Keep an eye on compliance with process mining

Why bother with process compliance?

Focusing on process compliance is essential to the long-term success of any business. Not only does it help you avoid legal and contractual sanctions—especially in highly regulated industries such as banking, medical, or pharmaceutical. It also helps you meet customer demands, as failure to meet customer expectations can result in customer loss. Implementing process compliance can also improve the efficiency and consistency of your operations. By following standardized processes, you can reduce errors, rework, and delays, ultimately saving time and resources. This can lead to increased productivity, lower costs, and higher quality end products or services.

How do you ensure process compliance?

There are three strategies that you can implement to ensure process compliance:

1. Compliance by design
   Map your processes and use these blueprints for optimization, standardization and certification purposes. Process blueprints can be used not only for implementation, but also for introducing process knowledge and procedural instructions in your company so that all employees know how to operate. Documenting your processes provides a vital foundation for ensuring process compliance, but it should not stop there. It's essential to monitor process execution continuously.
2. Regular compliance audits
   Based on the analysis of a sample of executed processes, auditors verify and certify your process compliance. This periodic compliance analysis ensures that your defined processes are adhered to and enables reactive actions in the event of deviations. However, this approach is applied only sporadically, e.g. once a quarter. Using only snapshots during a certain period does not guarantee continuous adherence to the processes, and does not enable timely countermeasures if anything becomes noncompliant. It is not uncommon for actual compliance to rise shortly before the start of an audit and then drop significantly again after it is done.
3. Compliance at runtime
   Since the execution of a process can vary from case to case, analyzing realistic system data is the only way to achieve an effective and targeted compliance strategy. Only continuous monitoring of compliance immediately after processes are executed, or even during runtime, allows you to ensure continuous process compliance, quickly identify vulnerabilities, and take proactive action to improve compliance. Process conformance checking powered by ARIS Process Mining guarantees such a continuous and fact-based analysis.
   
   In everyday personal life, individuals are constantly observing and complying (or not) with external regulations, personal policies, and social norms. In business, compliance is even more critical, especially in highly regulated industries. The business reality is complex, with numerous variations in the execution of day-to-day operations, even for standardized business processes. Ensuring that your organization meets all business obligations and maintains consistent risk and compliance management requires vigilance to avoid penalties or even jail time. 
   
   To ensure compliance, organizations should establish a structured business architecture with defined processes, rules, risks, and controls. This setup enables seamless knowledge sharing across the workforce, facilitates efficient onboarding for new employees and provides necessary guidance for temporary replacements. The framework acts as a blueprint for implementing and adapting applications like ERP systems while supporting the integration of new technology such as robots in RPA projects.

How do you ensure compliance? By designing your business architecture in a structured way, defining reference processes, business and decision rules, potential business risks and associated mitigation controls. That way your entire workforce can then easily access and benefit from this knowledge pool: new employees can be quickly onboarded, vacation replacements will have all required instructions at their fingertips, and even experienced employees can benefit by sharing their best practices with other senior colleagues.

The framework will serve as a blueprint for the technical implementation and continuous adaptation of your applications, such as ERP systems. It also helps you onboard new robots within your recently launched RPA initiative.

We understand the critical nature of ensuring compliance within your organization to meet all business obligations and maintain consistent compliance management. However, there is a potential risk that individuals or systems may stray from proper business processes.

How do you ensure that people and systems do not deviate from the norm and take unnecessary risks as new regulations continue to emerge? The trick is in using process mining, the indispensable building block in your compliance management strategy. With process mining, you can contrast your annual or quarterly audits, looking only at a sample of executed processes. Process mining in fact enables digitalization of highly manual audits.

This promises many benefits: 

• Early Detection of Compliance Risks: Process mining can uncover potential compliance issues before they escalate into significant problems, allowing organizations to implement corrective actions to reduce risks.
• Enhanced Audit Efficiency: Process mining provides concrete data to support audit findings, identifying high-risk areas, making audit efforts more efficient. Process mining can also help pinpoint the root causes of compliance issues, accelerating resolution.
• Stronger Evidence of Compliance: Process mining generates concrete evidence of compliance adherence, reducing the risk of penalties and legal issues.
• Continuous Improvement: Process improvements can be aligned with compliance requirements, enhancing overall performance.

Process mining provides the dual benefit of conducting both conformance and compliance analyses. This ensures that procedures are followed accurately and identifies any discrepancies between the expected and actual processes. Leveraging process mining for compliance not only validates adherence to regulations but also improves operational efficiency and reduces costs for organizations..

Here’s an example

Let’s take a “Purchase-to-Pay” process as an example. This is a series of steps that organizations follow to acquire goods or services from suppliers while ensuring proper compliance.

Steps in a Purchase-to-Pay process:

1. Identify need and requisition: There is a need for a product or service in a department. They fill in a document in which all details of what is needed are included as a formal requisition.
2. Formal requisition approval: The formal requisition is approved by the person responsible in the department and received and approved by the Purchase department.
3. Purchase order creation: Once the purchase department verifies that they have received all the required information, the purchase order is generated and sent to the selected supplier.
4. Goods receipt: Goods are received.
5. Invoice: after goods reception or along with them, supplier sent an invoice.
6. Payment: Once it is verified that all goods have been received according to the order, the purchasing department proceeds to payment.

