The aim of this paper is to provide continuous results on research in financial data analysis. Financial processes involve complex procedures concerning the recording and analysis of financial data. Many companies encounter difficulties when handling large amounts of financial data for assessing the current state of the company, planning future strategies, and other purposes. This paper proceeds with the analysis and usage of financial data space dimensions using General Ledger information from specific companies in the Netherlands, also introduces a method for identifying financial anomalies.
Van der Aalst introduced the notion of process mining in 2004 [24]. Process mining, a data
analytics technology, aims to extract process-related insights, focusing on analyzing historical data
from process executions recorded as event logs [
Business processes encompass a significant volume of events captured by information systems.
This data comprises details such as event ID, activity, timestamp, and the individual responsible,
collectively referred to as “Event Logs” [
An event is an origin of a case, i.e., a process instance (e.g., transferring money from a bank
account), comprising an activity (e.g., logging into the bank's website) occurring within a timestamp
(e.g., the duration of website usage from login to logout) by an originator (the individual executing the
task) [
The concept of process mining aims to uncover, monitor, and enhance genuine processes – those
that exist in reality, rather than assumed ones – by extracting insights from event logs readily
accessible in contemporary information systems. Process mining includes automated process
discovery (extracting process models from event logs), conformance checking (monitoring variations
by comparing models with logs), social network and organizational mining, automated creation of
simulation models, model expansion, model rectification, case prediction, and history-based
recommendations [
There can be defined three process mining characteristics:
Process mining extends beyond control-flow discovery. The generation of process models
from event logs creates creativity among both practitioners and scholars. Consequently,
controlflow discovery is frequently perceived as the most captivating aspect of process mining. However,
process mining transcends control-flow discovery. On one hand, discovery represents just one of
the three fundamental forms of process mining (discovery, conformance, and enhancement). On
the other hand, its scope isn’t confined solely to control-flow; the organizational, case, and time
perspectives also hold significant relevance [
Financial auditing involves evaluating companies and their processes to ensure the accuracy and
reliability of associated information. Audits verify whether business operations comply with
established limitations, which may be defined by managers, administrators, or other parties, including
legal or company policies. Detecting violations of these rules can reveal instances of fraud, anomalies,
risks, or inefficiencies. Traditionally, auditors provide reasonable assurance regarding process
compliance by assessing the effectiveness of controls. However, advancements in data recording, such
as event logs and transaction databases, have facilitated a shift towards Auditing 2.0. This approach
utilizes detailed process information and advanced process mining techniques to evaluate all events
within a business process in real-time, significantly altering the role of auditors [
Given the large amount of research that has been produced on the use of modern data mining technology in the field of accounting, an obvious question is: can this research be presented in a structurally logical and thematically coherent manner? In an attempt to answer this question in the affirmative, there is proposed several organizing frameworks for the applications of data mining in accounting. Main idea of this kind frameworks is to present the extensive research coherently. Such frameworks enhance understanding of complex relationships within literature, providing a structured way to map research within a domain.
The main goal of descriptive data mining is business and data understanding (the what happened),
the goal of predictive data mining is using the past to understand the future (the what could happen),
and the goal of prescriptive data mining is to achieve the best outcome (the what should happen).
Descriptive data mining focuses on understanding past and present data to make informed decisions,
employing techniques to categorize, characterize, and visualize information [
Data mining uses various techniques from statistics, machine learning, and databases. Neural
networks emerge as the most widely used technique, followed by regression, decision trees, support
vector machines, and genetic algorithms. Less common techniques include text mining,
selforganizing maps, and Bayesian networks [
A topical analysis reveals that the majority of data mining applications in accounting focus on
assurance and compliance, followed by managerial accounting and financial accounting/accounting
information systems. This distribution may reflect the differing needs for advanced analytics across
various branches of accounting, potentially driven by auditing failures, regulatory tightening, and the
demand for technological support. [
Auditing using historic data, where historic data, represented by event logs of completed cases, serves as a valuable resource for offline auditing. This data can be filtered and queried to create a more manageable and relevant event log for further analysis. Additionally, historic data can be used to discover de facto process models and assess conformance to de jure models, aiding in identifying deviations and potential problems.
Alternatively, auditing can be conducted solely based on models without direct reference to event
data. This approach involves comparing de facto and de jure models to identify differences and update
existing models accordingly. Models can also be diagnosed for anomalies using conventional analysis
techniques and merged with process mining results to create comprehensive simulation models for
what-if analysis [
Auditing using current event data and advanced IT systems, auditors can monitor processes in
real-time and intervene before completion. Techniques such as process mining allow for on-the-fly
monitoring, deviation detection, outcome prediction, and recommendation of corrective actions.
However, this operational support raises questions about the auditor's independence and potential
interference with the process execution [
Auditors face the challenge of dealing with various management information systems that are
rapidly growing in data. Traditional methods are becoming obsolete for auditing those financial
statements generated by these automated processes. Process mining has been introduced in different
corporate contexts, but are missing in the field of auditing. Mining and reconstruction of financial
process models can be done using process mining methods. In order to use process mining, data
should be in the form of an event log [
For process mining to become as widely adopted in accounting information systems, accounting professionals must to acknowledge that the proven value of process mining in those research areas indicates that it surely would be anomalous if it is not equally impactful in our own.
