy of compliance risk identification; meanwhile, two business process experts are engaged to focus on analyzing the potential business impacts of deviations. This evaluation focuses on three core objectives: testing the consistency between the tool’s output results and domain experts’ cognition; quantifying the improvement in analysis efficiency of the tool in complex deviation scenarios; and identifying potential technical optimization directions from a business perspective. The experiment adopts the BPIC-2019 dataset preprocessed in Section 4.1, which includes 1272 process variants. Deviation patterns among high-frequency variants are highly similar, so 20 types of typical cases with high frequency and distinct deviation patterns are selected (as shown in Table 3), covering major types such as missing activities, wrong order, repeated activities, and mixed deviations. Before the evaluation, experts are provided with case background, scenario descriptions, and process model diagrams to support their deviation diagnosis. Table 3 20 Categories of Deviation Typical Cases (Real Log) Case No. Deviating P2P Trace 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Through independent diagnosis of the above 20 typical cases and comparative analysis with the tool’s output results, profound insights into the method’s performance and business value were obtained (see Table 4, where grayed entries indicate controversial cases). First, regarding consistency verification: the deviation types detected by the plugin were fully or partially consistent with experts’ diagnostic results in approximately 75% of the cases (e.g., Case 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 16, 17, 19, 20). This initially verifies the tool’s effectiveness in identifying typical rule-based deviations. However, it is noteworthy that partial discrepancies emerged in the remaining 25% of the cases (e.g., Case 1, 7, 11, 14, 15, 18). In-depth analysis of these discrepant cases revealed that the root cause lies primarily in business cognition differences rather than technical flaws, specifically manifesting in four scenarios:(1) Experts accept specific process alternatives based on domain knowledge (e.g., in Case 1, experts consider the "RSE" activity can replace the "GR" function for procuring service-type goods; in Case 3, experts recognize multiple scenarios where missing "GR" may be an exemption for suppliers in direct invoicing scenarios);(2) Experts have higher tolerance for activity execution sequences and allow flexible adjustments under specific conditions (e.g., Case 7 permits "receiving invoices first and supplementing goods receipt later");(3) Experts adopt hierarchical tolerance standards for repeated activities based on their business nature and occurrence frequency (e.g., in Case 11, experts exempt repeated "IR" as normal review; in Case 14, experts accept repeated "Clear Invoice (CI)"; in Case 15, experts regard repeated "GR" as reasonable batch delivery operations);(4) Experts show higher acceptance of mixed deviations in specific high-frequency or complex operation scenarios (e.g., Case 18: the plugin marks IR/RPB/CI as repeated anomalies based on static rules, but experts accept their rationality in certain business contexts, recognizing the existence and legitimacy of the repeated activities). Comparing the plugin’s deviation detection results with experts’ diagnoses reveals that in some cases, although the plugin can accurately identify deviations, inconsistencies with expert judgments arise due to special circumstances or flexibility in business operations. This indicates that while automated tools demonstrate advantages in improving efficiency, these discrepancies clearly highlight the limitations of pure process-driven tools in capturing complex, context-dependent business logic and expert experience. Nevertheless, in most cases—especially when involving obvious violations of established processes (e.g., missing mandatory invoice receipt steps or incorrect payment unlocking positions)—the plugin aligns highly with experts’ opinions, confirming its reliability in identifying standard deviations. Second, regarding the quantitative evaluation of efficiency improvement: experts unanimously reported that the tool significantly accelerates the processing of complex deviation cases. Traditionally, experts needed to manually parse lengthy process traces, compare them with standard models, and infer deviation types and impacts based on experience, which was time-consuming. In contrast, this tool instantly outputs structured deviation detection results (including type, position, and predefined labels), providing experts with a clear starting point. The efficiency improvement is particularly notable when handling complex cases involving multiple activities, long sequences, or mixed deviations (e.g., Case 6, 12, 13, 16, 17, 20). Experts estimated that the tool reduces the average preliminary diagnosis time by approximately 50%-70%, allowing them to focus more on in-depth business impact analysis and risk assessment. Table 4 Comparison of Plug-in Results with Expert Diagnosis Findings Case Diagnostic results (Plug-in ) Diagnosis results (Experts) Summary of Judgment Basis Agree to plug-in ? difference analysis Case1 Missing "GR" No deviation “RSE can replace GR” may be a procurement service item. NO Business Cognition Differences: Experts Accept RSE Instead of GR Case2 Missing "IR" Missing "IR “IR must be executed” YES Identical Case3 Missing "GR" Missing GR or No deviation "Missing GR leads to abnormalities"and may be a direct Invoicing mode YES Substantially consistent Case4 Missing "CI" Missing "CI" “Missing endpoints will cause anomalies” YES Identical Case5 Missing "GR+IR" Missing "GR+IR" “IR+GR must be executed” YES Identical Case6 Wrong order "VCI" Wrong order "VCI" "VCI should be created before GR" YES Identical Case7 Wrong order "IR" No deviation "Receive the invoice first and collect the goods later" NO Business Cognition Differences:Experts permit flexible trace Case8 Wrong order "RPB+VCI" Wrong order "RPB+VCI" "RPB location is incorrect, and the supplier should first provide an invoice" YES Identical Case9 Wrong order "GR" Wrong order "GR" "GR should be prior to VCI" YES Identical Case10 Wrong order "CI" Wrong order "CI" "RPB is invalid after reaching the destination" YES Identical Case11 Repeat "VCI+IR" Repeat "IR" only "IR repetition is a normal review process" NO Business Cognition Differences:Experts grant exemption from repetition of "IR" Case12 Repeat "GR+RSE" Repeat "GR+RSE" "Non-standard repeated GR and RSE" YES Identical Case13 Repeat "RPB" Repeat "RPB" "RPB is repeated" YES Identical Case14 Repeat "RPB+CI" Repeat "RPB" only "CI repetition is acceptable" NO Business Cognition Differences：Graded expert discretion thresholds Case15 Repeat "VCI+GR" No deviation "Batch arrivals cause GR duplication repetition" NO Business Cognition Differences：Experts accept batch operation Case16 Missing "GR and Wrong order "IR" Missing "GR" and Wrong order "IR" "IR is wrong order before RSE" and goods must be received YES Identical Case17 Missing "GR" and Repeat "IR" Missing "GR"and Repeat "IR" "IR repeated execution and must receive goods" YES Identical Case18 Missing "GR" and Repeat "IR+RPB+CI" No deviation "All activities exist, repetition is reasonable" NO Business Cognition Differences：Experts accept high frequency operation Case19 Wrong order "VCI"and Repeat "IR" Wrong order "VCI"and Repeat "IR" "VCI is wrong order and IR is repeated" YES Identical Case20 Wrong order "IR"and Repeat "RPB" Wrong order "IR"and Repeat "RPB" "IR is wrong order before GR and RPB is repeated" YES Identical 4.3 Correlation Mapping Between Process Deviations and Fraud Risks Based on Real Logs Experimental results from real logs show that among 9,102 detected cases in the summary panel, 52.3% (4,761 cases) have at least one type of deviation, indicating significant compliance risks in real procurement processes. Regarding the distribution of deviation types: Repeated activities are the dominant type (accounting for 67.1%), mainly concentrated in the "Record Goods Receipt (GR)" and "Record Service Entry Sheet (SES)" links within non-cyclic structures; Wrong order accounts for 32.9%, typically manifested as "advance Clear Invoice (CI)" or "delayed Vendor Create Invoice (VCI)";Missing activities are extremely rare, with only 4 cases detected across the entire dataset. This distribution characteristic reveals the coexistence of high-frequency operational redundancy and demand for process flexibility in real business scenarios. Combining the correlation logic between process deviations and fraud risks, the potential fraud risks hidden behind various deviations require in-depth analysis to realize an audit closed-loop from "deviation identification" to "risk localization". Specifically, the high proportion of "repeated activity" deviations (67.1%) needs to be closely associated with two types of fraud risks: Repeated execution of "Record Goods Receipt (GR)" in non-cyclic structures may correspond to "inventory inflation fraud". If GR is recorded multiple times for the same procurement case without reasonable batch delivery evidence (e.g., no supporting documents for supplier’s batch deliveries), internal personnel may fabricate receipt records to inflate corporate inventory, thereby concealing inventory shortages or embezzling inventory funds. Repeated execution of "Record Invoice Receipt (IR)" is prone to triggering "duplicate reimbursement or fund embezzlement fraud". That is, the same invoice is entered into the system multiple times to initiate payment processes, which may involve collusion between internal personnel and suppliers to embezzle corporate funds through duplicate invoicing. "Wrong order" deviations (32.9%) mainly map to two fraud scenarios: "Advance payment fraud", typically manifested as "advance Clear Invoice (CI)" (i.e., CI is executed before GR or IR is completed). This violates the core requirement of the three-way matching principle—"verify goods and invoices first, then settle payments"—and may lead enterprises to make payments without actually receiving goods or verifying invoice authenticity, posing a collusion risk of paying fake suppliers or overpaying. "False transaction concealment", such as "delayed Vendor Create Invoice (VCI)" (VCI is executed after GR). In normal procurement processes, VCI should precede IR to ensure invoice matching with purchase orders. Such deviations may be traces of internal personnel forging process compliance by adjusting activity sequences to conceal "false transactions without real procurement backgrounds". Although "missing activity" deviations account for an extremely low proportion (only 4 cases, 0.0%), all manifest as "missing Record Invoice Receipt (IR)". Such deviations are directly associated with "risk of payment without invoices or off-book fund flows". According to compliance requirements for the purchase-to-pay process, IR is a key document to verify transaction authenticity. Payment without IR may bypass financial supervision, posing hidden fraud risks such as internal personnel transferring corporate funds through "payment without invoices" or colluding with suppliers to conceal the actual transaction amount. All 4 detected cases involve single transaction amounts exceeding 100,000 $, with corresponding suppliers being newly added partners. Auditors need to further verify the transaction background by cross-referencing bank statements and contract books. Table 5 Mapping Table of Process Deviation Categories to Fraud Categories Deviation Type Specific Manifestations of Deviation (BPIC-2019) Fraud Category Mapping Risk Disclosure Repeat 1. Duplicate execution of “Record Goods Receipt (GR)” in non-cyclic structures 2. Duplicate entry of “Record Invoice Receipt (IR)” 1. Inventory padding fraud 2. Double billing / funds siphoning fraud 1. Duplicate GRs without valid batch arrival justification may inflate inventory through fabricated receipt records or conceal shortages; 2. Multiple IR entries for the same invoice may trigger duplicate payments, posing risks of collusion between internal and external parties to siphon funds. Wrong order “Invoice Settlement (CI)” is executed before GR/IR completion (CI pre-process) “Vendor Creates Invoice (VCI)” is executed after GR completion (VCI post-process) 1. Advance payment fraud 2. Concealed fraudulent transactions 1. Violating the three-way matching principle may result in payment without receiving goods or verifying invoices, posing a risk of payment to fraudulent suppliers; 2. Post-VCI without purchase order modification records may indicate traces of falsified transactions to appear compliant. Missing “Invoice Receipt (IR) Record” Missing (Only this type of missing data in the entire dataset) Unrecorded payments / Off-book fund flow risks The IR serves as the critical credential for verifying transaction authenticity. Payments lacking an IR may circumvent financial oversight, posing risks of fund diversion and concealment of actual transaction amounts. Based on this, by constructing a rule base that closely links process deviations to fraud categories (Table 5), business compliance experts are provided with investigation insights to capture and identify non-standard transactions deviating from standard processes, alerting to potential fraud risks. Through this mechanism, compliance personnel and auditors can not only respond promptly but also conduct timely in-depth investigations into suspicious transactions, thereby effectively preventing and mitigating fraud, and safeguarding the operational compliance and financial health of enterprises. 5 Conclusion and Discussion Focusing on the core challenge of business process deviation detection and interpretation within enterprise information systems, this study innovatively proposes a four-layer deviation analysis framework based on process mining alignment technology. This framework effectively addresses the existing shortcomings of conformance checking algorithms in transforming deviation semantics and providing business explanations. On a theoretical level, by thoroughly analyzing the output of the DPN-based alignment algorithm, the study captures the distribution characteristics of activity move types. It constructs a formal knowledge base that maps move types to three core deviation categories and designs a rule-driven deviation detection algorithm. This successfully transforms abstract technical data semantics into business deviation descriptions that are easily understandable by compliance personnel. On the practical application front, the study developed the "DPN Deviation Analysis" plugin for the ProM platform. This plugin automates the entire process of deviation labeling, trace reconstruction, and visualization, enabling compliance personnel to intuitively explore the context of deviating activities. The method's effectiveness was validated through dual experiments using both synthetic logs and real-world logs from the BPIC-2019 purchase-to-pay process. In the synthetic log experiments, the overall F1-score reached 0.93, demonstrating excellent deviation identification accuracy. In the real-log experiment, the method identified deviations in 52.3% of the 9102 cases (with duplicate activities accounting for 67.1% and order errors for 32.9%). Expert evaluation showed that the tool's outputs aligned with domain expertise in 75% of typical cases, reducing the initial diagnosis time by an average of 50%-70%. Furthermore, based on the characteristics of real business deviation distributions, the study established a correlation mapping between process deviations and fraud risks, providing concrete guidance for corporate fraud prevention and control. The innovations of this study are primarily reflected in three aspects. First, it establishes knowledge transformation rules that map move types to business deviation semantics, effectively addressing the gap between the abstract outputs of existing alignment algorithms and the concrete needs of business operations, thereby enhancing the interpretability of business deviations. Second, it operationalizes the deviation analysis method by developing a ProM plugin that covers the entire workflow from data input and algorithm processing to result visualization. This provides an end-to-end, practical tool for business monitoring within enterprise information systems, significantly improving monitoring efficiency. Third, it deepens the risk-oriented value of deviation analysis. By establishing a precise mapping between deviations and fraud risks, it elevates process compliance checking to the level of risk prevention and control support, effectively expanding the application scope and practical boundaries of process mining technology in the field of compliance monitoring for enterprise information systems. Despite the aforementioned achievements, the study still has certain limitations. Firstly, the cost optimization mechanism of the DPN alignment algorithm may lead to misjudgments in some activity move types. For instance, in experiments, some activities that conformed to the model were incorrectly marked as log moves, affecting the accuracy of deviation identification. This issue stems from the underlying algorithm's design logic and requires further optimization of the cost function. Secondly, the tool shows insufficient adaptability when handling special business scenarios. In expert evaluations, identification results diverged from expert judgments in 25% of the cases, mainly because the tool struggles to capture flexible operational rules such as substitute activities or batch deliveries. This reflects the limitations of a purely rule-driven approach in handling context-dependent