Process mining of event logs in internal auditing: a case study

Abstract

In this paper we explore the value that the techniques of process mining can provide to internal auditors by conducting a case study of the procurement process at a major European financial services provider. Jans et al. (2010) argued that process mining has the potential to increase the effectiveness and scope of internal auditing by enabling auditors to extract knowledge from event logs recorded by a business’s information system. They argued that what makes an event log potentially such a unique and potentially invaluable resource for auditing is not only that it provides the auditor with more data to analyze, but also because that additional data is recorded automatically and independently of the person whose behavior is the subject of the audit. In this paper we examine procurement data that has already been audited by internal auditors in order to test whether process mining can identify audit relevant transactions over and above those recognized by existing auditing techniques. We find that the various process mining tasks we utilize do discover internal control failures that the business’s own internal auditors failed to do