The specification of Financial Process Mining tasks (projects) has fundamental differences from traditional Process Mining. The Process Mining technology is aimed to discovery of process model from process related data records named Eventlog. Financial processes refer to the methods and procedures completed by the Office of Finance. They include, but aren’t limited to: Accounting, Budgeting, Planning and other categorized under varied titles depending on the finance policies and procedures. Since each finance department function has a list of finance business processes involved, drawing up process maps can bring a clear understanding of the tasks and people involved [16, 17, 18].
Basic concepts of finance process mining are listed below [16, 17, 18]:
Financial (accounting) object (FO): any name of the file field (data record field), i.e. the
column name of the excel table), except for time attributes.
Source data: A subset of financial data records, each record being a set of financial objects
and their meanings or codes.
Case: a unique finance object sequence compiled from event log entries
Case ID: any selected finance object or combination of few finance objects from the
financial data record
Activity ID: any selected finance object or combination of few finance objects from the
financial data record, except included to Case ID.
Event: one financial data record consisting of the following fields: required field with time
parameter value (time stamp) and all others called financial objects (with specified value or
code)
Outcome of finance PM: process model of the behavior of a financial object and its and its
differences in different time periods, and statistics (key performance indicators).
Current problem: to reveal the behavior of financial objects in time, according to data
clusters (financial statement types, source document types, ledgers and sub-ledger
(journals, etc.)).
Relevant: behavior of data values and its differences in time periods, according to separate
groups of financial data.).
Process Cube: Process cubes are multidimensional space where the event data is presented
and organized using different dimensions. Each cell in the process cube corresponds to a
set of events which can be used as an input by any process mining technique. This notion
is related to the well-known OLAP (Online Analytical Processing) data cubes, adapting the
OLAP paradigm to event data through multidimensional process mining. In this way all
operations: slice, dice, drill down, drill up can be implemented [
There are many PM tools, their environments are very different, so it is too complicated for a financial specialist to use them directly in formulating data analysis tasks. In [16, 17]were presented a user-friendly approach to PM technology implementation for financial data analysis using a multidimensional space of financial data.
Figure 1 presents financial data space (FDS) dimensions and their members, which can be covered with particular data from General Ledger prepared for the analysis according to transformation algorithms [16, 17, 18]: Event class dimension is associated with the Document Type (dimension B), Time window dimension is associated with the Financial Period (dimension T).
The Financial Process Mining tool composes the Financial Process Cube according to the user specification and displays (visualizes) PC dimensions and their members, continuing the example: Case type dimension is associated with the Financial Statement Category (dimension A) members a1 – FS Category and a5 - Section, Event class dimension is associated with the Document Type (dimension B) members, b3
Doc-subtype3, Time window dimension is associated with the Financial Period (dimension T), t3
FinancialYear.
The Process Cube dimensions and members according to the user requirements specification are as follows: PC = {Case type (a1, a5); (Event class (b3); (Times window (t1)};
The next step is to specify the parameters of the PM project according to the objectives of the analysis performed. We select Case ID, Actitvity ID, and Timestamp ID from existing cube dimensions and their members. The example of PM project specification is as follows: Dimension FS Category: Case ID: a1 - Category, a5 - Section Code; Dimension Document types: Activity ID: b3 – Doc-subtype3 (Invoice); Dimension TimeWindow: Timestamp: t3 – Financial Year.
In this step, according to the project specification, the PM tool creates a project EventLog from the existing data set (i.e. Initial Event), on the basis of which the PM process will be started: CaseID =(CaseID1=StatementType AND CaseID2=SectionCode), ActivityID = InvoiceNumber (i.e. doc-subtype3), Timestamp= FinancialYear.
Case type (CaseID1 and CaseID2,..) can be associated with financial process rules (constraints) defined through data record attributes and their values.
These rules of the financial process make it possible to distinguish between permissible and nonpermissible transactions, i.e. allows you to detect inadequate records. The rules of financial processes (constraints) are based on the expert knowledge presented in natural language and then formally specified using expression IF (conditions) THEN (Action) and decision tables.
Constraints for Horizontal dimension (= Activity type) members (ActivityID = doc-subtype3, ....) is based on the expert knowledge (formally specified as decision table or otherwise.
The list of doc-subtype3 possible values: doc-subtype3 = (Invoice, Quote, Order, …) Example of the Decision table for ActivityID = doc-subtype3 when Transaction type = (DebitSectionCode – CreditSectionCode).