business logic. In response to these limitations, future research will focus on three directions. First, exploring the integration of machine learning with the existing rule-based system to construct an adaptive deviation classification model capable of learning from historical decisions and dynamically optimizing itself. Second, extending the dimensions of deviation analysis from control flow to attributes such as time and resources, thereby building a more comprehensive multi-dimensional deviation analysis framework. Third, validating and promoting this method in broader domains (e.g., financial statement auditing, supply chain management) to enhance its generalizability and applicability. In summary, this study provides a feasible solution from the three dimensions of theoretical models, analytical tools, and empirical evaluation to elevate the level of intelligent process compliance monitoring in enterprise information systems. The research findings indicate that enhancing the "interpretability" of process mining technology is key to unlocking its business value. As corporate digital transformation deepens, embedding such knowledge-driven intelligent analysis methods into the architecture of enterprise information systems holds significant theoretical importance and broad application prospects for building adaptive and intelligent business process governance systems. References Zdravković M, Panetto H, Trajanović M, Aubry A (2014) Explication and semantic qu-erying of enterprise information systems. Knowledge and Information Systems, 40(3):697-724.https://doi.org/10.1007/s10115-013-0650-x Liu J, Xu J, Zhang R, Reiff-Marganiec S (2021) A repairing missing activities approach with succession relation for event logs. Knowledge and Information Systems, 63(2):477-495. Augusto A, Conforti R, Dumas M, La Rosa M, Polyvyanyy A (2019) Split miner: automated discovery of accurate and simple business process models from event logs.Knowledge and Information Systems, 59(2):251-284.https://doi.org/10.1007/s10115-018-1214-x Akhramovich K, Serral E, Cetina C (2024) A systematic literature review on the applicat-ion of process mining to Industry 4.0. Knowledge and Information Systems, 66(5):2699-2746.https://doi.org/10.1007/s10115-023-02042-x Jans M, Soffer P, Jouck T (2019) Building a valuable event log for process mining: an experimental exploration of a guided process.Enterprise Information Systems ,13(5),601-635.https://doi.org/10.1080/17517575.2019.1587788 Ingvaldsen J E, Gulla J A, (2010) Industrial application of semantic process mining Enterprise Information Systems,6(2):139-163.https://doi.org/10.1080/17517575.2011.593103 Cai H, Xu L, Zhang B, Zhang P, Guo J, Zhang Y (2016) A service governance mechanism based on process mining for cloud-based applications.Enterprise Information Systems,12(10):1239-1256.https://doi.org/10.1080/17517575.2018.1442933 Hosseinpour M, Jans M (2024) Auditors‘Categorization of Process Deviations. Journal of Information Systems. 38 (1):67–89.https://doi.org/10.2308/ISYS-2023-051. Van der Aalst W M P, Van Hee K M, Van der Werf J M E M, et al (2010) Auditing 2.0: Using Process Mining to Support Tomorrow’s Auditor. Computer, 43(3):90–93. Jans M, Alles M G, Vasarhelyi M A (2012) The case for process mining in auditing: Sources of value added and areas of application. International Journal of Accounting Information Systems, 14 (1), 1-20 Van der Aalst W M P (2011) Process Mining: Discovery, Conformance and Enhancement of Business Processes. Springer-Verlag, Berlin. Mannhardt F, De Leoni M, Reijers H A, van der Aalst W M P (2015) Balanced multi-perspective checking of process conformance. Computing 98(4), 407–437 https://doi.org/10.1007/s00607-015-0441-1 ProM .(2016) Process mining Workbench ProM.http://www.promtools.org. Garcia C D S, Meincheim A, Faria Junior E R, et al (2019) Process mining techniques and applications – A systematic mapping study. Expert Systems with Applications, 133 : 260-295. Van der Aalst W M P (2016) Process Mining: Data Science in Action. Springer-Verlag Berlin Heidelberg,2016. van der Aalst W M P, Weijters T, Maruster L (2004) Workflow mining: discovering process models from event logs. IEEE Transactions on Knowledge and Data Engineering, 16 (9),1128–1142. Rozinat A, van der Aalst W M P (2008) Conformance checking of processes based on monitoring real behavior.Information Systems, 33 (1), 64–95. Issahaku F Y, Lu K, Fang X,Danwana S B, Bandago H M (2024) An overview of semantic-based process mining techniques: trends and future directions. Knowledge and Information Systems, 66(10):5783-5827. Jans M, Alles M G, Vasarhelyi M A (2012) The case for process mining in auditing: Sources of value added and areas of application. International Journal of Accounting Information Systems, 14 (1), 1-20 Adriansyah A, van Dongen B F, van der Aalst W M P (2011). Conformance checking using cost-based fitness analysis.Proceedings of the 15th IEEE International Enterprise Distributed Object Computing Conference (EDOC), Helsinki, Finland,August 29–September 2. García-Banuelos L, van Beest N R T P, Dumas M, La Rosa M, Mertens W (2018) Complete and interpretable conformance checking of business processes. IEEE Transactions on Software Engineering, 44 (3): 262–290. Dunzer S, Stierle M, Matzner M, et al (2019) Conformance checking: a state-of-the-art literature review.Proceedings of the 11th International Conference on Subject-Oriented Business Process Management. Seville Spain, ACM, 1-10. Zhang L, Fang X (2020) Business process fitness analysis based on alignment processing and deviation detection. Computer Integrated Manufacturing Systems, 26(6), 1573-1581. Wang L, Du Y, Qi L(2019) Efficient deviation detection between a process model and event logs . IEEE/CAA Journal of Automatica Sinica, 6(6) : 1352-1364. Naderifar V, Sahran S, Shukur Z (2019) A review on conformance checking technique for the evaluation of process mining algorithms. TEM Journal, 8(4): 1232. Santoro F M, Revoredo K, E.M.da Cosrata R M (2020) Process Mining Techniques in Internal Auditing: A Stepwise Case Study.Brazilian Journal of Information Systems,13(4):48-76.https://doi.org/10.5753/isys.2020.823 Weijters A J M M, van Der Aalst W M P, De Medeiros A K A (2006) Process mining with the heuristics miner-algorithm. In: BETA Working paper series TU/e 166,pp. 1–34. Leemans S J J, Fahland D, van der Aalst W M P (2013) Discovering block-structured process models from event logs—a constructive approach. In: Application and Theory of Petri Nets and Concurrency. Springer, pp. 311–329. Swinnen J, Depaire B, Jans M, et al (2012) A Process Deviation Analysis-A Case Study.International Conference on Business Process Management Workshops, Springer Berlin Heidelberg, 99:87-98. Agrawal R, Imielinski T, Swami A N et al (1993) Mining asscoiation rules between sets of items inlarge database.International Conference on Management of Data, 22(2):207-216. Jans M, Depaire B, Vanhoof K (2011) Does Process Mining ADD to Internal Auditing？ An Experience Report.International Conference on Exploring Modeling Methods for Systems Analysis and Design, Springer Berlin Heidelberg,(81):31-45. van der Aalst W M P, Adriansyah A (2012) Replaying History on Process Models for Conformance Checking and Performance Analysis.Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery.2(2):182-192.https://doi.org/10.1002/widm.1045 Van Zelst S J, Bolt A, Van Dongen B F (2017) Tuning Alignment Computation: An Experimental Evaluation. ATAED@ Petri Nets/ACSD, 1847: 6-20. Bloemen V, Van Zelst S, Van Der Aalst W M P et al (2022) Aligning observed and modelled behaviour by maximizing synchronous moves and using milestones. Information Systems, 103 : 101456. Chatain T, Boltenhagen M, Carmona J.(2021)Anti-alignments—Measuring the precision of process models and event logs. Information Systems,98 : 101708. Casas-Ramos J, Mucientes M, Lama M.(2024)REACH: Researching Efficient alignment-based conformance checking. Expert Systems with Applications, 41 : 122467. Asare E, Wang L, Fang X (2020) Conformance Checking: Workflow of Hospitals and Workflow of Open-source EMRs. IEEE Access, 08:139546-139566..https://doi.org/10.1109/ACCESS.2020.3012147 Jans M, Alles M G, Vasarhelyi M A (2014) A Field Study on the Use of Process Mining of Event Logs as an Analytical Procedure. The Accounting Review, 89(5):1751-1773. https://doi.org/10.2308/accr-50807 Chiu T, Jans M (2019) Process Mining of Event Logs: A Case Study Evaluating Internal Control Effectiveness. Accounting Horizons, 33(3):141-156. Additional Declarations No competing interests reported. Supplementary Files Thesisdata.zip Cite Share Download PDF Status: Under Review Version 1 posted Reviews received at journal 26 Mar, 2026 Reviews received at journal 23 Mar, 2026 Reviewers agreed at journal 10 Mar, 2026 Reviewers agreed at journal 26 Feb, 2026 Reviewers agreed at journal 23 Feb, 2026 Reviewers invited by journal 15 Jan, 2026 Editor assigned by journal 26 Dec, 2025 Submission checks completed at journal 10 Dec, 2025 First submitted to journal 06 Dec, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8295347","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":576742848,"identity":"e6f35fc9-8b06-44e4-a8e2-dc6edc987c4f","order_by":0,"name":"Changhong Zhou","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA5klEQVRIiWNgGAWjYDACCSBmbIAyGCok5ORJ1HLGwtiwgSQtjG0ViQwHCOiQn918TOLnDrs8+ejmYw+/zpNIYGxgfvjoBh4tjHOOpUn2nkkuNrxzLN1YdptEHjsDm7FxDh4tzBI5ZtKMbcyJG2cAGZLbJIoZG3jYpPFpYYNoqYdqmSOR2HCAgBYeiJbDifOBDMmPDURokZBIS7bsbTueuEEiLU2a4ZiEsWEzAb/Iz0g+eONnW3Xi/BnJxyR/1NTJybM3P3yMTwscGBwAhgUPiMVMjHKwdQ3AEP9BrOpRMApGwSgYUQAA6w1H9fElTgMAAAAASUVORK5CYII=","orcid":"","institution":"Shandong University of Science and Technology","correspondingAuthor":true,"prefix":"","firstName":"Changhong","middleName":"","lastName":"Zhou","suffix":""},{"id":576742852,"identity":"2b8b371c-81d7-4b3b-91cb-8c9ce0c30250","order_by":1,"name":"Jipeng Song","email":"","orcid":"","institution":"Shandong University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Jipeng","middleName":"","lastName":"Song","suffix":""},{"id":576742859,"identity":"5143ae32-2be5-492f-bbda-742f8b1115e9","order_by":2,"name":"Yanqing Song","email":"","orcid":"","institution":"Shandong University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Yanqing","middleName":"","lastName":"Song","suffix":""}],"badges":[],"createdAt":"2025-12-06 14:38:14","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8295347/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8295347/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":100720152,"identity":"523b2cd6-b527-4740-8c82-f9ce720f8b4d","added_by":"auto","created_at":"2026-01-20 19:33:43","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1379880,"visible":true,"origin":"","legend":"","description":"","filename":"Manuscript.docx","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/21c1887e115ba0a15081d606.docx"},{"id":100720110,"identity":"8bca9af7-47a0-4de9-925a-e9248fe9663b","added_by":"auto","created_at":"2026-01-20 19:33:23","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5484,"visible":true,"origin":"","legend":"","description":"","filename":"70ca49f2155a4c93b9d2c9528551d53e.json","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/18b72101c92940aaf9586d9b.json"},{"id":100720155,"identity":"aee795ef-3c6c-4cc1-96df-6b791e1ad800","added_by":"auto","created_at":"2026-01-20 19:33:45","extension":"zip","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":33800251,"visible":true,"origin":"","legend":"","description":"","filename":"Thesisdatad1.zip","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/233761b374d95f10ac72062b.zip"},{"id":100720337,"identity":"c49706fa-bf19-410d-9db1-a80f5a9e85f3","added_by":"auto","created_at":"2026-01-20 19:35:34","extension":"eps","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":392,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage1.eps","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/4542b6a7b4b2654f56225432.eps"},{"id":100720445,"identity":"d0955f44-bd1f-48d3-90b4-6ad3efdfc43a","added_by":"auto","created_at":"2026-01-20 19:36:44","extension":"eps","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":379,"visible":true,"origin":"","legend":"","description":"","filename":"drawingimage2.eps","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/a2faf2dfe5f9d61d5415d0f8.eps"},{"id":100720144,"identity":"f6c447c5-3bcb-46aa-9ddd-9c4727f699eb","added_by":"auto","created_at":"2026-01-20 19:33:36","extension":"emf","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1799024,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/246c3792b67026ba3b2a9472.emf"},{"id":100720161,"identity":"05d039c4-e2aa-496e-886c-6448e7496c43","added_by":"auto","created_at":"2026-01-20 19:33:52","extension":"png","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":63544,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage10.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/960a60ea7e67b97e31390906.png"},{"id":100720315,"identity":"7fd408f8-97ef-4f46-b0bf-7d78ea1c3ede","added_by":"auto","created_at":"2026-01-20 19:35:08","extension":"emf","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":2200588,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/c9dc66160503a29632d94b8d.emf"},{"id":100720661,"identity":"3626cd97-a16f-478f-9fa0-c85420369f19","added_by":"auto","created_at":"2026-01-20 19:38:32","extension":"emf","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":272796,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage3.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/e8ae75504279af67a85b4dc7.emf"},{"id":100719977,"identity":"c50efc72-b181-42e7-bf5e-1fa8cf409f14","added_by":"auto","created_at":"2026-01-20 19:31:40","extension":"emf","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":308236,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/866419f1f009c96d45ccb207.emf"},{"id":100720430,"identity":"e243ed64-f6a7-4bc2-a9c0-d1db153b1452","added_by":"auto","created_at":"2026-01-20 19:36:28","extension":"emf","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":336456,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/631b233be66cf76f9a79b76b.emf"},{"id":100720065,"identity":"b3dd75af-521b-4eea-90f0-6a338892b850","added_by":"auto","created_at":"2026-01-20 19:32:35","extension":"emf","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":335260,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/7714fbff2653165faa40ee81.emf"},{"id":100720193,"identity":"5636f63b-d6e5-4bbf-8c5c-ec98545d8f1a","added_by":"auto","created_at":"2026-01-20 19:34:15","extension":"emf","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":83140,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.emf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/19fb15a111a9111f2c669495.emf"},{"id":100720440,"identity":"2e8f8d0f-f679-4076-a803-9f050183e372","added_by":"auto","created_at":"2026-01-20 19:36:38","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":63028,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/8dcd814e4653e679c494d5b8.png"},{"id":100720068,"identity":"b65b9b17-1d04-408f-b5c4-797da9d80032","added_by":"auto","created_at":"2026-01-20 19:32:39","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":86953,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/5751b85dd12c7160dcb03d31.png"},{"id":100720442,"identity":"bca3802e-c9ab-40aa-a41f-2d88ec288ce9","added_by":"auto","created_at":"2026-01-20 19:36:42","extension":"png","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":67474,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/73e8367a3109c79d127d0026.png"},{"id":100720322,"identity":"7f50df96-83a5-4985-9b77-1954bc3a19b4","added_by":"auto","created_at":"2026-01-20 19:35:14","extension":"png","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":21237,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage10.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/8ae178e62f7b503e3879f815.png"},{"id":100720353,"identity":"cc604e52-0375-460c-ad21-2c63699e55af","added_by":"auto","created_at":"2026-01-20 19:35:52","extension":"png","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":94395,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/631fe41b8d1f9dff2353779c.png"},{"id":100720448,"identity":"383bc5b6-02ab-435f-846a-b00e02ae9bce","added_by":"auto","created_at":"2026-01-20 19:36:45","extension":"png","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6799,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/c8f4a30e6674376879e6b279.png"},{"id":100720663,"identity":"5ea9018b-978d-479e-9495-f6e263d33b39","added_by":"auto","created_at":"2026-01-20 19:38:33","extension":"png","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":9620,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/10643ed169ccdd098543304d.png"},{"id":100719905,"identity":"661a5969-09e4-47a3-a335-ab3c6fee1d46","added_by":"auto","created_at":"2026-01-20 19:31:19","extension":"png","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":10797,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/5e148a7871f6e2eaa1fed529.png"},{"id":100720268,"identity":"d619356b-6a19-426d-be37-6f11b4a0b039","added_by":"auto","created_at":"2026-01-20 19:34:23","extension":"png","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":11132,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/f9a49c08696a0214fec0bfb9.png"},{"id":100720355,"identity":"2eaa3676-8419-4d3e-902b-5dff8648943e","added_by":"auto","created_at":"2026-01-20 19:35:54","extension":"png","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":38438,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/7593db85d496c2c69a04f2e2.png"},{"id":100719996,"identity":"fc753814-de2f-4f21-8d0e-d9b107e6c753","added_by":"auto","created_at":"2026-01-20 19:32:06","extension":"png","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20421,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/dc041adc8758994882b89376.png"},{"id":100720071,"identity":"4ed2dfe7-d378-410d-ac37-874942fda031","added_by":"auto","created_at":"2026-01-20 19:32:41","extension":"png","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":19483,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/00fc3c6073918c98ae52e88c.png"},{"id":100719648,"identity":"8c3c4660-f680-428f-a0dd-654c6f9025be","added_by":"auto","created_at":"2026-01-20 19:29:17","extension":"jpg","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":147279,"visible":true,"origin":"","legend":"\u003cp\u003eMethod and framework\u003c/p\u003e","description":"","filename":"1.