Keep an eye on compliance with process mining

Why bother with process compliance?

To be successful in the marketplace, you must comply with legal and economic regulations, and meet your customers’ requirements. Non-compliance with regulations or requirements can lead to legal and contractual sanctions, especially in highly regulated industries such as banking, medicine, or pharmaceuticals. Moreover, failing to meet customer expectations can damage client relationships and result in customer loss. Therefore, it is important to ensure that each of your process executions complies with your defined business processes and work procedures.

How do you ensure process compliance?

There are three strategies that you can implement to ensure process compliance:

1. Compliance by design

Map your processes and use these blueprints for optimization, standardization and certification purposes. Process blueprints can be used not only for implementation, but also for introducing process knowledge and procedural instructions in your company so that all employees know how to operate. Documenting your processes is a vital foundation for ensuring process compliance, but it should not stop there. It's essential to monitor process execution continuously.

2. Regular compliance audits
   Based on the analysis of a sample of executed processes, auditors verify and certify your process compliance. This periodic compliance analysis ensures that your defined processes are adhered to and enables reactive actions in the event of deviations. However, this approach is applied only sporadically, e.g. once a quarter. Using only snapshots during a certain period does not guarantee continuous adherence to the processes, and does not enable timely countermeasures if anything becomes noncompliant. It is not uncommon for actual compliance to rise shortly before the start of an audit and then drop significantly again after it is done.
3. Compliance at runtime
   Since the execution of a process can vary from case to case, analyzing realistic system data is the only way to achieve an effective and targeted compliance strategy. Only continuous monitoring of compliance immediately after processes are executed, or even during runtime, allows you to ensure continuous process compliance, quickly identify vulnerabilities, and take proactive action to improve compliance. Process conformance checking powered by ARIS Process Mining guarantees such a continuous and fact-based analysis.
   
   In daily personal life, individuals continually observe and comply (or not) with external regulations, personal guidelines, and social standards. In business, compliance is even more critical, especially in highly regulated industries. Business reality is complex, with numerous execution variations in daily operations, even for standardized business processes. Ensuring your organization meets all business obligations and maintains consistent risk and compliance management requires vigilance to avoid penalties or even jail time.

How do you ensure compliance? By designing your business architecture in a structured way, defining reference processes, business and decision rules, potential business risks and associated mitigation controls. That way your entire workforce can then easily access and benefit from this knowledge pool: new employees can be quickly onboarded, vacation replacements will have all required instructions at their fingertips, and even experienced employees can benefit by sharing their best practices with other senior colleagues.

The framework will serve as a blueprint for the technical implementation and continuous adaptation of your applications, such as ERP systems. It also helps you onboard new robots within your recently launched RPA initiative.

Yet there is a risk that people or systems may deviate from the way business processes should be carried out. It is essential to ensure that your organization continuously meets all business obligations, consistent compliance management.

How do you ensure this? The trick is in using process mining, the indispensable building block in your compliance management strategy. With process mining, you can contrast your annual or quarterly audits, looking only at a sample of executed processes. Process mining in fact enables digitalization of highly manual audits.

This promises many benefits: 

• Efficient and continuous audit through process automation
• Effective audit as all cases can be inspected
• Trace issues back to process behavior and corresponding patterns
• Rapid feedback cycle on compliance design
• Intervention when compliance issues occur

The key benefit is in how process mining performs both conformance and compliance analyses. This is crucial given the difference between both: conformance checks determine how procedures are followed, identifying gaps between “to be” (what it should be) and what actually “is.”

Whereas compliance checks determine if what actually “is” follows “to be.” As a result, process mining validates how processes are followed and whether they’re followed according to company policy and regulations.

Here’s an example

Let’s take a “Purchase-to-Pay” process as an example. This is a series of steps that organizations follow to acquire goods or services from suppliers while ensuring proper compliance.

Steps in a Purchase-to-Pay process:

1. Identify need and requisition: There is a need for a product or service in a department. They fill in a document in which all details of what is needed are included as a formal requisition.
2. Formal requisition approval: The formal requisition is approved by the person responsible in the department and received and approved by the Purchase department.
3. Purchase order creation: Once the purchase department verifies that they have received all the required information, the purchase order is generated and sent to the selected supplier.
4. Goods receipt: Goods are received.
5. Invoice: after goods reception or along with them, supplier sent an invoice.
6. Payment: Once it is verified that all goods have been received according to the order, the purchasing department proceeds to payment.

This structured Purchase-to-Pay process helps organizations streamline their procurement activities, control costs, maintain compliance, and ensure efficient supplier relationships. Additionally, it provides a clear audit trail for financial and regulatory purposes.