The PM execution results are the discovered process model, which can be also represented graphically (Process Map), and the process model parameters (static data). With the help of PM tool it is possible to get various statistical information, such as: General statistics of data set: Number of records, Cases (number), Variants (number), Max number of Events in CaseID (Longest case), Activity ID of Longest case; Case ID, Characteristics (Quantities): (QC1) Duration of case, (QC2) Case Started, (QC3) Case Finished, (QC4) Number of Events in the case, (QC5) A number of Resources for each Activity in the case; Activity, Characteristics (Quantities): (QA1) Frequency of Activity (a quantity of the same
Activity in the data), Relative quantities (%): (RA1) Relative Frequency of Activity (%); Resource, Characteristics (Quantities): (QR1) Median Duration, (QR2) Mean duration, (QR3) Duration Range, (QR4) Cumulative duration, (QR5) Frequency of Resource (a number); Relative quantities (%): (RR1) Relative frequency of Resource (%); Attributes, Characteristics (Quantities): (Q01) Frequency, (Q02) Cumulative Frequency;
Relative quantities (%): (R01) Relative Frequency of Attribute (%); Variant (A Cluster of cases), Characteristics (Quantities): (QV1) Cumulative % of Variants (graphical scheme), (QV2) Median Duration (of cases included in the Variant), (QV3) Mean duration (of cases included in the Variant), (QV4) Number of different Cases in the Variant, (QV5) Number of Events (Activities) in the Variant (in the cluster of cases); Relative quantities (%): (RV1) Relative frequency (%) of Variant (% of cases with the same sequence of Activities (Events)).
Using process mining for anomalies detection in financial data empowers companies to protect their assets, maintain investor confidence, and uphold the integrity and accuracy of financial information.
For the companies the process of detecting anomalies in financial data is crucial for identifying potential fraud, errors, or irregularities that could damage the integrity of financial reporting and entire status of the company. Anomalies detection in financial data using process mining techniques provides companies with the ability to proactively mitigate risks and enhance compliance with regulatory requirements. The main steps of financial anomaly detection are listed below [18, 22, 23]: 1. Discovery of a normalized model (company-specific): 1.1. to detect anomalous journal entries, first to be done is to define “normality” with respect to accounting attribute type, indicator type. 2. Identification of deviations of attribute values: 2.1. to exhibit unusual or rare individual attribute values. Such anomalies usually relate to skewed attributes, e.g. rarely used ledgers, journals or unusual posting times. Traditionally, “red-flag” tests performed by auditors during an annual audit, are designed to capture this type of anomaly. 3. Unusual or rare combinations of attribute values: 3.1. journal entries that exhibit an unusual or rare combination of attribute values while their individual attribute values occur quite frequently: e.g. unusual accounting records, irregular combinations of general ledger accounts, user accounts used by several accounting departments. 4. Actual time periods list.
It should be noted that some steps are related to method of detection of anomalies in large scale accounting data where according to the authors, their score accounts for both of the observed characteristics, namely: (1) any "unusual" attribute value occurrence (global anomaly) and (2) any "unusual" attribute value co-occurrence (local anomaly): [an unusual or rare combination of attribute values] [22].
4.2.
Before the presentation of financial anomaly detection example some concepts must be defined. Changing behavior of some KPI (key performance indicators) is one of the most important indications of changes in companies’ decisions. New type of KPI's for anomaly detection are defined below [23]: 1. BCI-A - Absolute: (change per Financial Period: Financial Year or Month): 1.1. BCI-A1 – Absolute change against previous Financial Period; 1.2. BCI-A2 – Absolute change against average of Financial Period; 2. BCI-RO - Robustness Coefficient: measure the distance of KPI from the Normative value; 3. BCI-RE1 – Relative (%): change of KPI per Financial Period, i.e. KPI change compared to previous period; 4. BCI-RE2 – Relative (%): change of KPI per Financial Period compared to the KPI Average value); 5. DELTA of some BCI is defined as a change of BCI of the given period comparing to a change of BCI of the previous period (change of change). DELTA of some BCI indicates the trend (style) of changes.
There is anomaly detection in KPI: Current Ratio (Cr) (KPI which equals current assets / current liabilities) presented in the example. Figure 2 presents fragment of company’s financial data.
The paper introduces the benefits of using process mining in financial data analysis, outlining process mining and audit-related tasks while defining aspects of financial process mining. It focuses on the approach of anomaly detection in financial data, using behavioral change indicators (BCIs) based on traditional KPIs. This is part of the results of the project "Platform of tools for the analysis of corporate financial activity data".
The advantages of using BCIs in financial data analysis can be summarized as follows: BCI calculations provide both quantitative and visual insights into KPI behavior over time. Changes in KPI values serve as crucial indicators of changes in company processes or decisions. Using BCIs to track changes in KPIs and identify suspicious trends, reduces the amount of data that needs to be analyzed.
The presented example effectively illustrates the practical implementation of the defined method and underscores its effectiveness in enhancing the understanding and management of financial processes within companies. It provides necessary information for the auditor to make further decisions.
This paper presents part of results of research project “Enterprise Financial Performance Data Analysis Tools Platform (AIFA)”. The research project is funded by European Regional Development Fund according to the 2014–2020 Operational Programme for the European Union Funds’ Investments under measure No. 01.2.1-LVPA-T-848 “Smart FDI”. Project no.: 01.2.1-LVPA-T-848-02-0004; Period of project implementation: 2020-06-01 - 2022-05-31