---
title: "Process mining: event data, discovery and action"
description: "Process mining reconstructs how work actually flows from timestamped system events, revealing variants, delays, rework and control gaps."
canonical: "https://zephior.com/glossary/process-mining"
last-updated: 2026-07-28
---

# Process mining: event data, discovery and action

> Process mining reconstructs how work actually flows from timestamped system events, revealing variants, delays, rework and control gaps.

By [George Manolas](https://zephior.com/authors/george-manolas). Published 2026-07-28; updated 2026-07-28. 5 minute read.

## Definition

Process mining is a family of techniques that uses event data from operational systems to reconstruct, analyse and compare process execution. A usable event log normally links each event to a case, activity and timestamp, with attributes for deeper analysis.

## Problem

The documented process is rarely the process people execute. Yet event data is not neutral truth either: systems record some actions, omit offline work and use timestamps or identifiers inconsistently. A visually impressive process map can therefore amplify extraction defects or invite simplistic conclusions about people and performance.

## Point of view

Process mining should connect data lineage to operational inquiry. Validate the case and event model, interpret variants with process owners and frontline staff, quantify causes and consequences, then test a specific intervention rather than automating the dominant diagram.

## Case, activity and time define the process view

The case identifier groups events belonging to the same process instance, such as an order, claim or request. Activity names describe meaningful state changes. Timestamps order them and allow duration analysis. Attributes add amount, product, location, team or outcome.

Modelling choices change the picture. One customer request may create several orders; one order may contain several lines. An event can be logged when a user opens a screen, saves a record or a batch job completes. Document these semantics and test them before interpreting a bottleneck.

| Element | Purpose | Validation question |
| --- | --- | --- |
| Case ID | Group one process instance | Can events from different cases join? |
| Activity | Represent a meaningful step | Is naming consistent across systems? |
| Timestamp | Order and measure events | What moment does it record? |
| Attributes | Segment and explain variation | Are definitions stable and permitted? |
| Outcome | Connect path to value | Does it reflect the business result? |

## A process map is evidence for a conversation, not the answer

A dense diagram can show that many variants exist but not why. Interview the people who perform and receive the work, inspect sampled cases and distinguish policy, system constraints, data defects and genuine customer variation. Quantify the volume and outcome of each cause.

Select interventions by expected value and controllability. A data-quality fix may remove more rework than an AI layer. A clearer approval threshold may outperform a new bot. Process mining is valuable when it closes the loop from observed event to tested change.

- Start with one operational question.
- Validate event semantics with source records.
- Segment variants before judging them.
- Combine data with practitioner context.
- Re-mine after intervention to verify effect.

## Workflow

1. **Frame the operational question.** Choose a measurable issue such as late approval, duplicate handling, rework or missed service level. Define process boundaries, case start and end, relevant populations and outcome metrics. Avoid beginning with a request to mine everything.
2. **Build and validate the event log.** Map source systems, case identifiers, activities, timestamps and attributes. Test uniqueness, ordering, timezone, missing events and joins. Trace sampled cases back to source records and compare them with how practitioners describe the work.
3. **Analyse variants and causes.** Discover common and exceptional paths, cycle times, queues, rework and handoffs. Segment by product, customer, channel, team or risk where appropriate. Use conformance analysis against a justified reference model without assuming every deviation is bad.
4. **Intervene and measure.** Prioritize a cause the organisation can change. Redesign, clarify policy, improve data or automate a bounded step. Pilot with an owner and countermeasure, then compare cycle, quality, load and unintended effects. Refresh the model to verify that behavior actually changed.

## Key decisions

- What business question and outcome does the analysis support?
- What constitutes one case across the source systems?
- Which timestamps reflect real work, queue time or batch updates?
- Is a variant a justified exception, preference or control defect?
- Which intervention addresses the cause rather than the visible symptom?

## Risks

- Incorrect case joins create paths that no real transaction followed.
- Missing manual work makes automation potential look larger than it is.
- System timestamps may represent entry time rather than activity time.
- Variant counts can be used to judge staff without context or fairness controls.
- Automating the most frequent path can strand important exceptions.

## Metrics

- event coverage and trace-to-source accuracy
- cycle and waiting time by variant
- rework, loop and handoff frequency
- conformance deviation by justified cause
- intervention effect on quality, time and cost
- new exceptions and unintended displacement

## Frequently asked questions

### What is process mining?

Process mining uses timestamped events from operational systems to reconstruct and analyse how cases actually move through activities, including delays, variants, rework and conformance.

### What data is needed for process mining?

At minimum, events need a case identifier, activity and timestamp. Attributes such as team, amount, product and outcome enable segmentation, provided definitions and permissions are controlled.

### Is process mining the same as task mining?

Process mining usually analyses events across business systems and cases. Task mining captures detailed user interactions on desktops. They can complement each other but have different data, privacy and scope.

### Does process mining identify what to automate?

It provides evidence about volume, repetition, waits and variants. A separate decision must assess root cause, exceptions, integration, risk, capacity and whether redesign or data improvement is better than automation.


## Primary sources

- [IEEE Task Force on Process Mining](https://www.tf-pm.org/), IEEE Task Force on Process Mining
- [Business Process Model and Notation Version 2.0.2](https://www.omg.org/spec/BPMN/2.0.2/), Object Management Group