Process Diagnostics: a Method Based on Process Mining Melike Bozkaya, Joost Gabriels, Jan Martijn van der Werf LaQuSo, Laboratory for Quality Software, an activity of Technische Universiteit Eindhoven and Radboud Universiteit Nijmegen, P.O. Box 513, 5600 MB Eindhoven, The Netherlands Email: {m.bozkaya, j.gabriels, j.m.v.d.werf}@laquso.com Abstract—As organizations change, their information systems can evolve from simple systems to complex systems, which are hard to understand, and therefore hard to maintain or extend. Process mining can help organizations in trying to understand the information systems by analyzing the system. In this paper we propose a methodology to perform process diagnostics, based on process mining. Given an event log of an information system within an organization, process diagnostics gives a broad overview of the organization’s process(es) within a short period of time. In the process diagnostics methodology, several perspectives of the process are highlighted. The outcome covers the control flow perspective, the performance perspective and the organizational perspective. We used the methodology on a case study for a Dutch governmental organization. Index Terms—process management, process mining, informa- tion system design, process analysis, methodology I. I NTRODUCTION Today, information systems are indispensable within or- ganizations. As organizations change, these systems evolve from simple systems that were easy to understand to complex systems that are hard to understand, and hence difficult to maintain. This raises the question whether the system is work- ing the way the organization thinks it works. This question typically occurs in case the information system has some flaws, like performance problems. More important, for organizations to be in control, they need to ensure that the system is working according to their specification. Information systems supporting business processes typically record all events in a log. Such a log, called an event log or audit trail, contains information about the events: for which activity and process instance, referred to as case, it is executed, by whom and at what time. An activity can have multiple events. All events for a case form a sequence, which is called the trail or the run of that case, and shows what events happened in what order and at what time. Process mining allows these event logs to be analyzed. Process mining looks “inside the process” to answer questions like: “how does the actual process look like?”, “are the executed logs con- form specification, i.e. follow all cases the specified process model?”, “are there any bottlenecks in the process?”, “who executes what tasks?”, “who typically work together?”, etc. The field of process mining covers many areas, like per- formance characteristics (e.g. throughput times) [1], process discovery (discovery of the control flow) [2], [3], [4], process conformance (is the event log conform specification) [5], [6], and social networks (e.g. cooperation or subcontracting) [7], [8]. Answers on these questions can serve as a handle for organizations to answer two of the main questions: “are we in control?”, and “does the information system really reflect the state of affairs of the business process?”. One of the tools to support process mining is the process mining framework ProM [9]. It is plugin-based to support new areas and techniques. In the last decade, process mining evolved from control flow discovery to a broad area of research to get all kinds of information from a log, which resulted in more than 250 different plugins within ProM. This shows that many different techniques exist to apply process mining. Since there are so many, it is not clear anymore when to use which plugin. Although many case studies, see e.g. [10], [11], have been performed, the main problem with these case studies is that they were all done case-by-case on the insights and knowledge of the researcher performing the case study. Up- to-now, there is no methodology to tackle a new case study, i.e. it is hard to make process mining a repeatable service. In this paper we propose a methodology to make a diagnos- tics of a process based on process mining. The methodology is designed to deliver within a short period of time a broad overview of the process(es) within the information system. Key in this methodology is the absence of prior and domain specific knowledge. The only information available is the event log. This also implies that the diagnostics only presents facts about the process. It is up to the organization to interpret the outcome of the diagnostics. We illustrate the methodology with a case study performed for a Dutch governmental organization. This paper is organized as follows: first we explain the methodology in Section II. In Section III, we present a case study in which we applied the methodology. We conclude this paper in Section IV. II. THE PROCESS DIAGNOSTICS METHOD We present a methodology for quick process diagnostics. The methodology aims at giving a broad overview of the process in the information system within a short period of time. It consists of five phases: (1) log preparation, in which the event log of the information system is extracted, (2) log inspection, to get a first glance of the process, (3) control flow analysis, (4) performance analysis and (5) role analysis, i.e. the