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/add2273a93c667d23e58c692.jpg"},{"id":100719994,"identity":"a9d577e2-d2e2-42dd-9e15-e1a24618b166","added_by":"auto","created_at":"2026-01-20 19:32:05","extension":"jpg","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":119729,"visible":true,"origin":"","legend":"\u003cp\u003eConformance Checking of DPN Algorithm Visualization\u003c/p\u003e","description":"","filename":"2.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/3c921c1dc64a1315cea2808f.jpg"},{"id":100720660,"identity":"ad76e601-7ea7-4912-95a0-60316ca568eb","added_by":"auto","created_at":"2026-01-20 19:38:31","extension":"jpg","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":60299,"visible":true,"origin":"","legend":"\u003cp\u003e“Missing Activity” Deviation Scenario\u003c/p\u003e","description":"","filename":"3.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/3b756549572bef6e5792cf1f.jpg"},{"id":100720107,"identity":"2189fc7a-1c5e-45d7-ab20-4c6993458d35","added_by":"auto","created_at":"2026-01-20 19:33:23","extension":"jpg","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":68028,"visible":true,"origin":"","legend":"\u003cp\u003e\"Wrong Order\" Deviation Scenario\u003c/p\u003e","description":"","filename":"4.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/ca92d2e29a1391ad23a5748d.jpg"},{"id":100719679,"identity":"45486992-5935-4ce7-b35c-d757a8ab2679","added_by":"auto","created_at":"2026-01-20 19:29:46","extension":"jpg","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":60571,"visible":true,"origin":"","legend":"\u003cp\u003e\"Repeat \" Deviation Identification: backward backtracking Scenario\u003c/p\u003e","description":"","filename":"5.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/62f0bee0aff47092b70539a6.jpg"},{"id":100719777,"identity":"c00902f3-d5c4-47bc-9bd7-0acc500cac44","added_by":"auto","created_at":"2026-01-20 19:30:41","extension":"jpg","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":62923,"visible":true,"origin":"","legend":"\u003cp\u003e\"Repeat \" Deviation Identification:forward tracking Scenario\u003c/p\u003e","description":"","filename":"6.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/40a0381157a2497b0b20431b.jpg"},{"id":100719993,"identity":"94398757-ddd5-473a-ac59-4528770a3224","added_by":"auto","created_at":"2026-01-20 19:31:59","extension":"jpg","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":38637,"visible":true,"origin":"","legend":"\u003cp\u003ePetri net model (noise = 0.2)\u003c/p\u003e","description":"","filename":"7.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/7d3c22fdb52a552d86cd394b.jpg"},{"id":100720192,"identity":"4d494b2f-149f-4571-a6a1-c95070736173","added_by":"auto","created_at":"2026-01-20 19:34:11","extension":"jpg","order_by":8,"title":"Figure 8","display":"","copyAsset":false,"role":"figure","size":154697,"visible":true,"origin":"","legend":"\u003cp\u003eDeviation Identification and Case-Level Visualization Interface\u003c/p\u003e","description":"","filename":"8.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/7b5aea963c33750d0d0d8eee.jpg"},{"id":100719995,"identity":"5429b535-e760-485f-8f1e-6c9a8bda6b7b","added_by":"auto","created_at":"2026-01-20 19:32:06","extension":"jpg","order_by":9,"title":"Figure 9","display":"","copyAsset":false,"role":"figure","size":114464,"visible":true,"origin":"","legend":"\u003cp\u003eAbstract View\u003c/p\u003e","description":"","filename":"9.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/8293bd78d4f7d9677ba455d2.jpg"},{"id":100720127,"identity":"4a8100da-bdbf-4abe-99b3-bbacb90b0f7f","added_by":"auto","created_at":"2026-01-20 19:33:25","extension":"jpg","order_by":10,"title":"Figure 10","display":"","copyAsset":false,"role":"figure","size":170626,"visible":true,"origin":"","legend":"\u003cp\u003eDetailed View of the Case\u003c/p\u003e","description":"","filename":"10.jpg","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/8f469f8b81e96c5786bd40d7.jpg"},{"id":100728395,"identity":"05e93191-00c0-4d4e-b4de-9e0067a52596","added_by":"auto","created_at":"2026-01-20 20:52:57","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2190617,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/87f28b94-02bd-4e66-844d-a52c84a1c013.pdf"},{"id":100720151,"identity":"5cac479c-bc44-4dcf-bcfd-2e02948c6aba","added_by":"auto","created_at":"2026-01-20 19:33:43","extension":"zip","order_by":0,"title":"","display":"","copyAsset":false,"role":"supplement","size":33800251,"visible":true,"origin":"","legend":"","description":"","filename":"Thesisdata.zip","url":"https://assets-eu.researchsquare.com/files/rs-8295347/v1/bc997617562abcddcad3d4bf.zip"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Knowledge-Driven Approach to Interpretable Compliance Deviation Analysis in Business Processes","fulltext":[{"header":"1 Introduction","content":"\u003cp\u003eCurrently, the operations of modern enterprises increasingly rely on complex information systems such as ERP and SCM[1]. These systems serve not only as the core pillars for executing business processes but also function as critical repositories of both implicit and explicit business knowledge. The massive volumes of event logs they generate contain rich operational knowledge, including compliance rules, process specifications, activity dependencies, and operational patterns[2]. Such knowledge-intensive log data lay the groundwork for data-driven business process compliance monitoring, anomaly detection, and operational optimization[3]. However, this also presents a fundamental challenge: how to effectively extract actionable knowledge from unstructured log data and bridge the semantic gap between technically detected deviations and business-interpretable explanations[4].\u003c/p\u003e\n\u003cp\u003eHowever, against the backdrop of digital transformation, the trend of cross-system integration in information systems and the increased complexity of business processes have rendered traditional compliance monitoring methods inadequate for covering end-to-end process segments[5]. This creates a risk that compliance issues in the execution of critical processes may be overlooked [6]. For instance, does the accuracy of financial transaction records truly reflect the underlying business operations? Can internal control measures effectively prevent errors or fraud? Confronted with complex, dynamic, and large-scale business data, there is a pressing need for more intelligent methods to automatically discern deviations between process execution and expected norms, and to provide precise business-semantic interpretations of such deviations. This is essential to ensure the compliance and effectiveness of business processes[7]. Furthermore, deviations arising during business process execution have become a key factor affecting organizational operational efficiency and compliance. Their effective identification and in-depth analysis constitute a core aspect of internal control work [8]. As digital transformation advances, corporate compliance requirements have also evolved beyond merely \u0026quot;verifying compliance\u0026quot; to further demand the ability to \u0026quot;explain causal chains\u0026quot; and \u0026quot;emphasize real-time monitoring and process optimization.\u0026quot; This shift places higher demands on the intelligence and granularity of compliance monitoring.\u003c/p\u003e\n\u003cp\u003eIn this context, the emergence of efficient data analysis technologies, such as process mining, has become a vital tool for unlocking the knowledge value embedded within information system logs, offering new possibilities to address various challenges in enterprise information system compliance monitoring [4,9]. Leveraging its strengths in data analysis, process mining technology can perform \u0026quot;knowledge extraction\u0026quot; from event logs. This includes automatically extracting process models, deriving compliance norms, and utilizing conformance checking techniques to identify deviations between actual execution and predefined specifications [10,11]. These capabilities provide significant theoretical guidance for supporting anomaly diagnosis, business process optimization, and enabling comprehensive dynamic monitoring.\u003c/p\u003e\n\u003cp\u003eHowever, although existing advanced conformance checking algorithms (such as the mainstream DPN-based alignment algorithm [12]) can quantify inconsistencies between logs and models, their outputs consist of large volumes of abstract technical data (e.g., move types). These results are difficult to directly map to specific deviation patterns at the business level (such as missing activities, incorrect ordering, etc.). This disconnect between technical semantics and business interpretation means there is no effective mechanism to transform such data into actionable \u0026quot;knowledge\u0026quot; thereby creating a critical \u0026quot;knowledge gap\u0026quot; in deviation identification. As a result, when enterprises attempt to identify massive process deviations, it becomes challenging to quickly pinpoint the root cause of issues. Additional human resources are required to interpret alignment results in order to discover corresponding anomalous deviations. This severely limits the automation and scalability of deviation detection, consequently impairing the efficiency and effectiveness of process optimization.\u003c/p\u003e\n\u003cp\u003eTo address the above issues, this paper proposes a four-layer deviation analysis framework based on process mining alignment techniques. The framework aims to systematically identify the most prevalent and common types of business process deviations\u0026mdash;missing activities, out-of-order activities, and duplicate activities\u0026mdash;by interpreting the abstract technical semantic knowledge derived from alignment algorithm results [8].\u003c/p\u003e\n\u003cp\u003eSpecifically, this study extracts the characteristic knowledge of move types from alignment results and constructs mapping rules that translate these move types into specific deviation categories. A rule-driven deviation classification algorithm is then designed to convert alignment outputs into business-interpretable deviation semantics. To better apply this approach in practical business process management, a deviation analysis plugin integrated into the ProM platform [13] has been developed. This plugin supports the visualization and interactive exploration of deviation detection results, enabling auditors to quickly locate process anomalies. It provides compliance officers and related managers with an intuitive and efficient tool for deviation analysis, assisting them in investigating the root causes of deviations and offering end-to-end decision support for enterprises.\u003c/p\u003e\n\u003cp\u003eFurthermore, based on the distribution characteristics of deviations in real-world scenarios, a correlation mapping between process deviations and fraud risks has been established, achieving an audit closed loop from deviation identification to risk localization. The core theoretical contribution of this work lies in constructing a formalized knowledge model\u0026mdash;a rule base\u0026mdash;for interpreting process compliance deviations. This model systematically transforms technical semantics into business knowledge, effectively bridging the previously mentioned \u0026quot;knowledge gap.\u0026quot; It provides both theoretical foundation and practical solutions for business process compliance control and risk prevention.\u003c/p\u003e\n\u003cp\u003eThe structure of the subsequent chapters is as follows: Chapter 2 reviews related work; Chapter 3 elaborates on the methodology and framework design; Chapter 4 validates the method and demonstrates its application through experiments on synthetic logs and real-world cases; Chapter 5 concludes the study and outlines directions for future research.\u003c/p\u003e\n"},{"header":"2 Related work","content":"\u003cp\u003e\u003cstrong\u003e2.1 Process mining \u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eProcess mining is a novel interdisciplinary research field lying at the intersection of computational intelligence, data mining, as well as process modeling and analysis [14]. Its research scope mainly encompasses three aspects: process discovery, conformance checking, and process enhancement [15]. Process discovery technology constructs process models by extracting information recorded in event logs [16], while process enhancement improves or extends existing process models based on information derived from logs [15]. As one of the primary application areas, conformance checking quantifies deviations between event logs and process models. It reflects the degree to which actual behaviors recorded in event logs align with expected behaviors specified in the process model, thereby identifying potential anomalies in the process[17,18].\u003c/p\u003e\n\u003cp\u003eMeanwhile, process anomaly detection based on deviation measurement is a widely used and effective method in process mining. Its core lies in calculating deviation metrics between a given dataset and predefined or standard patterns to determine whether a system or process is in an abnormal state. This method holds significant application value across multiple domains, such as abnormal condition identification in industrial production lines and fraud detection in financial transactions[4]. In practical applications, it is necessary to formulate corresponding judgment criteria based on specific scenarios and domain knowledge, while integrating other anomaly detection methods to improve detection accuracy.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2.2 Overview of Deviation Classification\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe standardization of business process deviation classification serves as a key link connecting technical detection results and business interpretations. Existing classification systems in academic research can be categorized into two types: theoretically driven (model structure-based) and domain-driven (application scenario-based)[19].\u003c/p\u003e\n\u003cp\u003eThe theoretically driven classification focuses on technical detectability. For example, Adriansyah et al. [20] proposed six categories of control-flow deviations (e.g., skipping, insertion, and replacement), while Garc\u0026iacute;a-Ba\u0026ntilde;uelos et al. [21] addressed task-level anomalies based on natural language descriptions. Although highly systematic, such methods often lack support from business semantics and struggle to align with the cognitive needs of practical domains like auditing.\u003c/p\u003e\n\u003cp\u003eIn contrast, the domain-driven classification places greater emphasis on integrating industry-specific cognitive frameworks. Hosseinpour and Jans [8] innovatively integrated the theoretical framework of control-flow deviations with empirical research methods, conducting a systematic investigation into the classification behaviors of experienced auditors regarding 62 types of deviations. They thus concluded that auditors and compliance professionals identify deviations primarily based on three core dimensions: Missing activity, Wrong order, and Repeat activity. Therefore, this study adopts this three-dimensional classification system as the framework for subsequent analysis.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2.3 Abnormal deviation detection\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIn the execution of business processes, anomaly detection aims to identify deviant executions by distinguishing non-conforming behavior from normative behavior. As a critical component of process mining, conformance checking techniques employ specific metrics to quantify the alignment degree between observed behavior in event logs and expected or normative behavior specified in process models[22]. By contrasting modeled behavior with observed behavior, these techniques detect, pinpoint, and explain deviations [23,24]. This dual-capability framework serves both to identify non-compliant executions with diagnostic insights and to evaluate process model quality [25]. Consequently, research on conformance checking constitutes a primary focus for detecting deviations between process models and event logs.\u003c/p\u003e\n\u003cp\u003eEarly conformance checking research predominantly employed model-driven approaches to enhance process model expressiveness for anomaly detection. For instance, Rozinat et al[26]. introduced token-based replay, which simulates token flow through process models to identify activities in event logs not covered by the model. While this technique diagnoses deviation locations via missing/remaining token counts\u0026mdash;enabling continuation through token insertion\u0026mdash;it risks falsely enabling subsequently unexecutable activities, thereby generating misleading diagnostics. Subsequently, Weijters et al.