Process mining is the practice of reconstructing how a business or IT process actually behaves by analyzing system event logs — incident records, ERP transactions, ITSM tickets, workflow timestamps — rather than relying on how the process is documented. The technique reliably reveals that the documented process and the actual process diverge, with 10–20% of process volume typically running through paths that add no value.
What process mining does.
Every system that handles a business process generates events: a ticket is created, assigned, escalated, resolved; a purchase order is raised, approved, fulfilled, invoiced; a change request is submitted, reviewed, deployed. Each event has a timestamp, an actor, and a state. Process mining tools ingest these events, link them by case ID, and reconstruct the actual flow each case took through the process.
The output is a process map drawn from data — not from documentation, not from interviews, not from how anyone says the process works. The map shows every variant of the path, the frequency of each, the average duration of each step, and the rework loops.
What it typically reveals.
The documented process versus the actual process are reliably different. A process documented as a five-step incident-management workflow may, in the event log, involve 23 distinct paths, of which the documented one accounts for only 38% of cases. The other 62% — the long tail of variants — is where the work to investigate sits.
Common findings:
- Rework loops. Cases that go back to a previous step. Often signal a quality or training problem upstream.
- Manual workarounds. Process variants that exist because the standard path doesn't handle a real-world case the documented process pretends doesn't exist.
- Approval cycles. Cases held for approval by people who, on inspection, are not actually adding judgement to the decision.
- Duplicate work. The same activity being performed in two systems by two teams, neither aware of the other.
- Bottlenecks. The step that consistently takes 5x the average. Usually a specific person, a specific system, or a specific approval gate.
Where it's useful.
- Operational efficiency. Identifying the 10–20% of process volume that doesn't add value. The starting point for most efficiency programs.
- Automation candidate selection. Process mining identifies which processes are stable enough, standardized enough, and high-volume enough to be worth automating.
- Compliance auditing. Detecting cases that bypassed controls, approvals that weren't recorded, segregation-of-duties violations.
- Vendor performance verification. Reconciling vendor-reported SLAs against actual ticket-level event data. The most common gap we find in outsourcing arrangements.
- Process harmonization. Comparing how the same process runs in different geographies or business units. Often reveals that "the global standard" is theory rather than practice.
Tools and capability.
The dedicated process-mining platforms — Celonis is the category leader, alongside Signavio (now SAP), UiPath Process Mining, Software AG ARIS, and several others — handle large event-log volumes and produce sophisticated visualizations. For smaller-scale work, modern data tooling (dbt, Python pandas, BI platforms) can produce meaningful process-mining analysis without specialized software.
The interesting capability in 2026 is not the tool but the analyst skill: someone who understands the business process, knows what to look for in the variants, and can translate process-mining findings into actionable changes. The tool produces the map; the analyst produces the insight.
Common pitfalls.
- Bad data. Process mining is only as good as the event log. Missing timestamps, inconsistent case IDs, unsynchronized system clocks — all produce maps that look authoritative but are wrong.
- Tool-led rather than question-led. "We have Celonis, what should we do with it" is the wrong starting point. "We need to know why P1 incident resolution time has drifted" is the right one.
- Mistaking variation for waste. Some process variation is legitimate. The analyst's job is to distinguish necessary variation from accidental complexity.
FAQ.
What is process mining?
The practice of reconstructing actual process behaviour from system event logs, rather than from documented process maps or interviews.
What does process mining typically find?
That the documented process and the actual process are reliably different. Typical findings: 10–20% of process volume runs through paths that add no value (rework loops, unnecessary approvals, manual workarounds, duplicate work).
What tools are used for process mining?
Dedicated platforms include Celonis (category leader), Signavio (SAP), UiPath Process Mining, and Software AG ARIS. For smaller-scale analysis, modern data tooling can produce meaningful results without specialized software.