This structured Purchase-to-Pay process helps organizations streamline their procurement activities, control costs, maintain compliance, and ensure efficient supplier relationships. Additionally, it provides a clear audit trail for financial and regulatory purposes.

However, there are times when meticulously planned processes go awry, leading to what is commonly known as “Maverick buying”, also called invisible or wild buying. This term is used to describe situations where acquisitions occur outside of the company's established procurement procedures. These purchases often bypass involvement from the purchasing department and neglect to follow the requisite steps, resulting in a lack of adherence to any conformance or compliance checks.

Here are some examples of non-compliance and non-conformance checks in the Purchase-to-pay process:

1. Non-compliance:
   • When a purchase requisition lacks approval from the authorized personnel.
   • When items are ordered that exceed the assigned budget.
   • When a purchase order is directed to an unapproved vendor.
   
   In all these cases we missed one of the steps or rules in the process.
   
2. Non-conformance:
   • When creating incomplete purchase requisitions or purchase orders.
   • When failing to verify that received goods align with the order.
   • When neglecting to maintain a comprehensive record of all documents for the audit trail.
   
   In all these cases there is a lack of control.

Effective compliance and conformance checks help organizations maintain control over their procurement activities, reduce risks, and increase cost control. 

In addition to a black-and-white classification of your executed processes, ARIS Process Mining SaaS also calculates the fitness value of your processes.

This metric illustrates on a scale from 0 to 100 how closely your processes follow the reference. This far more fine-grained picture allows you to understand all the nuances of the state of your business processes and assess the impact on your process compliance. With this visual representation, you can gauge not only whether your processes are compliant but also how close they are to the ideal 100 benchmark.

1. “Are our people adapting their way of working to the process changes that have been made and rolled out globally? Are there specific locations where additional training on the changes is needed?”

As the leading tool for Process Intelligence, the ARIS Suite enables you to adapt your business processes, ensure a controlled release cycle of your changes by the responsible process owners and roll out the adapted processes globally to the entire workforce with the appropriate representations. Our confirmation management also ensures that all employees affected by process changes can confirm they have read and understood the changes to ensure they can act in compliance.

But that’s not all—ARIS Process Mining can also make the actual adoption rate visible and allows you to analyze it from different perspectives. In this way, you can identify weaknesses, such as certain regions having difficulty adapting to the changes made by a newly introduced application system. Based on these findings, you can take appropriate action directly within ARIS. For example, you can trigger training initiatives to enable your employees to perform adopted processes correctly. Our tight integration with the leading training authoring tool, SAP^® Enable Now, also ensures that the right training materials are created to meet business requirements.

2. “We implemented our business logic into the new SAP^® S/4HANA system according to the process blueprint. How can we ensure that the application is running as it should and validate the deployment?”

ARIS Process Mining not only covers the human, but also the technical side, of process conformity. The main difference from checking the previously discussed process adoption rate is that the success of a system rollout (and thus of a process rollout) is measured. This enables you to identify potential instability in newly implemented or revised application systems in the early stages of your implementation project. Completely new system implementations, as well as upgrades and consolidations (re-implementation of a process) of existing systems, can be examined. Essentially it is about validating that the system behaves as desired and supports the right way of working according to the process blueprint and other functional requirements.

ARIS offers extensive options for designing your process blueprint, synchronizing it directly with SAP Solution Manager for implementation, or exporting it as a BPMN file. Thanks to our first-class BPMN compatibility, ARIS offers extensive implementation scenarios. With ARIS, you can analyze and validate your system implementation and identify problems.

Incorrect or incomplete configurations, user workarounds or misinterpreted requirements can cause, which even your blueprint may not have represented for the desired implementation. Hence, you can test the effectiveness of the implementation as quickly as possible after a rollout and immediately incorporate the results into the global template when you move to the next region or country implementation. This will accelerate the implementation process and increase the success rate, which will have a positive impact on time and budget constraints.

3. “How does the process documentation reflect reality? What changes do we need to make to improve model quality?”

ARIS Process Mining lays the foundation—it shows all deviations in your process execution from your documented processes. Based on these identified compliance issues, you can decide whether it is an actual incident that needs to be addressed from an organizational or technical point of view, or whether it is a valid way of working that is not yet covered in the process documentation. This could also be a workaround established by a specific department or region you want to incorporate as a global standard in your process template. With ARIS smart modeling capabilities, adapting your process design is easier than ever. Changed processes can be seamlessly approved in ARIS and rolled out across your organization. The colleagues responsible for the affected processes will clearly see the deviations from the previous version through our latest model comparison capabilities that show and explain all changes.

1. Import your process repository from ARIS to check compliance or if you don't have process models, simply discover them, thanks to the process discovery feature in ARIS Process Mining.
2. Identify process inefficiencies and compliance issues by tracking adoption rates and overall process compliance.
3. Improve your process documentation by identifying missing functions and additional process variants.