[27] designed Heuristics Nets, incorporating activity frequency and contextual relationships to detect deviations. Although this method improved detection efficacy to some extent, it exhibited high false-positive rates when handling concurrent behaviors.\u003c/p\u003e\n\u003cp\u003eTo address deviation detection in concurrent processes, Leemans et al.[28] developed the Inductive Miner algorithm. This approach directly generates process trees with priority structures from event logs and identifies anomalous activities through structural comparisons (e.g., missing subtrees). However, the method demonstrates sensitivity to noisy logs and lacks precision in localizing anomalous behavior. Later, Swinnen et al.[29] applied fuzzy mining techniques to discover models from logs, comparing them against predefined models to identify deviations and quantify divergence levels. Agrawal [30]and Jans et al.[31]adopted similar association rule mining methods to analyze high-frequency behavioral deviations, both relying on manual comparison to assess divergence from original models\u0026mdash;an approach incurring substantial labor and time costs.\u003c/p\u003e\n\u003cp\u003eThese methods typically enhance existing process models via discovery techniques, evaluating deviation severity through comparison with reference models. Nevertheless, practitioners can only broadly identify anomalous activities within models, failing to map these deviations precisely to individual case trajectories for granular analysis. Crucially, deviation identification remains heavily dependent on manual post-hoc comparison and judgment. This limitation not only reduces practical efficiency but also constrains scalability, indicating significant room for methodological advancement.\u003c/p\u003e\n\u003cp\u003eAddressing this challenge, van der Aalst and Adriansyah[32] initially proposed a conformance deviation detection technique based on alignments, which subsequently evolved into the de facto standard for conformance checking. This method was further applied in Literature [33]. Its core principle involves comparing an individual process execution trace against paths in the model to identify an optimal match, thereby determining whether observed activities deviate from model-defined behavior. This approach provides detailed output at the process instance level.Subsequently, numerous researchers have conducted in-depth studies focusing on two primary directions: optimizing alignment algorithms[34,35,36] and applying them to diverse practical domains [37,38]. Representative work by Van der Aalst et al. [12] introduced the DPN alignment algorithm, which utilizes dynamic programming to optimize the matching path between an event trace and the model. It quantifies the conformance relationship through synchronous moves, model moves, and log moves.\u003c/p\u003e\n\u003cp\u003eHowever, a significant limitation persists: The output of such alignment algorithms typically remains at the abstract level of move types (e.g., model move, log move), lacking systematic classification and interpretation of the underlying deviation behaviors. Manual interpretation of the deviation semantics is still required. This limitation significantly undermines the practical value of process mining in real-world business scenarios.\u003c/p\u003e\n\u003cp\u003eThis study aims to analyze the distribution characteristics of movement types in the alignment results of this algorithm, establish mapping rules from movement types to specific deviation types, and design a rule-driven deviation classification algorithm. Thereby, it converts alignment results into business-interpretable deviation semantics, provides business analysts with a more intuitive and efficient process deviation analysis tool, and offers decision support for enterprises.\u003c/p\u003e"},{"header":"3 Methodology","content":"\u003cp\u003e\u003cstrong\u003e3.1 Methodology and Framework Design\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis study proposes a four-layer deviation analysis framework based on process mining technology (Figure 1). The first phase of the framework adopts the well-established DPN alignment algorithm [12]. The core idea of this algorithm is to align and match event logs recorded by information systems with the Petri net model of standard business processes. Through this operation, we can obtain the matching relationship between the process model and specific case traces, and identify the movement type of each activity (e.g., synchronous moves, log-only moves, or model-only moves). These movement types clearly reveal deviations between actual execution and expected standards. Ultimately, the analysis results of this phase serve as the input for the entire framework (Figure 2).\u003c/p\u003e\n\u003cp\u003eThe second and third phases constitute the core framework stages, establishing a formalized deviation knowledge base. This includes mapping rules from movement types to deviation types, upon which a rule-driven classification algorithm is constructed. This algorithm transforms alignment results into deviation categories with business semantics, covering three core deviation types commonly encountered in business process practices: Missing , Wrong order , Repeated [8]\u0026mdash;which are used to identify unexecuted activities, abnormal sequencing, and redundant executions, respectively. Building on this, a deviation analysis plugin is developed on the ProM platform to realize deviation annotation, trace reconstruction, and visualization. This assists users in understanding the context of deviations, improves analysis efficiency, and supports process optimization.\u003c/p\u003e\n\u003cp\u003eThe final phase focuses on the associative analysis between deviations and risks, aiming to establish a mapping relationship between identified business deviations and potential fraud risks. By integrating information such as the type characteristics, occurrence scenarios, and business impacts of deviations, combined with risk knowledge in the auditing field, the corresponding relationship between deviations and risk points is initially constructed. This provides a foundation for subsequent risk quantitative assessment and disposal, thereby realizing an analytical closed-loop from process deviation identification to risk early warning. It helps compliance personnel and auditors accurately locate high-risk links and enhance the risk prevention and control effectiveness of information systems.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3.2 Deviation Identification and Interpretation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe core work of this study focuses on the interpretation and analysis of deviations. To address this task, identification and interpretation algorithms are designed respectively and integrated into the \u0026quot;DPN Deviation Analysis\u0026quot; plugin of the ProM platform, supporting visual analysis. This plugin takes alignment results in xes format as input and outputs multi-dimensional deviation reports. The key attributes in the alignment results, which form the basis for the logical judgment of deviations, are first explained as follows:\u003c/p\u003e\n\u003cp\u003eThe \u0026quot;alignment:movetype\u0026quot; attribute identifies the movement type, with values including:\u003c/p\u003e\n\u003cp\u003e\u0026middot;alignment:movetype = 0 (Synchronous move): The activity exists and matches both in the log and the model;\u003c/p\u003e\n\u003cp\u003e\u0026middot;alignment:movetype = 1 (Log-only move): The activity only appears in the log, potentially representing a behavior that actually occurred but is not allowed by the model;\u003c/p\u003e\n\u003cp\u003e\u0026middot;alignment:movetype = 2 (Model-only move): The activity only appears in the model, potentially representing a behavior expected by the model but not actually executed.\u003c/p\u003e\n\u003cp\u003eThese movement types serve as crucial bases for identifying deviations such as missing activities, redundant activities, and incorrect sequencing.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3.2.1 The Knowledge Base: Formal Definitions of Deviation Patterns\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis section formally defines and identifies three types of core deviations based on the four-layer deviation analysis framework (Figure 1). The constructed knowledge base primarily consists of the following three core inference rules, which systematically map patterns in alignment sequences to business deviations.\u003c/p\u003e\n\u003cp\u003eLet \u003cstrong\u003e\u003cem\u003eL\u003c/em\u003e \u003c/strong\u003edenote the event log, \u003cstrong\u003e\u003cem\u003eM\u003c/em\u003e\u003c/strong\u003e denote the Petri net model, and \u003cstrong\u003e\u003cem\u003e\u0026sigma; = \u0026lt; m\u003csub\u003e1\u003c/sub\u003e,m\u003csub\u003e2\u003c/sub\u003e,\u0026hellip;,m\u003csub\u003en\u003c/sub\u003e \u0026gt;\u003c/em\u003e\u003c/strong\u003e denote the optimal alignment sequence between\u003cstrong\u003e\u003cem\u003e L\u003c/em\u003e\u003c/strong\u003e and \u003cstrong\u003e\u003cem\u003eM\u003c/em\u003e\u003c/strong\u003e, where \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e\u003c/em\u003e\u003c/strong\u003e represents the i-th activity in the alignment result. Specifically, \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.activity \u003c/em\u003e\u003c/strong\u003edenotes the name of the i-th activity in the optimal alignment sequence; \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.type \u003c/em\u003e\u003c/strong\u003edenotes the movement type of the i-th activity (synchronous move, log-only move, or model-only move); \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.position \u003c/em\u003e\u003c/strong\u003edenotes the position of the i-th activity in the case trace; and \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.caseId\u003c/em\u003e\u003c/strong\u003e denotes the case ID of the i-th activity. The formal definitions and identification processes for the three types of deviations are as follows:\u003c/p\u003e\n\u003cp\u003e(1) Identification of \u0026quot;Missing Activity\u0026quot; Deviations\u003c/p\u003e\n\u003cp\u003eThe missing activity refers to an activity that should be executed but is not actually performed (Figure 3). In other words, such activities exist in the process model but are not implemented in the actual case trace. In Figure 3, when an activity (e.g., t3 in the example) is present in the model trace but does not appear in the log trace, the alignment result will display a purple \u0026quot;model-only move\u0026quot; activity at the corresponding position in the log trace. This activity represents a \u0026quot;missing activity\u0026quot;\u0026mdash;i.e., an activity defined in the model but not recorded in the actual execution of the log. Therefore, the formal definition of the \u0026quot;missing activity\u0026quot; deviation is as follows:\u003c/p\u003e\n\u003cp\u003e\u0026bull; Definition 1: \u0026quot;Missing Activity\u0026quot; Deviation (Missing)\u003c/p\u003e\n\u003cp\u003eFor any activity \u003cstrong\u003e\u003cem\u003emi\u003c/em\u003e\u003c/strong\u003e\u003cimg width=\"12\" height=\"17\" src=\"data:image/png;base64,R0lGODlhEgAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAYACAALAAwAhAAAAAAAAAAAZgA6ZgA6kABmtjoAADo6ADqQ22YAAGa2/5A6AJBmOrZmOrbb/7b//9uQOtv///+2Zv/bkP/btv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwUxIABUzRGcJwJQCeGI8LgQUQxPhmqLUqDsIghqmBL+gL3jDlcAygQPJ27wAlIYBiIiBAA7\" alt=\"image\"\u003e\u003cstrong\u003e\u003cem\u003e \u0026sigma;\u003c/em\u003e\u003c/strong\u003e, it is termed a \u0026quot;missing activity\u0026quot; deviation if the following conditions are satisfied:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.type \u003c/em\u003e\u003c/strong\u003e= 2\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e= {\u0026tau;} (where \u0026tau; denotes an invisible activity)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThis is referred to as the \u0026ldquo;Missing activity\u0026rdquo; deviation.\u003c/p\u003e\n\u003cp\u003eBased on this logic, this study has designed a deviation identification algorithm for \u0026quot;missing activities\u0026quot; (with the pseudocode provided below). In the process of identifying \u0026quot;missing activity\u0026quot; deviations, it is necessary to perform special processing or filtering on \u0026tau; activities (tau activities). \u0026tau; activities represent invisible events in the model (e.g., control nodes in parallel, selection, or loop structures), rather than actual business activities that occur in practice, and thus do not appear in real case traces. If they are mistakenly judged as \u0026quot;missing\u0026quot;, the analysis results will deviate from the actual business execution situation. Filtering \u0026tau; activities helps improve the accuracy and interpretability of deviation analysis, allowing the analysis to focus on real business operation deviations.The pseudocode is as follows:\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAlgorithm1: Identify Missing Activity Deviations\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \u003cp\u003eInput: Alignment between event log and process model\u003c/p\u003e\n \u003cp\u003eOutput: Set of missing activity deviations\u003c/p\u003e\n \u003cp\u003e1 Function IdentifyMissingActivities(alignment):\u003c/p\u003e\n \u003cp\u003e2 missingDeviations = empty list\u003c/p\u003e\n \u003cp\u003e3 for each move in alignment:\u003c/p\u003e\n \u003cp\u003e4 if move.type == MODEL_MOVE and move.activity != \u0026quot;tau\u0026quot;:\u003c/p\u003e\n \u003cp\u003e5 deviation = new Deviation()\u003c/p\u003e\n \u003cp\u003e6 deviation.type = \u0026quot;MISSING\u0026quot;\u003c/p\u003e\n \u003cp\u003e7 deviation.activityName = move.activity\u003c/p\u003e\n \u003cp\u003e8 deviation.position = move.position\u003c/p\u003e\n \u003cp\u003e9 deviation.caseId = move.caseId\u003c/p\u003e\n \u003cp\u003e10 missingDeviations.add(deviation)\u003c/p\u003e\n \u003cp\u003e11 return missingDeviations\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003e(2) Identification of \u0026quot;Wrong Order\u0026quot; Deviations\u003c/p\u003e\n\u003cp\u003eThe identification of \u0026quot;wrong order\u0026quot; deviations is a critical component in control-flow analysis. It is designed to detect cases where the actual execution order of case traces in the log is inconsistent with the sequence specified by the process model. The identification of wrong order primarily relies on the Log Move type in the alignment results. A Log Move (alignment_moveType=1) is generated when an activity exists in the log but cannot be matched with the current position in the model, which typically indicates that the execution of this activity at the current position is inconsistent with the model\u0026apos;s specifications. Therefore, the formal definition of the \u0026quot;wrong order\u0026quot; deviation is as follows:\u003c/p\u003e\n\u003cp\u003e\u0026bull; Definition 2: \u0026quot;Wrong Order\u0026quot; Deviation\u003c/p\u003e\n\u003cp\u003eFor any activity \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e\u003c/em\u003e\u003c/strong\u003e\u003cimg width=\"12\" height=\"17\" src=\"data:image/png;base64,R0lGODlhEgAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAYACAALAAwAhAAAAAAAAAAAZgA6ZgA6kABmtjoAADo6ADqQ22YAAGa2/5A6AJBmOrZmOrbb/7b//9uQOtv///+2Zv/bkP/btv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwUxIABUzRGcJwJQCeGI8LgQUQxPhmqLUqDsIghqmBL+gL3jDlcAygQPJ27wAlIYBiIiBAA7\" alt=\"image\"\u003e\u003cstrong\u003e\u0026sigma;\u003c/strong\u003e, it is termed a \u0026quot;wrong order\u0026quot; deviation if the following conditions are satisfied:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.type\u003c/em\u003e\u003c/strong\u003e = 1 (Log Move);\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e2. \u003cimg width=\"12\" height=\"17\" src=\"data:image/png;base64,R0lGODlhEgAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAABwANAA0AhAAAAAAAAAAAOgAAZgA6kABmtjoAADqQ22YAAGa2/5A6AJCQOpDb/7ZmALb//9uQOtv///+2Zv/bkP//tv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwVD4CMwQGkCE1JIxnGaIkMpBPTONRCNbxQkpVRgSAzkSg1e6fE7sVwAnM00Gzh0AeiJCWxYXyjVE4wcLL5kX5ZcmilNIQA7\" alt=\"image\"\u003ej \u003cimg width=\"14\" height=\"20\" src=\"data:image/png;base64,R0lGODlhFQAeAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAIACgARAA0AhAAAAAAAAAAAOgA6OgA6Zjo6ADo6Ojo6ZjpmkDpmtjqQtmY6AGaQtma222a2/5BmOpC227ZmOrbb27bb/9uQOtu2Ztu2kNvb/9v////btv/b2///2wECAwECAwECAwECAwU9ICCOJGktTqlmj5Bc6rhVxSHFIyswGA7MBsTEB2AZGj0iJaBIEkVAxO2Za/GoUBoBghXpXt1ZYYDsaiKOEAA7\" alt=\"image\"\u003e i, such that\u003cstrong\u003e\u003cem\u003em\u003csub\u003ej\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e\u003cimg width=\"17\" height=\"17\" src=\"data:image/png;base64,R0lGODlhGQAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAYACQAOAAwAhAAAAAAAAAAAOgAAZgA6kDoAZjqQ22YAOma2/5A6AJDb/7ZmALb//9uQOtv///+2Zv/bkP//tv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwUzICCO4jMwZApIiaGmUIGOTWDfeCAoqjm/ooULKIoceKlaLrcjGZHEBsFBXCUQVUDslwoBADs=\" alt=\"image\"\u003e\u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e;\u003c/p\u003e\n\u003cp\u003e\u003cimg width=\"57\" height=\"17\" src=\"data:image/png;base64,R0lGODlhVQAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAUABQBQABMAhQAAAAAAAAAAOgAAZgA6ZgA6kABmtjoAADoAZjo6ADo6ZjpmkDpmtjqQ22YAAGYAOmYAZmY6AGY6OmZmtmaQtma222a2/5A6AJBmOpCQtpC225Db/7ZmALZmOra2Zrbb/7b//9uQOtu2Ztu2kNv///+2Zv/bkP/btv//tv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwb/QIBwSCwaj0VOA4m6FEDIqFTIGUCFpkggwCBNvwAT4mpsPsFoqhU78YoOhrQwddna7Ra5fprKEENre0MoEB4BeXohCx+CUoBkgiEGJYeCIxECFF6NRCgOiI10FpSgRCcYgUinAQQaYKepQpcVnFhjpEYmBwGxSCkiCQGLUbq8ZHRbAqV7kgC4RnS9UquZm0XRkAApHQECG3ocd3fLcxfSfBjeR9hHIQFLkXHOldDm2dMY3Zrr9kee8npECXl2rR8fYMIYRWFXxgE8PSUKbCJIhKGqfK3AWCQi5h4YJUMoDtlI5FK1NOx0KWB0QgIoOuqmECIjstw5RQrleFKXIl+3MmEjL8T0VUfcFnLaDNYaUuzo0kEPvmlU+rRqO4Bf6GC1yhWcgAooonYdm2gLAalkhwQBADs=\" alt=\"image\"\u003e，such that \u003cstrong\u003e\u003cem\u003em\u003csub\u003ej\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e \u003cimg width=\"37\" height=\"17\" src=\"data:image/png;base64,R0lGODlhNwAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAEABQA2ABAAhAAAAAAAAAAAOgAAZgA6ZgA6kABmtjoAADpmkDqQ22YAAGZmOma2/5A6AJDb/7ZmALZmOraQOrbbkLbb/7b//9uQOtuQZtv///+2Zv/bkP//tv//2wECAwECAwECAwECAwWvICCOZGmeaCpWQaK+sHUEyAVvTVDYcF9Wg8kmMqC8MIGFwOFrAjIHhghneD0GkoPL2bsaV8WURpHA7biv8VmElKIqSwCcKQ/Y7/hA/AWtjpBbJmY2UIFoJ30kgChtUw1rhyaJfy0oXiNzkYgHfmyVJmOdT1p1eXl7Kmo8dW4/qACDmiaXIrQksSSZsiRQblQniyWFuyUQQRsQBF8ltiNmxCUyNKu8nG8C0E4srcIHIQA7\" alt=\"image\"\u003e \u003cstrong\u003e\u003cem\u003em\u003csub\u003ej\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e \u003cimg width=\"11\" height=\"17\" src=\"data:image/png;base64,R0lGODlhEAAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAEACwAOAAUAggAAAAAAAAAAOpDb/9uQOgECAwECAwECAwMOSLHcIQPISau92CrnYAIAOw==\" alt=\"image\"\u003e \u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.activity\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThen it is called the \u0026quot;Wrong Order\u0026quot; Deviation.