This document discusses techniques for identifying and addressing deviant business processes. It defines deviance as processes that violate compliance rules, service level objectives, or cost targets. The document recommends a two-pronged approach of deviance mining and predictive monitoring. Deviance mining involves analyzing process event logs to discover patterns that distinguish normal and deviant cases, in order to explain the causes of deviance. Predictive monitoring uses the patterns to predict future deviance and generate alerts. Several case studies are described where organizations successfully applied these techniques to problems like late deliveries, faulty products, and software issues. The key takeaway is that organizations should quantify, analyze, monitor, and predict deviance to preempt problems in their business processes.

1. Doctor, my business
processes are deviant!
What should I do about it?
Marlon Dumas
University of Tartu, Estonia
European BPM Roundtable, Liechtenstein, May 2014
1

2. DEVIANT? LIKE WHAT?
2

3. Deviant like…
• Violation of compliance rules
– Purchases without required quotes
– Delivery without Purchase Order (PO)
– Invoice issued before PO
• Violations of SLA objectives
– High defect rates (e.g. customer complains)
– High number of missed deadlines
• Deviations w.r.t. cost targets
– Cases taking abnormally more effort to handle
– Cases requiring abnormal amounts of re-work
3

4. HAVEN’T YOU STANDARDIZED?
Don‟t you have process models?
Don‟t you communicate your processes in your company?
Don‟t you have guidelines and instructions for process workers?
Haven‟t you automated your processes?
Don‟t you monitor your processes?
4

5. DIAGNOSIS:
ACUTE DEVIANCE SYNDROME
Fact sheet
• Endemic: present in 99% of the process population
• Most process owners don‟t know it
• Many opt to ignore it
• Very few treat it
• Nobody has ever been cured…
• But we can put it in remission
5

6. Two-pronged therapy
Detect and explain Predict to prevent
Deviance Mining Predictive Monitoring 6

7. Deviance Mining and Predictive
Monitoring
7

8. Something should have “normally” happened but
did not happen, why?
Something should normally not have happened
but it happened, why?
What increases the chances that things go “well”
(normal)?
What increases the chances that things go
“wrong” (deviant)?
Deviance Mining
8

9. 1. Frame the Problem
• Define deviance (“normal” cases vs. “deviant” cases)
• Quantify deviance and its impact
2. Collect the Data
• Extract event logs, include relevant data attributes
• Organize by traces (“normal” vs “deviant”)
3. Analyze
• Extract model for “normal” vs “deviant” cases, compare
• Use sequence mining to find discriminative patterns
• Construct classifiers to explain deviance
4. Interpret & Create Insights
• Inspect and interpret classifiers
• Derive causes of deviance, devise resolutions
Deviance Mining: Basic Method
9

10. Case Study 1:
Suncorp (Australia)
• Oftentimes „simple‟ claims take an unexpectedly long
time to complete
– To what extent does the cycle time of the claims handling
process diverge?
– What distinguishes the processing of simple claims completed
on-time, and simple claims not completed on time?
– What `early predictors‟ can be used to determine that a given
`simple‟ claim will not be completed on time?
• Team of analysts, relevant managers, IT experts
• Started with defining what a “simple claim” is.
S. Suriadi et al.: Understanding Process Behaviours in a Large Insurance Company in Australia:
A Case Study. CAiSE 2013: 449-464
10

11. OK
OK Good
Not Ideal
Expected
Performance
Line
Suncorp Case
11

12. Main result
Nailed down key activities/patterns associated with slower performance!
Simple “timely” claims Simple “slow” claims
Suncorp Case: Delta Analysis
12

13. Sequence mining
Decision trees, class association rules
Cross validation
R.P.J.C. Bose and W.P. van der Aalst: Discovering signature patterns from event logs. CIDM'2013
13
Case Study 2: Philips Healthcare
Discovering Patterns of Faulty Units

14. Case Study 3:
Commercial bank, China
Mining Anomalous Software Project Issues
• Extract features from traces based on which events
occur in the trace
• Apply a contrasting itemset mining technique 
features in one class and not in the other
• Decision tree to construct readable rules
C. Sun, J. Du, N. Chen, S.-C. Khoo, Y. Yang. Mining explicit rules for software process evaluation. ICSSP’2013.
14

15. Other Case Studies
• Undisclosed EU financial institution
– Problem: Anomalies in purchasing process
– Approach: Association rules mining
• Undisclosed U.S. healthcare provider
– Discriminate between cases leading to positive vs. negative
outcomes
– Approach: delta analysis and sequence mining
• Rabobank ICT
– Find patterns in IT change implementations that correlate
with increased/decreased interactions or
increased/decreased incidents
15Swinnen et al. Process Deviation Analysis - A Case Study. BPM Workshops 2011
Lakshmanan et al. Investigating clinical care pathways correlated with outcomes. BPM'2013.
BPI Challenge 2014: http://www.win.tue.nl/bpi/2014/challenge

16. How likely is it that a running
(apparently normal) case will
become deviant?
Will this case
end up in a
negative
outcome?
Will this process
fail to meet its
Service Level
Objectives in the
next 24 hours?
Will this case
generate
abnormal
effort, costs or
rework?
16
Beyond Deviance Mining:
Predictive (Deviance) Monitoring

17. Predictive Monitoring Techniques
• Predicting completion times & deadline
violations
– Use process mining to calculate “max
expected time” after each activity
– Trigger alerts if expected time exceeded
• Predicting negative outcomes
– Based on decision trees or other classifiers
– Based on clustering, nearest-neighbours…
17

18. Case Study 4: Transportation Provider
Predicting “Late Show” Events
• Predicting differences between expected & actual
time of delivery to a carrier (e.g. airline)
• Approach:
– Identify correlations between “late show”
events, completion time of activities, and external
variables (e.g. weather, traffic)
– Manually derive event processing rules to generate
alerts at runtime
18
Feldman, Fournier, Franklin, Metzger. Proactive event processing in action: a case study on the proactive
management of transport processes. DEBS’2013.

19. Take-home messages
• Recognize your deviance
• Quantify it
• Analyze it
• Monitor it
• Predict it
• Preempt it
19
Every good process eventually becomes a bad process…
unless continuously cared for
After: Michael Hammer (Handbook of BPM, Springer)