Process mining for audit and internal control
Process mining and robotic process automation appear on only 25 recent papers, mostly in AI and operations research, with 3 in accounting. Event logs from enterprise systems record every step of purchasing, invoicing and payment. Can auditors test whole populations of transactions instead of samples, and what do they find?
What prompted this#
Since October 2025, 25 papers carry a process-mining, robotic-process-automation or business-process keyword (14 in AI journals, 5 in operations research, 3 in accounting): "process mining" on 8, "robotic process automation" on 5, "business process modeling" on 4. Audit firms advertise full-population testing with these tools, but evidence on what it changes is scarce.
Questions#
- When auditors analyse the full event log of the purchase-to-pay process, how many control deviations do they find that sampling would have missed, and how many are real problems?
- Do firms whose auditors use process mining have fewer later restatements or material weaknesses?
- Do automated processes (bots) reduce control deviations, or create new ones that nobody reviews?
Data that could help#
Anonymized enterprise system event logs (public process mining challenge datasets), audit firm data on tool use, and restatements and control weaknesses (Audit Analytics).
Next step#
Apply standard conformance checking to a public purchase-to-pay event log and classify the deviations found by type and likely materiality.