\u003c/p\u003e\n\u003cp\u003eWhen the algorithm detects that an activity\u0026rsquo;s movement type is Log Move, the activity appears for the first time in the current case trace, and the activity will not appear in the form of a Synchronous move thereafter, the algorithm will compare its position in the case trace with the corresponding position in the predefined model trace. If the positions are inconsistent, the algorithm determines that the activity has a wrong order deviation (Figure 4).\u003c/p\u003e\n\u003cp\u003eThe pseudocode is as follows:\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAlgorithm 2: Identify Wrong Order Deviations\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \u003cp\u003eInput: Alignment between event log and process model\u003c/p\u003e\n \u003cp\u003eOutput: Set of wrong order deviations\u003c/p\u003e\n \u003cp\u003e1 Function IdentifyWrongOrderDeviations(alignment):\u003c/p\u003e\n \u003cp\u003e2 wrongOrderDeviations = empty list\u003c/p\u003e\n \u003cp\u003e3 observedActivities = empty set\u003c/p\u003e\n \u003cp\u003e4 for each move in alignment:\u003c/p\u003e\n \u003cp\u003e5 if move.type == LOG_MOVE:\u003c/p\u003e\n \u003cp\u003e6 activity = move.activity\u003c/p\u003e\n \u003cp\u003e7 if existsInFutureModelMoves(activity, alignment, move.position) \u003c/p\u003e\n \u003cp\u003e8 and activity not in observedActivities:\u003c/p\u003e\n \u003cp\u003e9 deviation=new Deviation(\u0026quot;WRONG_ORDER\u0026quot;, activity, move.position, 10 move.caseId)\u003c/p\u003e\n \u003cp\u003e11 wrongOrderDeviations.add(deviation)\u003c/p\u003e\n \u003cp\u003e12 if move.hasLogActivity():\u003c/p\u003e\n \u003cp\u003e13 observedActivities.add(move.activity)\u003c/p\u003e\n \u003cp\u003e14 return wrongOrderDeviations\u003c/p\u003e\n \u003cp\u003e15 Function existsInFutureModelMoves(activity, alignment, currentPosition):\u003c/p\u003e\n \u003cp\u003e16 for i = currentPosition to alignment.length - 1:\u003c/p\u003e\n \u003cp\u003e17 if alignment[i].hasModelActivity() and alignment[i].activity == activity:\u003c/p\u003e\n \u003cp\u003e18 return true\u003c/p\u003e\n \u003cp\u003e19 return false\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 553px;\"\u003e\n \n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e(3) Identification of \u0026quot;Repeated Activity\u0026quot; Deviations\u003c/p\u003e\n\u003cp\u003e\u0026quot;Repeated Activity\u0026quot; deviation (Repeat) refers to an activity that occurs more times in actual execution than specified by the process model. In algorithm design, a multi-level, comprehensive judgment strategy is adopted to identify \u0026quot;Repeated Activity\u0026quot; deviations. First, the formal definition of the \u0026quot;Repeated Activity\u0026quot; deviation is given as follows:\u003c/p\u003e\n\u003cp\u003e\u0026bull; Definition 3: \u0026quot;Repeated Activity\u0026quot; Deviation (Repeated)\u003c/p\u003e\n\u003cp\u003eFor any activity \u003cimg width=\"35\" height=\"17\" src=\"data:image/png;base64,R0lGODlhNQAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAACAA1AA0AhQAAAAAAAAAAOgAAZgA6ZgA6kABmZgBmtjoAADo6ADo6OjpmtjqQ22YAAGY6AGZmZmZmkGZmtmaQ22a2tma2/5A6AJBmOpCQZpCQtpCQ25DbtpDb/7ZmALZmOraQOraQZrbbkLbb27bb/7b//9uQOtuQZtvbttv/29v///+2Zv/bkP/btv//tv//2wECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwECAwbzQIBwSCwaja1OIsBsMo7QqBS6agQKoqkWsLokDoASooACqBwCSrRVuZa3wtZH0QwASE0KPiDYqBBMYAAeA1lDfwFPcGaAdXZ3AQMgEhx8GhAmVoKEhkIpTGpwLFYEIQAdG0OVBhhsAQQPI58BoUd7jk5HlQMjQhxkAKORI4h9AJV9wsBDe7VTiIquarNPe0/KZZ+KQ7POUp+8Qohqu73ljIlCJMZEiIJan8t4yVbXmuqWEScVy0Ou4Vr+ABMGphsAg64EKPCDYFs7QAQ6SeHQxxUBc8MgAezwKgueCRmOrLDQqI5Dfx4ACVjwZtGgACxdygwCADs=\" alt=\"image\"\u003e, it is termed a \u0026quot;Repeated Activity\u0026quot; deviation if the following conditions are satisfied:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003e\u003cem\u003em\u003csub\u003ei\u003c/sub\u003e.type\u003c/em\u003e\u003c/strong\u003e\u003cem\u003e \u003c/em\u003e= 1 (Log Move);\u003c/li\u003e\n\u003cli\u003e\u003cimg width=\"40\" height=\"17\" src=\"data:image/png;base64,R0lGODlhPAAZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAEABgA6ABIAhAAAAAAAAAAAOgAAZgA6kABmtjoAADoAZjpmtjqQ22YAAGYAOmaQ22a2/5A6AJDb/7ZmALb//9uQOtu2Ztu2kNv///+2Zv/bkP//tv//2wECAwECAwECAwECAwECAwECAwWtICCOZFleRmGubAugqhTMdDBErhUkbp/vLMnNRywaAULc0WcZLktJli5AqBgzDt4voAo6Vzpt8XJQ/sSmqDTQaMlq8IDgsW4j4zZzem5s6t18Xn8jWFVGEGgthVaCLBgKXUQYC3Q+j5EraiZhLm94M4ElnG5fUKE9k5U+EqdppYQOr26GRKwPFAgVnjWyAI+0PVh2RCgBuU+jPmSDT0UQrc3RLhMp0tadcgzXSyEAOw==\" alt=\"image\"\u003e，such that \u003cimg width=\"213\" height=\"17\" src=\"data:image/png;base64,R0lGODlhQAEZAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAABQBAARMAhgAAAAAAAAEBAAEAAAAAOgEAOgAAZgEAZgAA/wA6OgA6ZgA6kAA6jwE6kABmZgBmkABmtQBmtgD//zoAADsAADsBATsBADoBADoAOjoAZjo6ADo6Ojo6Zjs6ZjpmZjpmkDpmtjqQtjqQ2zqP2jqQ2juQ22YAAGcBAWYBAWYBAGY6AGZmZmZmkGZmtmaQZmaQtmaQ22a1tWa2tma12ma222a2/2a1/ma2/pA6AJA7AZA6AZBmAJBmOpBmZpBmkJCQZpCQtpCQ25C2ZpDatpDbtpDb/4/a/pDa/pDa/5Db/rZmALZnAbZmAbdmALZnO7ZmOrdmOrZmZrZnkLaQOreROrbbkLbakLXa/rbb/7ba/7Xa/7b/trb/27b//7b+/7X+/7X+/tuQOtuROtuQZtuRZtu2Ztu2kNu3kdu229vbttrbttvb/9v/ttr+ttv/29v//9r+/9r///+2Zv+2Z/+3Zv/bkP/bkf/btv//tv//t///2/7/2////wECAwECAwECAwf/gACCg4SFhoeIiYqLjI2Oj5CRkpOUg2EBASKVm5ydnp+QchMLXYuipKCpqoanpYqtq3o4mAtvq7e4ek4UAQpXuJVPNYJKmMOKxQHHgsLAzo3NAMnLiNOE0ZtymAEERc+EUNTfi3o5BUZ6S+fjjXpPBq6wr6Ou7vDs+AD28fSm/frvXG1KhknTN3te8pkSwAAOADkMHSo0ZEZFgFqbKl60NdGZRoyVPnKshMdEgBCzQAI7Y3FBnI6Hyg2AIKhOhQA2Bt35oSECgDGjbNVRQUBczCcXp2wkVEYDNxh6CAbwmabHBE1pfmDwJqsbgKpXo26bmoaHglJ1gnLa2fOn2qFF/xm5S7p0UNOnYrdRtYpVK1ccXsGKyIspQtmzANKqXHSpW2Nvidj6JDPqpR2iRgfpYTI2ghqzXwDYsbAAjh4zPALESE3gSKE7PCZclDgJz4kANBPfHCHokjHf3dIWJnavEB6iRbRN1TwrxJswXothTOZ4m6aSmahDlv582zBtXi2NHb+8kG9lwIsILz/FABZDx7sp9ylI1snn0ZdqP3/dpAjtxGx03nfcQEZOSm8IZ9Ah590QxgDcIFHHBcMBQIUBWRjSxEVxPIhJThARMAQK25CwRw64ESJGAUfMIUBrhIQhAHnb5DaITSnqliMAlxhQBQzFEEAEC2mYRJ8SxTGXSf9ish1jnyZpdYMdfdIEcI9wPtk3TDH3TFmTbAaFkSQlPf4Y5JBFsudeIU8yqUx9s0A5gZRGDsIlWrJlOcuWVpbipZthjpmIcsPYt5h5VloBA2ciEplCeRdmSEgej9I3WgAkCCLGAV+Uk6MSA5TGzAA5iTGAAWBUAlGOONpYjANA2KfACl0Q+kqfD+HK41JpgZDrm/rMQp+hQmXQhX302QoAdgbJsWAlr8Y6y6y1GnPrPdoUdwlGvf7qpLBw8mossoIoy2y5zyKj62OJRKuHDr3QKgeENyhCB72C5EFipg+VsCyJOUkTqkMQlWYbptnMmFurgmAHj3D5dWPfmOTuihH/dkax6+Yydz4kJ7AaVxyFQL3RqBd8Jj0sW8RFYLdYxdvagrEhGgvHMa7OblxyeCKTnMifgCLisBcTRgjAhgQggcejLhViatL1oZjbyA+96JqnNHk6g0b8xjijyTbWdNPCY5db0K5LuizUBFR++WabuYanJEg9CnQnHizYUnewdZErR2aRKKeJb/0tpU26NvPdbIFsIlhyknfnves9xIbr09+OaMz3oWYjbCrClHIIwL1d1wdv0/pI/dAxoIp6KYhfJ/DCGp0cTHYAvFV5T8cKliwOu8ruTUjvfLfdIxc+2FIx8Zuz0YInHfMOZm9y7+xN8LreOH3xMVqJvPLgBh3u/wLOO1K5eNXbaWVCGxqQkB0U8rsiEoXAj3DUF7XxfOr3myqqqagChUzIRgAjLMs/ByxPY4jQAjfg4B5IIUXd5mKALTxPeACIAhYINQb1NEkOkGnMBzhiMxBycDvx8lltEPinBTYQBxiJYBcmiJQKXjB7GjxhCUPIjRG6rQYmNEYHA0QtRwiuEMwbxLlCR5+nDaGBOmgaFC5SK3oNUWBFFI0FYIQHgGnqVKnShxQSkrCGVM2MtrKVfQiwgZaZwCfYUUa2uoCGHXCDA3iayhv0EAVvNMYFMECbBwJptgiMxDeD3BUBAKk+YHEijdZaYxvTUjg59qmOd8yjIfnoR24wEv+RhMyVIcUTgET+MZTWcETHCHG+QdjqXgGo17u4MckLZCp0sXzQIlEJoYAB4HM20NogLpWpO/QgCZ0oxznSsQ7dlUJ4SFHAe7RxDBnaZ4TRfE9NLEIAENAOAGWYEyFFQYBQ/iRd5CRkOMtJiGK0bSC4gmYv3nMJGQQBANacBTbneSNuelMQ6xynOAkxBnQOFJwHDdA7FYElBjGunbgCIBmnKM1fDsCeAJgiKQLazploBkUPmJaBBEEGXnSTNpzQBS98MQklpA8mjFAC576hFBCMBKYxnSkifJOZJEaCCgGwaSOU0ADajAZGOJVESRaaVFa6VD14bKpU2fTUOkR1qu1MYELS6tABMpZLAKLC6iLqgAEhvBSrcVyTWKeaVm2uVRG4NIAWCHEHEikgNG9FxB1MQAAa5PUaAfDhX5uKFMEOFhFTNKxFt2EAvCY1EAA7\" alt=\"image\"\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eWhen the movement type of an activity in the event log is determined to be a Log Move (movetype=1), the algorithm triggers a two-way verification mechanism combining forward tracking and backward tracing to implement the identification process of repeated activity deviations. First, the system retrieves historical case traces to verify whether the activity exists in previous execution instances in the form of synchronous moves. If confirmed, the activity is marked as a \u0026quot;Repeated Activity\u0026quot; deviation (Figure 5); otherwise, it is classified as a potential \u0026quot;Wrong Order\u0026quot; deviation, and the corresponding \u0026quot;Wrong Order\u0026quot; identification and verification mechanism is triggered for in-depth analysis. Second, when the system retrieves historical case traces and finds that the activity exists in subsequent execution instances and appears in the form of synchronous moves, it is also identified as a \u0026quot;Repeated Activity\u0026quot; deviation (Figure 6).\u003c/p\u003e\n\u003cp\u003eThis two-way verification identification mechanism improves the accuracy of identifying Repeated Activity deviations. It fully accounts for the complexity of loop structures in process models, avoids false positives, and enhances the overall accuracy of deviation analysis.\u003c/p\u003e\n\u003cp\u003eIn summary, the identification of Repeated Activity deviations is a critical component in process deviation analysis, requiring a balance between accuracy and sensitivity. For detecting repeated activities within Log Moves, potential \u0026quot;Repeated Activity\u0026quot; deviations are quickly located by prioritizing checks on the historical occurrence count of the activity and locking in repeated execution instances that fail to match the model\u0026rsquo;s expectations. The pseudocode is as follows:\u003c/p\u003e\n \u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"100%\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 100px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAlgorithm 4: Identify Repeated Activity Deviation\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 100px;\"\u003e\n \u003cp\u003eInput: Aligned trace (alignedTrace)\u003c/p\u003e\n \u003cp\u003eOutput: List of repeat deviations (repeatDeviations)\u003c/p\u003e\n \u003cp\u003e1 Function DetectRepeatDeviations(alignedTrace):\u003c/p\u003e\n \u003cp\u003e2 Initialize activityCounts = {}\u003c/p\u003e\n \u003cp\u003e3 Initialize repeatDeviations = []\u003c/p\u003e\n \u003cp\u003e4 For each event in alignedTrace:\u003c/p\u003e\n \u003cp\u003e5 moveType = GetMoveType(event)\u003c/p\u003e\n \u003cp\u003e6 activityName = GetActivityName(event)\u003c/p\u003e\n \u003cp\u003e7 If moveType == 0: // Synchronous move\u003c/p\u003e\n \u003cp\u003e8 If activityCounts[activityName] \u0026gt; 0:\u003c/p\u003e\n \u003cp\u003e9 AddDeviation(repeatDeviations, activityName)\u003c/p\u003e\n \u003cp\u003e10 activityCounts[activityName]++\u003c/p\u003e\n \u003cp\u003e11 Else if moveType == 1: // Log move\u003c/p\u003e\n \u003cp\u003e12 If activityCounts[activityName] \u0026gt; 0 OR HasFutureSyncMove(event, activityName):\u003c/p\u003e\n \u003cp\u003e13 AddDeviation(repeatDeviations, activityName)\u003c/p\u003e\n \u003cp\u003e14 activityCounts[activityName]++\u003c/p\u003e\n \u003cp\u003e15 Return repeatDeviations\u003c/p\u003e\n \u003cp\u003e16 Function HasFutureSyncMove(event, activityName):\u003c/p\u003e\n \u003cp\u003e17 currentIndex = GetEventIndex(event)\u003c/p\u003e\n \u003cp\u003e18 For i = currentIndex+1 to traceLength-1:\u003c/p\u003e\n \u003cp\u003e19 futureEvent = GetEvent(i)\u003c/p\u003e\n \u003cp\u003e20 If GetMoveType(futureEvent) == 0 AND GetActivityName(futureEvent) == \u003c/p\u003e\n \u003cp\u003e21 activityName:\u003c/p\u003e\n \u003cp\u003e22 Return true\u003c/p\u003e\n \u003cp\u003e23 Return false\u003c/p\u003e\n \u003cp\u003e24 Function AddDeviation(repeatDeviations, activityName):\u003c/p\u003e\n \u003cp\u003e25 deviation = CreateDeviation(activityName, \u0026quot;Activity was repeated\u0026quot;)\u003c/p\u003e\n \u003cp\u003e26 repeatDeviations.Add(deviation)\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n"},{"header":"4 Experimental Design","content":"\u003cp\u003eAs a core component of process conformance checking, the effectiveness of the deviation identification and interpretation technology proposed in this study needs to be systematically verified through experiments in terms of accuracy, efficiency, and interpretability. This chapter aims to validate the quantitative algorithm performance of the system as well as its innovative value at both theoretical and practical dimensions through multi-dimensional evaluations on synthetic logs and real-world business data.\u003c/p\u003e\n\u003cp\u003eThe experiments are based on a public dataset from the BPI Challenge 2019, and synthetic datasets were constructed based on the content of this dataset. The case describes an enterprise\u0026rsquo;s Purchase-to-Pay (P2P) process, with data sourced from the information system of a Dutch coatings and paint company. The company focuses on the partial purchase order processing procedures of 60 of its subsidiaries, covering multiple stages including procurement management, goods receipt, and invoice processing.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.1 Data Preprocessing\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eTo ensure the accuracy of the analysis, the experiment identifies and confirms the start and end marker events for each case. It takes \u0026quot;Create Purchase Order Item\u0026quot; as the case starting point and \u0026quot;Clear Invoice\u0026quot; as the endpoint, ensuring each case includes both start and end events\u0026mdash;incomplete cases are excluded. Additionally, external process activities (e.g., \u0026quot;SRM:Create\u0026quot;) whose operational logic and workflows are often independent of the enterprise\u0026rsquo;s internal processes are excluded, with 7 core activity nodes retained ultimately.\u003c/p\u003e\n\u003cp\u003eGiven that the dataset is concentrated after 2017, the analysis period is limited to December 1, 2017, to February 1, 2019, to enhance timeliness and data representativeness. In the description of BPIC-2019, the event log is divided into four independent yet interrelated data flows (DF1-DF4). Among these, this study selects the data and processes of the more complete and rigorous three-way matching mode (DF1) as the experimental data (Table 1).\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTable 1\u003c/strong\u003e DF1 Data Stream Information\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eDataset attributes\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003eValue\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eCase\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e9,102\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eEvent\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e119,436\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eActivity\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e7\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eCase duration (median)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e79.5d\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eCase duration (average)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e86.7d\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eVariant\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e1272\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eBegin time\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e2018.2.1\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 166px;\"\u003e\n \u003cp\u003eEnd time\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 140px;\"\u003e\n \u003cp\u003e2019.1.17\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003e\u003cstrong\u003eTable 2\u003c/strong\u003e Abbreviations for core activities\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"80%\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 60px;\"\u003e\n \u003cp\u003eActivity\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eAbbreviation\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eRecord Goods Receipt\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eGR\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eRecord Service Entry Sheet\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eSES\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eRecord Invoice Receipt\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eIR\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eClear Invoice\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eCI\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eVendor creates invoice\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eVI\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eCreate Purchase Order Item\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eCreate PO\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 60px;\"\u003e\n \u003cp\u003eRemove Payment Block\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 39px;\"\u003e\n \u003cp\u003eRPB\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.2 Synthetic Data Experiments\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eTo systematically evaluate the accuracy of the deviation classification algorithm in identifying three core deviations\u0026mdash;missing activities, out-of-order activities, and duplicate activities\u0026mdash;this study constructed a controlled experimental environment based on the BPIC-2019 Purchase-to-Payment (P2P) process log. By selecting seven core activity nodes from the log (as shown in Table 2), a reference Petri net model was generated using the Inductive Miner algorithm (noise threshold = 0.2) in the ProM platform (illustrated in Figure 7). Preset deviations were then injected to construct synthetic logs. This design retains the characteristics of real business processes while ensuring the quantifiable verification of deviation identification..