However, there are times when meticulously planned processes go awry, leading to what is commonly known as “Maverick buying”, also called invisible or wild buying. This term is used to describe situations where acquisitions occur outside of the company's established procurement procedures. These purchases often bypass involvement from the purchasing department and neglect to follow the requisite steps, resulting in a lack of adherence to any conformance or compliance checks.

Here are some examples of non-compliance and non-conformance checks in the Purchase-to-pay process:

1. Non-compliance:
   • When a purchase requisition lacks approval from the authorized personnel.
   • When items are ordered that exceed the assigned budget.
   • When a purchase order is directed to an unapproved vendor.
   
   In all these cases we missed one of the steps or rules in the process.
   
2. Non-conformance:
   • When creating incomplete purchase requisitions or purchase orders.
   • When failing to verify that received goods align with the order.
   • When neglecting to maintain a comprehensive record of all documents for the audit trail.
   
   In all these cases there is a lack of control.

Effective compliance and conformance checks help organizations maintain control over their procurement activities, reduce risks, and increase cost control. 

Keep an eye on compliance with ARIS Process Mining

ARIS Process Mining SaaS Enterprise edition automatically evaluates your process conformance based on BPMN models, serving as reference processes. You also can analyze impact of deviations from your standardized process on KPIs, such as process cycle time.

In addition to a black-and-white classification of your executed processes, ARIS Process Mining SaaS also calculates the fitness value of your processes.

This metric illustrates on a scale from 0 to 100 how closely your processes follow the reference. This far more fine-grained picture allows you to understand all the nuances of the state of your business processes and assess the impact on your process compliance.

“Do our employees adapt their way of working to the process changes made and rolled out worldwide? Are there any specific locations where additional training on the changes is required?”

As the leading tool for process design and analysis, ARIS enables you to adapt your business processes, ensure a controlled release cycle of your changes by the responsible process owners and roll out the adapted processes globally to the entire workforce with the appropriate representations. Our confirmation management also ensures that all employees affected by process changes can confirm they have read and understood the changes to ensure they can act in compliance.

But that’s not all—ARIS Process Mining can also make the actual adoption rate visible and allows you to analyze it from different perspectives. In this way, you can identify weaknesses, such as certain regions having difficulty adapting to the changes made by a newly introduced application system. Based on these findings, you can take appropriate action directly within ARIS. For example, you can trigger training initiatives to enable your employees to perform adapted processes correctly. Our tight integration with the leading training authoring tool, SAP^® Enable Now, also ensures that the right training materials are created to meet business requirements.

“We implemented our business logic into the new SAP^® S/4HANA system according to the process blueprint. How can we ensure that the application is running as it should and validate the deployment?”

ARIS Process Mining not only covers the human, but also the technical side, of process conformity. The main difference of checking the previously discussed process adoption rate is that the success of a system rollout (and thus of a process rollout) is measured. This enables you to identify potential instability in newly implemented or revised application systems in the early stages of your implementation project. Completely new system implementations, as well as upgrades and consolidations (re-implementation of a process) of existing systems, can be examined. Essentially it is about validating that the system behaves as desired and supports the right way of working according to the process blueprint and other functional requirements.

ARIS offers you extensive options for designing your process blueprint, synchronizing it directly with SAP Solution Manager for implementation, or for exporting it as a BPMN file. Thanks to our first-class BPMN compatibility, ARIS offers you extensive implementation scenarios. With ARIS, you can analyze and validate your system implementation and identify problems, incorrect or incomplete configurations, user workarounds or misinterpreted requirements can cause, which even your blueprint may not have represented for the desired implementation. Hence you can test the effectiveness of the implementation as quickly as possible after a rollout and immediately incorporate the results into the global template when you move to the next region or country implementation. This will accelerate the implementation process and increase the success rate, which will have a positive impact on time and budget constraints.

“How does the process documentation reflect reality? What changes do we need to make to improve model quality?”

ARIS Process Mining lays the foundation—it shows all deviations in your process execution from your documented processes. Based on these identified compliance issues, you can decide whether it is an actual incident that needs to be addressed from an organizational or technical point of view, or whether it is a valid way of working that is not yet covered in the process documentation. This could also be a workaround established by a specific department or region you want to incorporate as a global standard in your process template. With ARIS smart modeling capabilities, adapting your process design is easier than ever. Changed processes can be seamlessly approved in ARIS and rolled out across your organization. The colleagues responsible for the affected processes will clearly see the deviations from the previous version through our latest model comparison capabilities that show and explain all changes.

1. Import your process repository from ARIS to check compliance or if you don't have process models, simply discover them, thanks to the process discovery feature in ARIS Process Mining.
2. Identify process inefficiencies and compliance issues by tracking adoption rates and overall process compliance.
3. Improve your process documentation by identifying missing functions and additional process variants.

Watch the "Are we on process?" webinar right here.