Deviation analysis (process mining)

What is deviation analysis?

Deviation analysis looks at where process runs differ from a chosen reference. An activity can be missing, happen twice, sit in a different order, or occur far later than expected.

The reference can be a formal process model, a policy rule, a target variant, a past period, or a comparable group. Without a clear reference point, a deviation is only a difference, not a judgement.

A deviation is not automatically a mistake. An urgent case may skip a standard step on purpose. The analysis makes the difference visible; domain experts decide what it means and what should follow.

What kinds of deviation can you study?

Control-flow deviations are about the order and presence of activities. An invoice was paid with no approval on record.

Timing deviations are about waiting time, processing time, or deadlines. A credit check took three days where similar cases usually finish within hours.

Data deviations are about values or combinations of values, such as a discount above the allowed limit.

Organisational deviations are about role, handover, or separation of duties. The same person created and approved a record.

Set a tolerance and a materiality threshold. A one-second difference and a missing mandatory control should not carry the same priority.

A worked invoice example

The standard process requires Received, Matched, Approved, and Paid. The event log holds several different traces through those steps.

One group of invoices runs Received, Approved, Paid, with the matching step absent. A second group shows Approved twice, which may point to rework. A third follows the standard path but waits a long time between matching and approval.

The analysis counts the cases, the amounts, the suppliers, and the departments involved. Invoices with a legitimate automatic match may explain the first deviation, and if that route is allowed, it belongs in the reference model or the rules. So deviation analysis produces a ranked list to investigate, not a verdict on blame or cause.

Deviation analysis versus conformance checking

Conformance checking compares behaviour from an event log formally against a process model. Techniques such as token-based replay and alignments can pinpoint where a trace and the model disagree and put a number on how well they fit.

Deviation analysis is broader. It can also study performance, data values, roles, and comparisons between periods without a fully formal reference model. Conformance results are a strong input to it, and the next step adds business impact, context, and priority on top.

Deviation versus process variant

A process variant groups traces that follow the same path. A variant is descriptive on its own. It only becomes a deviation once you weigh it against a chosen norm or expectation.

The most common variant is not automatically the right one. A widespread shortcut can be structurally undesirable, and a rare route can be legally required for a specific case. Compare variants against outcomes, rules, and context, not against frequency alone.

From deviation to cause and action

Segment deviations on features that were available before or during the problem, and look for patterns by product, channel, amount, system, or team. A correlation is not yet a cause. Invoices from one supplier can run slower because of missing purchase orders, a different product type, or a temporary system fault, and root cause analysis is where you frame and test those hypotheses.

Only wire an automatic action to a deviation when its meaning is reliable. A compliance breach can block straight away, while an unusual but possibly valid path should be reviewed first.

Quality and governance

Check whether missing activities truly did not happen or simply were not recorded. Time-zone errors and wrong case correlation can manufacture false deviations. Keep the reference model, the rules, the log version, and the analysis parameters, or a result cannot be reproduced later.

Handle employee and team data with care. Deviation analysis judges process behaviour; individual league tables without context can be both wrong and harmful. After a process change, track whether the deviation shrinks and whether new routes appear. Improvement is a measurement cycle, not a one-off clean-up.