\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e4.2.1 Deviation Injection\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eBased on the structural characteristics of the process model, the experiment designs four types of systematic deviation injection strategies:\u003c/p\u003e\n\u003cp\u003eTo verify the algorithm\u0026rsquo;s effectiveness, this study systematically constructs four typical process deviations:\u003c/p\u003e\n\u003cp\u003e\u0026middot;Missing activities simulate compliance loopholes by removing key control nodes (e.g., mandatory activities such as Goods Receipt (GR), Invoice Receipt (IR), and Clear Invoice (CI)), testing the algorithm\u0026rsquo;s ability to identify critical omissions;\u003c/p\u003e\n\u003cp\u003e\u0026middot;Wrong order disrupts activity timing sequences (especially violating strict sequential dependencies) to evaluate the detection effect of process logic violations;\u003c/p\u003e\n\u003cp\u003e\u0026middot;Repeated activities involve inserting redundant activities into non-cyclic paths (e.g., multiple GR operations in a single case) while retaining legitimate cycles, distinguishing between normal and abnormal repetitions;\u003c/p\u003e\n\u003cp\u003e\u0026middot;Mixed deviations superimpose the above multiple anomaly types to construct complex defect scenarios, aiming to test the algorithm\u0026rsquo;s comprehensive detection performance in addressing real-world complex process issues.\u003c/p\u003e\n\u003cp\u003eEach type of deviation is designed for specific process anomaly patterns, collectively forming a complete algorithm verification framework. The experiment generates 500 cases in total, including 100 cases of missing activities, 100 cases of wrong order, 100 cases of repeated activities, 100 cases of mixed deviations, and 100 compliant cases. This hierarchical injection mechanism covers detection needs from basic anomalies to complex scenarios, providing a sufficient foundation for algorithm robustness evaluation.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.2.2 Experimental Verification and Visualization Result Analysis\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFor the verification of synthetic experiments, the \u0026quot;DPN Deviation Analysis\u0026quot; plugin is developed based on Java. It takes alignment results (in XES format) as input and outputs multi-dimensional deviation analysis reports. Experimental results are evaluated through deviation indicators on the visual analysis interface.\u003c/p\u003e\n\u003cp\u003eThe experimental results show that the plugin can accurately identify most deviation types and their distribution frequencies. As shown in Figure 8, the visualization interface clearly displays the statistical distribution of various deviations and case-level deviation details, with the three types of deviations labeled in different colors.\u003c/p\u003e\n\u003cp\u003eCompared with the predefined deviation annotations, all cases were correctly identified except for Variant 22, achieving an overall F1-score of 0.93 (precision = 0.94, recall = 0.92).\u003c/p\u003e\n\u003cp\u003eThe \u0026quot;variant\u0026quot; refers to different process path patterns formed by differences in the execution order of activities and the included activities during business process execution. According to Tiffany Chiu et al.[39], cases of the same variant share an identical path trajectory. For example, two process instances following the path \u0026quot;\u003cem\u003eCreate PO-VCI \u0026rarr; GR \u0026rarr; IR \u0026rarr; CI\u003c/em\u003e\u0026quot; are regarded as the same variant. Among Variant 22, 20 cases were misidentified, with the case trajectory being \u0026quot;\u003cem\u003eCreate PO-GR-RSE-GR-RSE-IR-GR-RSE-IR-CI\u003c/em\u003e\u0026quot;.\u003c/p\u003e\n\u003cp\u003eAnalysis of its alignment results reveals that the first occurrence of the \u0026quot;Record Goods Receipt (GR)\u0026quot; activity was incorrectly labeled as a Log Move instead of a Synchronous Move, even though the activity actually exists in the Petri net model. Further analysis indicates that this error stems from the cost optimization mechanism of the alignment algorithm: when searching for the optimal matching, the algorithm determined that labeling this activity as a Log Move (due to its first occurrence not conforming to the expected sequence in the model) resulted in a lower comprehensive cost than marking it as a Synchronous Move and introducing additional Model-only Moves, thereby leading to identification deviation.\u003c/p\u003e\n\u003cp\u003eNotably, the algorithm exhibits excellent identification capability in various mixed deviation scenarios. Taking Variant 18 as an example, this scenario presets the missing of the \u0026quot;GR\u0026quot; activity and the repetition of \u0026quot;IR + RPB\u0026quot;, and the plugin successfully identified both deviations simultaneously. In addition, for the trajectories of some variants, the algorithm not only accurately detected the predefined deviations but also made correct judgments on the predefined cyclic structures. This fully verifies that the algorithm maintains reliable analysis and identification capabilities even in complex scenarios involving the coupling of multiple types of deviations.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.3 Real Log Experiments\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eTo verify the generalization ability and practical value of the proposed method in complex business scenarios, this study conducts a systematic experimental evaluation based on the real event logs from BPIC-2019 (adopting the three-way matching subset DF1). The experimental design focuses on two core objectives: verifying the deviation classification framework\u0026rsquo;s ability to identify three core deviations (missing activities, wrong order, and repeated activities) in real business processes; and evaluating the interpretability of the structured reports and visual interaction mechanism for business users.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.3.1 Experimental Setup\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe experiment uses the BPIC-2019 log dataset preprocessed in Section 4.1. Consistent with the synthetic experiments, the Inductive Miner algorithm (with a noise threshold of 0.2) is applied to generate a Petri net process model as the normative benchmark. On this basis, the three-layer deviation analysis framework proposed in this study (based on conformance checking alignment technology) is applied to the real dataset.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.3.2Experimental Results and Analysis\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe experiment directly executes the \u0026quot;DPN Deviation Analysis\u0026quot; plugin, outputting a visualization interface with four functions: global summary, deviation distribution details, case-level details, and variant analysis panel (Figure 9).\u003c/p\u003e\n\u003cp\u003eIn the summary panel, the statistical data on the left shows that among 9,102 detected cases, 52.3% (4,761 cases) have at least one type of deviation, indicating significant compliance risks in real procurement processes. The dominant deviation type is repeated activities (accounting for 67.1%), mainly concentrated in the \u0026quot;Record Goods Receipt (GR)\u0026quot; and \u0026quot;Record Service Entry Sheet (SES)\u0026quot; links within non-cyclic structures; wrong order accounts for 32.9%, typically manifested as \u0026quot;advance Clear Invoice (CI)\u0026quot; or \u0026quot;delayed Vendor Create Invoice (VCI)\u0026quot;; missing activities are extremely rare, with only 4 cases detected across the entire dataset.\u003c/p\u003e\n\u003cp\u003eThis distribution characteristic reveals the coexistence of high-frequency operational redundancy and demand for process flexibility in real business scenarios. Meanwhile, the pie chart on the right intuitively presents this distribution feature.\u003c/p\u003e\n\u003cp\u003eThe case detail view (Figure 10) provides fine-grained analysis capability, supporting retrieval by case ID and visualizing deviation details of individual cases. Through trace reconstruction technology, the plugin reconstructs the case execution sequence and marks deviation positions with color coding: red indicates wrong order (e.g., \u0026quot;CI, which should be executed at the end, is performed in advance\u0026quot;), blue indicates repeated activities (e.g., \u0026quot;two consecutive SES activities\u0026quot;), and yellow indicates missing activities (e.g., \u0026quot;unexecuted IR\u0026quot;). This function enables auditors to quickly locate abnormal nodes in specific cases, significantly improving the efficiency of root cause analysis.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4.3.3 Expert Evaluation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eTo verify the advantages of the proposed method in terms of business interpretability and decision support value, this study designs an expert evaluation experiment. Three audit experts familiar with the Purchase-to-Pay (P2P) process are invited to assess the accuracy of compliance risk identification; meanwhile, two business process experts are engaged to focus on analyzing the potential business impacts of deviations. This evaluation focuses on three core objectives: testing the consistency between the tool\u0026rsquo;s output results and domain experts\u0026rsquo; cognition; quantifying the improvement in analysis efficiency of the tool in complex deviation scenarios; and identifying potential technical optimization directions from a business perspective.\u003c/p\u003e\n\u003cp\u003eThe experiment adopts the BPIC-2019 dataset preprocessed in Section 4.1, which includes 1272 process variants. Deviation patterns among high-frequency variants are highly similar, so 20 types of typical cases with high frequency and distinct deviation patterns are selected (as shown in Table 3), covering major types such as missing activities, wrong order, repeated activities, and mixed deviations. Before the evaluation, experts are provided with case background, scenario descriptions, and process model diagrams to support their deviation diagnosis.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTable 3 \u003c/strong\u003e20 Categories of Deviation Typical Cases (Real Log)\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"99%\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e\u003c/p\u003e\n \u003cp\u003e\u003cstrong\u003eCase No.\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003c/p\u003e\n \u003cp\u003e\u003cstrong\u003eDeviating P2P Trace\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e1\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; RPB\u0026rarr; RSE \u0026rarr; IR\u003c/em\u003e\u003cem\u003e\u0026rarr;\u003c/em\u003e\u003cem\u003eCI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e2\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; GR \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RSE \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e3\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; IR\u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e4\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; RSE \u0026rarr; GR \u0026rarr; GR \u0026rarr; RSE \u0026rarr; IR \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e5\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e6\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; VCI \u0026rarr; IR \u0026rarr; RPB\u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e7\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; IR \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e8\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; RPB \u0026rarr; GR \u0026rarr; RSE \u0026rarr; VCI \u0026rarr; IR \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e9\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; VCI \u0026rarr; IR \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e10\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; IR \u0026rarr; CI \u0026rarr; RPB \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e11\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; VCI \u0026rarr; GR \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; IR \u0026rarr; IR \u0026rarr; IR \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e12\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RSE \u0026rarr; IR \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e13\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; GR \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RSE \u0026rarr; IR \u0026rarr; RPB \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e14\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr;GR \u0026rarr; GR \u0026rarr; RSE\u0026rarr; RSE \u0026rarr; IR \u0026rarr; RPB \u0026rarr; RPB \u0026rarr; CI \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e15\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; VCI \u0026rarr; GR \u0026rarr; GR \u0026rarr; GR \u0026rarr; IR \u0026rarr; GR \u0026rarr; GR \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e16\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; IR \u0026rarr; RSE\u0026rarr; RSE \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e17\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; IR \u0026rarr; IR \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e18\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; IR \u0026rarr; RPB \u0026rarr; IR \u0026rarr; RPB \u0026rarr; CI \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e19\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; GR \u0026rarr; RSE \u0026rarr;GR \u0026rarr; RSE \u0026rarr; VCI \u0026rarr; IR \u0026rarr; IR \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 12px;\"\u003e\n \u003cp\u003e20\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cem\u003e\u0026lt; Create PO \u0026rarr; VCI \u0026rarr; IR \u0026rarr; GR \u0026rarr; RSE \u0026rarr; RSE \u0026rarr; GR \u0026rarr; RPB \u0026rarr; RPB \u0026rarr; CI \u0026gt;\u003c/em\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThrough independent diagnosis of the above 20 typical cases and comparative analysis with the tool\u0026rsquo;s output results, profound insights into the method\u0026rsquo;s performance and business value were obtained (see Table 4, where grayed entries indicate controversial cases).\u003c/p\u003e\n\u003cp\u003eFirst, regarding consistency verification: the deviation types detected by the plugin were fully or partially consistent with experts\u0026rsquo; diagnostic results in approximately 75% of the cases (e.g., Case 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 16, 17, 19, 20). This initially verifies the tool\u0026rsquo;s effectiveness in identifying typical rule-based deviations. However, it is noteworthy that partial discrepancies emerged in the remaining 25% of the cases (e.g., Case 1, 7, 11, 14, 15, 18). In-depth analysis of these discrepant cases revealed that the root cause lies primarily in business cognition differences rather than technical flaws, specifically manifesting in four scenarios:(1) Experts accept specific process alternatives based on domain knowledge (e.g., in Case 1, experts consider the \u0026quot;RSE\u0026quot; activity can replace the \u0026quot;GR\u0026quot; function for procuring service-type goods; in Case 3, experts recognize multiple scenarios where missing \u0026quot;GR\u0026quot; may be an exemption for suppliers in direct invoicing scenarios);(2) Experts have higher tolerance for activity execution sequences and allow flexible adjustments under specific conditions (e.g., Case 7 permits \u0026quot;receiving invoices first and supplementing goods receipt later\u0026quot;);(3) Experts adopt hierarchical tolerance standards for repeated activities based on their business nature and occurrence frequency (e.g., in Case 11, experts exempt repeated \u0026quot;IR\u0026quot; as normal review; in Case 14, experts accept repeated \u0026quot;Clear Invoice (CI)\u0026quot;; in Case 15, experts regard repeated \u0026quot;GR\u0026quot; as reasonable batch delivery operations);(4) Experts show higher acceptance of mixed deviations in specific high-frequency or complex operation scenarios (e.g., Case 18: the plugin marks IR/RPB/CI as repeated anomalies based on static rules, but experts accept their rationality in certain business contexts, recognizing the existence and legitimacy of the repeated activities).