Process mining is useful for internal audit only when it becomes evidence, not just a diagram. The audit file should show the population, event log, rule logic, false-positive review, source documents, owner response and conclusion behind every reported exception.
Download the Excel/PDF pack for event-log readiness, cycle analytics use cases, exception review, RCM handoff, dashboard routing and future Internal Audit product fields.
Unique transaction or document reference that ties the process step back to source evidence.
Standardised step such as PO created, GRN posted, invoice booked, payment approved or payment released.
System date/time for the activity. Date-only extracts are useful, but weak for sequence and rework testing.
User ID, role or owner who performed the step. Needed for segregation, override and leaver-access checks.
The process instance, such as PO number, invoice number, sales order, journal batch, employee ID or ticket ID.
Financial value or operational quantity used for materiality, exception thresholds and impact sizing.
Approved, rejected, cancelled, reversed, blocked, matched, paid, shipped, closed or reopened.
Vendor, customer, employee, item, bank account, cost centre, profit centre, location and GSTIN.
Analytics test: Trace PR -> PO -> GRN -> invoice -> payment sequence. Flag invoice-before-GRN, non-PO invoices, duplicate invoice keys, payment-before-approval and vendor-bank changes near payment.
Evidence: PO history, GRN register, invoice register, payment run, vendor master change log and approval workflow.
Open cycle checklistAnalytics test: Trace order -> dispatch -> invoice -> collection. Flag dispatch without invoice, invoice without dispatch, credit limit override, credit note spikes and long unapplied receipts.
Evidence: Sales order dump, dispatch register, invoice register, credit limit master, receipt register and credit note approval.
Open cycle checklistAnalytics test: Trace journal creation, approval, posting, reversal and period close. Flag post-close entries, repeated reopenings, same-user maker-checker, blank narration and unusual reversal timing.
Evidence: GL journal dump, close calendar, approval logs, period status history, reconciliations and adjustment register.
Open cycle checklistAnalytics test: Trace hire -> payroll master -> attendance -> payroll run -> bank file -> exit. Flag leaver paid after exit, duplicate bank accounts, late master changes and active access after exit.
Evidence: HRMS employee master, attendance dump, payroll register, bank upload, exit list, F&F register and access report.
Open cycle checklistAnalytics test: Trace GRN -> QC -> putaway -> issue -> transfer -> adjustment -> count. Flag negative stock, backdated movements, transfer ageing, repeated manual adjustments and count variance clusters.
Evidence: Stock ledger, GRN, QC log, issue slips, transfer register, adjustment approvals, cycle-count sheets and ageing report.
Open cycle checklistAnalytics test: Trace access request -> approval -> provisioning -> review -> removal. Flag leaver access, privileged access without ticket, emergency access not reviewed and failed interface jobs.
Evidence: User listing, role matrix, access tickets, HR leaver list, privileged activity logs, interface logs and backup status.
Open cycle checklistStart from risk and control objective, not from a colourful process map.
Define period, entity, source system, filters, excluded documents and reconciliation to control totals.
Prepare case ID, activity, timestamp, actor, amount, status and master-data fields.
Compare actual process sequence with approved workflow, delegation matrix and RCM expectations.
Document exclusions, system limitations, timing differences and business-approved deviations.
Each validated exception needs source evidence, owner explanation, conclusion, rating and report decision.
Recurring exceptions become monitoring rules and audit committee dashboard metrics only after review.
If posting date, document date and approval timestamp are mixed, the process sequence can be misleading.
Analytics output is weak until the source extract ties to ledger, sub-ledger or operational control totals.
A bypass may be approved emergency processing. A rework loop may be normal correction. Exceptions need process-owner validation.
A process-mining exception is not automatically an internal audit observation. The auditor still concludes.
If access, change management or interface controls are weak, the reliability of event logs and workflow evidence may also be weak.
This is a public website resource. The reusable layer for the separate Internal Audit product build is the event-log schema, cycle use-case register, exception validation workflow, RCM link, false-positive disposition and dashboard handoff model.
Process mining in internal audit uses system event logs to reconstruct how transactions actually moved through a process, then compares that path with the approved workflow, RCM and control expectations. It helps identify bypasses, rework, delays, segregation issues and unusual variants.
No. Process mining explains the actual process path and variants. Continuous monitoring runs repeatable exception rules on refreshed data. A mature team often uses process mining to design better monitoring rules.
It can support full-population testing for selected attributes, but it does not replace auditor judgement. The auditor still needs to validate source data, clear false positives, inspect evidence and conclude whether exceptions are reportable.
P2P, O2C, R2R, payroll/H2R, inventory, treasury and ITGC are good candidates because they usually generate structured timestamps, workflow statuses, user IDs and document references.