\u003c/p\u003e\n\u003cp\u003eComparing the plugin\u0026rsquo;s deviation detection results with experts\u0026rsquo; diagnoses reveals that in some cases, although the plugin can accurately identify deviations, inconsistencies with expert judgments arise due to special circumstances or flexibility in business operations. This indicates that while automated tools demonstrate advantages in improving efficiency, these discrepancies clearly highlight the limitations of pure process-driven tools in capturing complex, context-dependent business logic and expert experience. Nevertheless, in most cases\u0026mdash;especially when involving obvious violations of established processes (e.g., missing mandatory invoice receipt steps or incorrect payment unlocking positions)\u0026mdash;the plugin aligns highly with experts\u0026rsquo; opinions, confirming its reliability in identifying standard deviations.\u003c/p\u003e\n\u003cp\u003eSecond, regarding the quantitative evaluation of efficiency improvement: experts unanimously reported that the tool significantly accelerates the processing of complex deviation cases. Traditionally, experts needed to manually parse lengthy process traces, compare them with standard models, and infer deviation types and impacts based on experience, which was time-consuming. In contrast, this tool instantly outputs structured deviation detection results (including type, position, and predefined labels), providing experts with a clear starting point. The efficiency improvement is particularly notable when handling complex cases involving multiple activities, long sequences, or mixed deviations (e.g., Case 6, 12, 13, 16, 17, 20). Experts estimated that the tool reduces the average preliminary diagnosis time by approximately 50%-70%, allowing them to focus more on in-depth business impact analysis and risk assessment.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTable 4 \u003c/strong\u003eComparison of Plug-in Results with Expert Diagnosis Findings\u003c/p\u003e\n\u003ctable border=\"0\" cellspacing=\"0\" cellpadding=\"0\" width=\"601\"\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eCase\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eDiagnostic results\u003c/strong\u003e\u003c/p\u003e\n \u003cp\u003e\u003cstrong\u003e(Plug-in )\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eDiagnosis results\u003c/strong\u003e\u003c/p\u003e\n \u003cp\u003e\u003cstrong\u003e(Experts)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eSummary of Judgment Basis\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAgree to plug-in ?\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003e\u003cstrong\u003edifference analysis\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase1\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eNo deviation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026ldquo;RSE can replace GR\u0026rdquo; may be a procurement service item.\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences: Experts Accept RSE Instead of GR\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase2\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing \u0026quot;IR\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026ldquo;IR must be executed\u0026rdquo;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase3\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing GR or No deviation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;Missing GR leads to abnormalities\u0026quot;and may be a direct Invoicing mode\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eSubstantially consistent\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase4\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing \u0026quot;CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026ldquo;Missing endpoints will cause anomalies\u0026rdquo;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase5\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR+IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR+IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026ldquo;IR+GR must be executed\u0026rdquo;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase6\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;VCI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;VCI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;VCI should be created before GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase7\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eNo deviation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;Receive the invoice first and collect the goods later\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences:Experts permit flexible trace\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase8\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;RPB+VCI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;RPB+VCI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;RPB location is incorrect, and the supplier should first provide an invoice\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase9\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;GR should be prior to VCI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase10\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;RPB is invalid after reaching the destination\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase11\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;VCI+IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;IR\u0026quot; only\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;IR repetition is a normal review process\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences:Experts grant exemption from repetition of \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase12\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;GR+RSE\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;GR+RSE\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;Non-standard repeated GR and RSE\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase13\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;RPB\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;RPB\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;RPB is repeated\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase14\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;RPB+CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;RPB\u0026quot; only\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;CI repetition is acceptable\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences：Graded expert discretion thresholds\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase15\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eRepeat \u0026quot;VCI+GR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eNo deviation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;Batch arrivals cause GR duplication repetition\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences：Experts accept batch operation\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase16\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR and Wrong order \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot; and Wrong order \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;IR is wrong order before RSE\u0026quot; and goods must be received\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase17\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot; and Repeat \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot;and Repeat \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;IR repeated execution and must receive goods\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase18\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eMissing \u0026quot;GR\u0026quot; and Repeat \u0026quot;IR+RPB+CI\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eNo deviation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;All activities exist, repetition is reasonable\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eNO\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eBusiness Cognition Differences：Experts accept high frequency operation\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase19\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;VCI\u0026quot;and Repeat \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;VCI\u0026quot;and Repeat \u0026quot;IR\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;VCI is wrong order and IR is repeated\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 52px;\"\u003e\n \u003cp\u003eCase20\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 98px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;IR\u0026quot;and Repeat \u0026quot;RPB\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 111px;\"\u003e\n \u003cp\u003eWrong order \u0026quot;IR\u0026quot;and Repeat \u0026quot;RPB\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 145px;\"\u003e\n \u003cp\u003e\u0026quot;IR is wrong order before GR and RPB is repeated\u0026quot;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 56px;\"\u003e\n \u003cp\u003eYES\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 139px;\"\u003e\n \u003cp\u003eIdentical \u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003e\u003cstrong\u003e4.3 Correlation Mapping Between Process Deviations and Fraud Risks Based on Real Logs\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eExperimental results from real logs show that among 9,102 detected cases in the summary panel, 52.3% (4,761 cases) have at least one type of deviation, indicating significant compliance risks in real procurement processes. Regarding the distribution of deviation types:\u003c/p\u003e\n\u003cp\u003eRepeated activities are the dominant type (accounting for 67.1%), mainly concentrated in the \u0026quot;Record Goods Receipt (GR)\u0026quot; and \u0026quot;Record Service Entry Sheet (SES)\u0026quot; links within non-cyclic structures;\u003c/p\u003e\n\u003cp\u003eWrong order accounts for 32.9%, typically manifested as \u0026quot;advance Clear Invoice (CI)\u0026quot; or \u0026quot;delayed Vendor Create Invoice (VCI)\u0026quot;;Missing activities are extremely rare, with only 4 cases detected across the entire dataset.\u003c/p\u003e\n\u003cp\u003eThis distribution characteristic reveals the coexistence of high-frequency operational redundancy and demand for process flexibility in real business scenarios. Combining the correlation logic between process deviations and fraud risks, the potential fraud risks hidden behind various deviations require in-depth analysis to realize an audit closed-loop from \u0026quot;deviation identification\u0026quot; to \u0026quot;risk localization\u0026quot;.\u003c/p\u003e\n\u003cp\u003eSpecifically, the high proportion of \u0026quot;repeated activity\u0026quot; deviations (67.1%) needs to be closely associated with two types of fraud risks:\u003c/p\u003e\n\u003cp\u003eRepeated execution of \u0026quot;Record Goods Receipt (GR)\u0026quot; in non-cyclic structures may correspond to \u0026quot;inventory inflation fraud\u0026quot;. If GR is recorded multiple times for the same procurement case without reasonable batch delivery evidence (e.g., no supporting documents for supplier\u0026rsquo;s batch deliveries), internal personnel may fabricate receipt records to inflate corporate inventory, thereby concealing inventory shortages or embezzling inventory funds.\u003c/p\u003e\n\u003cp\u003eRepeated execution of \u0026quot;Record Invoice Receipt (IR)\u0026quot; is prone to triggering \u0026quot;duplicate reimbursement or fund embezzlement fraud\u0026quot;. That is, the same invoice is entered into the system multiple times to initiate payment processes, which may involve collusion between internal personnel and suppliers to embezzle corporate funds through duplicate invoicing.\u003c/p\u003e\n\u003cp\u003e\u0026quot;Wrong order\u0026quot; deviations (32.9%) mainly map to two fraud scenarios:\u003c/p\u003e\n\u003cp\u003e\u0026quot;Advance payment fraud\u0026quot;, typically manifested as \u0026quot;advance Clear Invoice (CI)\u0026quot; (i.e., CI is executed before GR or IR is completed). This violates the core requirement of the three-way matching principle\u0026mdash;\u0026quot;verify goods and invoices first, then settle payments\u0026quot;\u0026mdash;and may lead enterprises to make payments without actually receiving goods or verifying invoice authenticity, posing a collusion risk of paying fake suppliers or overpaying.\u003c/p\u003e\n\u003cp\u003e\u0026quot;False transaction concealment\u0026quot;, such as \u0026quot;delayed Vendor Create Invoice (VCI)\u0026quot; (VCI is executed after GR). In normal procurement processes, VCI should precede IR to ensure invoice matching with purchase orders. Such deviations may be traces of internal personnel forging process compliance by adjusting activity sequences to conceal \u0026quot;false transactions without real procurement backgrounds\u0026quot;.\u003c/p\u003e\n\u003cp\u003eAlthough \u0026quot;missing activity\u0026quot; deviations account for an extremely low proportion (only 4 cases, 0.0%), all manifest as \u0026quot;missing Record Invoice Receipt (IR)\u0026quot;. Such deviations are directly associated with \u0026quot;risk of payment without invoices or off-book fund flows\u0026quot;. According to compliance requirements for the purchase-to-pay process, IR is a key document to verify transaction authenticity. Payment without IR may bypass financial supervision, posing hidden fraud risks such as internal personnel transferring corporate funds through \u0026quot;payment without invoices\u0026quot; or colluding with suppliers to conceal the actual transaction amount. All 4 detected cases involve single transaction amounts exceeding 100,000 $, with corresponding suppliers being newly added partners. Auditors need to further verify the transaction background by cross-referencing bank statements and contract books.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTable 5 \u003c/strong\u003eMapping Table of Process Deviation Categories to Fraud Categories\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\"\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eDeviation Type\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eSpecific Manifestations of Deviation\u003c/strong\u003e\u003c/p\u003e\n \u003cp\u003e\u003cstrong\u003e(BPIC-2019)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eFraud Category Mapping\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eRisk Disclosure\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eRepeat\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1. Duplicate execution of \u0026ldquo;Record Goods Receipt (GR)\u0026rdquo; in non-cyclic structures\u003c/p\u003e\n \u003cp\u003e2. Duplicate entry of \u0026ldquo;Record Invoice Receipt (IR)\u0026rdquo;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1. Inventory padding fraud\u003c/p\u003e\n \u003cp\u003e2. Double billing / funds siphoning fraud\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1. Duplicate GRs without valid batch arrival justification may inflate inventory through fabricated receipt records or conceal shortages;\u003c/p\u003e\n \u003cp\u003e2. Multiple IR entries for the same invoice may trigger duplicate payments, posing risks of collusion between internal and external parties to siphon funds.\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eWrong\u003c/p\u003e\n \u003cp\u003eorder\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003col\u003e\n\u003cli\u003e\u0026ldquo;Invoice Settlement (CI)\u0026rdquo; is executed before GR/IR completion (CI pre-process)\u003c/li\u003e\n\u003cli\u003e\u0026ldquo;Vendor Creates Invoice (VCI)\u0026rdquo; is executed after GR completion (VCI post-process)\u003c/li\u003e\n \u003c/ol\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1. Advance payment fraud\u003c/p\u003e\n \u003cp\u003e2. Concealed fraudulent transactions\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1. Violating the three-way matching principle may result in payment without receiving goods or verifying invoices, posing a risk of payment to fraudulent suppliers;\u003c/p\u003e\n \u003cp\u003e2. Post-VCI without purchase order modification records may indicate traces of falsified transactions to appear compliant.\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eMissing\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u0026ldquo;Invoice Receipt (IR) Record\u0026rdquo; Missing (Only this type of missing data in the entire dataset)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eUnrecorded payments / Off-book fund flow risks\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eThe IR serves as the critical credential for verifying transaction authenticity. Payments lacking an IR may circumvent financial oversight, posing risks of fund diversion and concealment of actual transaction amounts.\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eBased on this, by constructing a rule base that closely links process deviations to fraud categories (Table 5), business compliance experts are provided with investigation insights to capture and identify non-standard transactions deviating from standard processes, alerting to potential fraud risks. Through this mechanism, compliance personnel and auditors can not only respond promptly but also conduct timely in-depth investigations into suspicious transactions, thereby effectively preventing and mitigating fraud, and safeguarding the operational compliance and financial health of enterprises.\u003c/p\u003e"},{"header":"5 Conclusion and Discussion","content":"\u003cp\u003eFocusing on the core challenge of business process deviation detection and interpretation within enterprise information systems, this study innovatively proposes a four-layer deviation analysis framework based on process mining alignment technology. This framework effectively addresses the existing shortcomings of conformance checking algorithms in transforming deviation semantics and providing business explanations. On a theoretical level, by thoroughly analyzing the output of the DPN-based alignment algorithm, the study captures the distribution characteristics of activity move types. It constructs a formal knowledge base that maps move types to three core deviation categories and designs a rule-driven deviation detection algorithm. This successfully transforms abstract technical data semantics into business deviation descriptions that are easily understandable by compliance personnel.\u003c/p\u003e\n\u003cp\u003eOn the practical application front, the study developed the \u0026quot;DPN Deviation Analysis\u0026quot; plugin for the ProM platform. This plugin automates the entire process of deviation labeling, trace reconstruction, and visualization, enabling compliance personnel to intuitively explore the context of deviating activities. The method\u0026apos;s effectiveness was validated through dual experiments using both synthetic logs and real-world logs from the BPIC-2019 purchase-to-pay process. In the synthetic log experiments, the overall F1-score reached 0.93, demonstrating excellent deviation identification accuracy. In the real-log experiment, the method identified deviations in 52.3% of the 9102 cases (with duplicate activities accounting for 67.1% and order errors for 32.9%). Expert evaluation showed that the tool\u0026apos;s outputs aligned with domain expertise in 75% of typical cases, reducing the initial diagnosis time by an average of 50%-70%. Furthermore, based on the characteristics of real business deviation distributions, the study established a correlation mapping between process deviations and fraud risks, providing concrete guidance for corporate fraud prevention and control.\u003c/p\u003e\n\u003cp\u003eThe innovations of this study are primarily reflected in three aspects.\u0026nbsp;First, it establishes knowledge transformation rules that map move types to business deviation semantics, effectively addressing the gap between the abstract outputs of existing alignment algorithms and the concrete needs of business operations, thereby enhancing the interpretability of business deviations.\u0026nbsp;Second, it operationalizes the deviation analysis method by developing a ProM plugin that covers the entire workflow from data input and algorithm processing to result visualization. This provides an end-to-end, practical tool for business monitoring within enterprise information systems, significantly improving monitoring efficiency.\u0026nbsp;Third, it deepens the risk-oriented value of deviation analysis. By establishing a precise mapping between deviations and fraud risks, it elevates process compliance checking to the level of risk prevention and control support, effectively expanding the application scope and practical boundaries of process mining technology in the field of compliance monitoring for enterprise information systems.\u003c/p\u003e\n\u003cp\u003eDespite the aforementioned achievements, the study still has certain limitations.\u0026nbsp;Firstly, the cost optimization mechanism of the DPN alignment algorithm may lead to misjudgments in some activity move types. For instance, in experiments, some activities that conformed to the model were incorrectly marked as log moves, affecting the accuracy of deviation identification. This issue stems from the underlying algorithm\u0026apos;s design logic and requires further optimization of the cost function.\u0026nbsp;Secondly, the tool shows insufficient adaptability when handling special business scenarios. In expert evaluations, identification results diverged from expert judgments in 25% of the cases, mainly because the tool struggles to capture flexible operational rules such as substitute activities or batch deliveries. This reflects the limitations of a purely rule-driven approach in handling context-dependent business logic.\u003c/p\u003e\n\u003cp\u003eIn response to these limitations, future research will focus on three directions.\u0026nbsp;First, exploring the integration of machine learning with the existing rule-based system to construct an adaptive deviation classification model capable of learning from historical decisions and dynamically optimizing itself.\u0026nbsp;Second, extending the dimensions of deviation analysis from control flow to attributes such as time and resources, thereby building a more comprehensive multi-dimensional deviation analysis framework.\u0026nbsp;Third, validating and promoting this method in broader domains (e.g., financial statement auditing, supply chain management) to enhance its generalizability and applicability.\u003c/p\u003e\n\u003cp\u003eIn summary, this study provides a feasible solution from the three dimensions of theoretical models, analytical tools, and empirical evaluation to elevate the level of intelligent process compliance monitoring in enterprise information systems. The research findings indicate that enhancing the \u0026quot;interpretability\u0026quot; of process mining technology is key to unlocking its business value. As corporate digital transformation deepens, embedding such knowledge-driven intelligent analysis methods into the architecture of enterprise information systems holds significant theoretical importance and broad application prospects for building adaptive and intelligent business process governance systems.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\n\u003cli\u003eZdravković M, Panetto H, Trajanović M, Aubry A (2014) Explication and semantic qu-erying of enterprise\u0026ensp;information\u0026ensp;systems. Knowledge and Information Systems, 40(3):697-724.https://doi.org/10.1007/s10115-013-0650-x\u003c/li\u003e\n\u003cli\u003eLiu J, Xu J, Zhang R, Reiff-Marganiec S (2021) A repairing missing activities approach with succession relation for\u0026ensp;event\u0026ensp;logs. Knowledge and Information Systems, 63(2):477-495.\u003c/li\u003e\n\u003cli\u003eAugusto A, Conforti R, Dumas M, La Rosa M, Polyvyanyy A (2019) Split miner: automated discovery of accurate and simple business process models from\u0026ensp;event\u0026ensp;logs.Knowledge and Information Systems, 59(2):251-284.https://doi.org/10.1007/s10115-018-1214-x\u003c/li\u003e\n\u003cli\u003eAkhramovich K, Serral E, Cetina C (2024) A\u0026ensp;systematic\u0026ensp;literature review on the applicat-ion of process mining to Industry 4.0. Knowledge and Information Systems, 66(5):2699-2746.https://doi.org/10.1007/s10115-023-02042-x\u003c/li\u003e\n\u003cli\u003eJans M, Soffer P, Jouck T (2019) Building a valuable event log for process mining: an experimental exploration of a guided process.Enterprise Information Systems\u0026ensp;,13(5),601-635.https://doi.org/10.1080/17517575.2019.1587788\u003c/li\u003e\n\u003cli\u003eIngvaldsen J E, Gulla J A, (2010) Industrial application of semantic process mining Enterprise Information Systems,6(2):139-163.https://doi.org/10.1080/17517575.2011.593103\u003c/li\u003e\n\u003cli\u003eCai H, Xu L, Zhang B, Zhang P, Guo J, Zhang Y (2016) A service governance mechanism based on process mining for cloud-based applications.Enterprise Information Systems,12(10):1239-1256.https://doi.org/10.1080/17517575.2018.1442933\u003c/li\u003e\n\u003cli\u003eHosseinpour M, Jans M (2024) Auditors\u0026lsquo;Categorization of Process Deviations. Journal of Information Systems. 38 (1):67\u0026ndash;89.https://doi.org/10.2308/ISYS-2023-051.\u003c/li\u003e\n\u003cli\u003eVan der Aalst W M P, Van Hee K M, Van der Werf J M E M, et al (2010) Auditing 2.0: Using Process Mining to Support Tomorrow\u0026rsquo;s Auditor. Computer, 43(3):90\u0026ndash;93.\u003c/li\u003e\n\u003cli\u003eJans M, Alles M G, Vasarhelyi M A (2012) The case for process mining in auditing: Sources of value added and areas of application. International Journal of Accounting Information Systems, 14 (1), 1-20\u003c/li\u003e\n\u003cli\u003eVan der Aalst W M P (2011) Process Mining: Discovery, Conformance and Enhancement of Business Processes. Springer-Verlag, Berlin.\u003c/li\u003e\n\u003cli\u003eMannhardt F, De Leoni M, Reijers H A, van der Aalst W M P (2015) Balanced multi-perspective checking of process conformance. Computing 98(4), 407\u0026ndash;437 https://doi.org/10.1007/s00607-015-0441-1\u003c/li\u003e\n\u003cli\u003eProM .(2016) Process mining Workbench ProM.http://www.promtools.org.\u003c/li\u003e\n\u003cli\u003eGarcia C D S, Meincheim A, Faria Junior E R, et al (2019) Process mining techniques and applications \u0026ndash; A systematic mapping study. Expert Systems with Applications, 133 : 260-295.\u003c/li\u003e\n\u003cli\u003eVan der Aalst W M P (2016) Process Mining: Data Science in Action. Springer-Verlag Berlin Heidelberg,2016.\u003c/li\u003e\n\u003cli\u003evan der Aalst W M P, Weijters T, Maruster L (2004) Workflow mining: discovering process models from event logs. IEEE Transactions on Knowledge and Data Engineering, 16 (9),1128\u0026ndash;1142.\u003c/li\u003e\n\u003cli\u003eRozinat A, van der Aalst W M P (2008) Conformance checking of processes based on monitoring real behavior.Information Systems, 33 (1), 64\u0026ndash;95.\u003c/li\u003e\n\u003cli\u003eIssahaku F Y, Lu K, Fang X,Danwana S B, Bandago H M (2024) An overview of semantic-based\u0026ensp;process\u0026ensp;mining\u0026ensp;techniques: trends and future directions. Knowledge and Information Systems, 66(10):5783-5827.\u003c/li\u003e\n\u003cli\u003eJans M, Alles M G, Vasarhelyi M A (2012) The case for process mining in auditing: Sources of value added and areas of application. International Journal of Accounting Information Systems, 14 (1), 1-20\u003c/li\u003e\n\u003cli\u003eAdriansyah A, van Dongen B F, van der Aalst W M P (2011). Conformance checking using cost-based fitness analysis.Proceedings of the 15th IEEE International Enterprise Distributed Object Computing Conference (EDOC), Helsinki, Finland,August 29\u0026ndash;September 2.\u003c/li\u003e\n\u003cli\u003eGarc\u0026iacute;a-Banuelos L, van Beest N R T P, Dumas M, La Rosa M, Mertens W (2018) Complete and interpretable conformance checking of business processes. IEEE Transactions on Software Engineering, 44 (3): 262\u0026ndash;290. \u003c/li\u003e\n\u003cli\u003eDunzer S, Stierle M, Matzner M, et al (2019) Conformance checking: a state-of-the-art literature review.Proceedings of the 11th International Conference on Subject-Oriented Business Process Management. Seville Spain, ACM, 1-10.\u003c/li\u003e\n\u003cli\u003eZhang L, Fang X (2020) Business process fitness analysis based on alignment processing and deviation detection. Computer Integrated Manufacturing Systems, 26(6), 1573-1581.\u003c/li\u003e\n\u003cli\u003eWang L, Du Y, Qi L(2019) Efficient deviation detection between a process model and event logs . IEEE/CAA Journal of Automatica Sinica, 6(6) : 1352-1364.\u003c/li\u003e\n\u003cli\u003eNaderifar V, Sahran S, Shukur Z (2019) A review on conformance checking technique for the evaluation of process mining algorithms. TEM Journal, 8(4): 1232. \u003c/li\u003e\n\u003cli\u003eSantoro F M, Revoredo K, E.M.da Cosrata R M (2020) Process Mining Techniques in Internal Auditing: A Stepwise Case Study.Brazilian Journal of Information Systems,13(4):48-76.https://doi.org/10.5753/isys.2020.823\u003c/li\u003e\n\u003cli\u003eWeijters A J M M, van Der Aalst W M P, De Medeiros A K A (2006) Process mining with the heuristics miner-algorithm. In: BETA Working paper series TU/e 166,pp. 1\u0026ndash;34.\u003c/li\u003e\n\u003cli\u003eLeemans S J J, Fahland D, van der Aalst W M P (2013) Discovering block-structured process models from event logs\u0026mdash;a constructive approach. In: Application and Theory of Petri Nets and Concurrency. Springer, pp. 311\u0026ndash;329.\u003c/li\u003e\n\u003cli\u003eSwinnen J, Depaire B, Jans M, et al (2012) A Process Deviation Analysis-A Case Study.International Conference on Business Process Management Workshops, Springer Berlin Heidelberg, 99:87-98.\u003c/li\u003e\n\u003cli\u003eAgrawal R, Imielinski T, Swami A N et al (1993) Mining asscoiation rules between sets of items inlarge database.International Conference on Management of Data, 22(2):207-216.\u003c/li\u003e\n\u003cli\u003eJans M, Depaire B, Vanhoof K (2011) Does Process Mining ADD to Internal Auditing？ An Experience Report.International Conference on Exploring Modeling Methods for Systems Analysis and Design, Springer Berlin Heidelberg,(81):31-45.\u003c/li\u003e\n\u003cli\u003evan der Aalst W M P, Adriansyah A (2012) Replaying History on Process Models for Conformance Checking and Performance Analysis.Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery.2(2):182-192.https://doi.org/10.1002/widm.1045\u003c/li\u003e\n\u003cli\u003eVan Zelst S J, Bolt A, Van Dongen B F (2017) Tuning Alignment Computation: An Experimental Evaluation. ATAED@ Petri Nets/ACSD, 1847: 6-20.\u003c/li\u003e\n\u003cli\u003eBloemen V, Van Zelst S, Van Der Aalst W M P et al (2022) Aligning observed and modelled behaviour by maximizing synchronous moves and using milestones. Information Systems, 103 : 101456.\u003c/li\u003e\n\u003cli\u003eChatain T, Boltenhagen M, Carmona J.(2021)Anti-alignments\u0026mdash;Measuring the precision of process models and event logs. Information Systems,98 : 101708.\u003c/li\u003e\n\u003cli\u003eCasas-Ramos J, Mucientes M, Lama M.(2024)REACH: Researching Efficient alignment-based conformance checking. Expert Systems with Applications, 41 : 122467. \u003c/li\u003e\n\u003cli\u003eAsare E, Wang L, Fang X (2020) Conformance Checking: Workflow of Hospitals and Workflow of Open-source EMRs. IEEE Access, 08:139546-139566..https://doi.org/10.1109/ACCESS.2020.3012147\u003c/li\u003e\n\u003cli\u003eJans M, Alles M G, Vasarhelyi M A (2014) A Field Study on the Use of Process Mining of Event Logs as an Analytical Procedure. The Accounting Review, 89(5):1751-1773. https://doi.org/10.2308/accr-50807\u003c/li\u003e\n\u003cli\u003eChiu T, Jans M (2019) Process Mining of Event Logs: A Case Study Evaluating Internal Control Effectiveness. Accounting Horizons, 33(3):141-156.\u003c/li\u003e\n\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"knowledge-and-information-systems","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"kais","sideBox":"Learn more about [Knowledge and Information Systems](http://link.springer.com/journal/10115)","snPcode":"10115","submissionUrl":"https://submission.nature.com/new-submission/10115/3","title":"Knowledge and Information Systems","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Information systems, Knowledge-Driven, Process mining, Business processes, Deviation detection, Risk assessment","lastPublishedDoi":"10.21203/rs.3.rs-8295347/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8295347/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Event logs of enterprise information systems capture rich knowledge regarding business process execution, yet extracting interpretable business semantics for compliance monitoring remains challenging. This study proposes a four-layer deviation analysis framework based on process mining. At its core lies a formalized knowledge base, which incorporates designed deviation mapping rules and classification algorithms to systematically transform abstract technical semantics into three explicit categories of business deviations—missing, out-of-order, and redundant—thereby generating deviation semantics that can be intuitively understood by business personnel. The knowledge-driven framework has been implemented as a plug-in for the ProM platform. Experiments on both synthetic and real-life logs, along with expert evaluations, demonstrate that the proposed method exhibits strong generalization capability and effective deviation detection performance in complex scenarios, significantly improving diagnostic efficiency. Furthermore, by establishing a correlation mapping between deviations and fraud risks, the study closes the audit loop from deviation identification to risk localization. This offers a knowledge-driven practical solution for compliance control and risk prevention in enterprise process management based on information systems.","manuscriptTitle":"A Knowledge-Driven Approach to Interpretable Compliance Deviation Analysis in Business Processes","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-01-20 16:22:21","doi":"10.21203/rs.3.rs-8295347/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"editorInvitedReview","content":"","date":"2026-03-26T15:12:25+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-03-23T08:15:28+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"85204451265104007958116996425359174578","date":"2026-03-10T13:26:39+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"118832227375562353226879612961949864028","date":"2026-02-26T09:18:45+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"30723293152515867879996548437500250855","date":"2026-02-23T06:56:34+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-01-16T04:17:01+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-12-26T12:01:38+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-12-10T11:59:28+00:00","index":"","fulltext":""},{"type":"submitted","content":"Knowledge and Information Systems","date":"2025-12-06T14:21:07+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"knowledge-and-information-systems","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"kais","sideBox":"Learn more about [Knowledge and Information Systems](http://link.springer.com/journal/10115)","snPcode":"10115","submissionUrl":"https://submission.nature.com/new-submission/10115/3","title":"Knowledge and Information Systems","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"68645f99-ee2c-471f-b0f4-0d69588f30bd","owner":[],"postedDate":"January 20th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-01-20T16:22:21+00:00","versionOfRecord":[],"versionCreatedAt":"2026-01-20 16:22:21","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8295347","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8295347","identity":"rs-8295347","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}