Categorizing Identified Deviations for Auditing

Currently, financial statements auditors perform the tests of controls based on sampling. However, when using a sampling approach, information is lost. To counter this drawback, data analytics has been applied as a method for auditors to provide assurance while using all data. Specifically for testing controls, the potential of process mining has been explained in literature. Indeed, conformance checking can be used to compare real process executions with a normative model. However, the outcome of current conformance checking techniques is too vast for an auditor to inspect further. The identified deviations are at an atomic level (skipped and inserted tasks) and there is no feasible approach to gain a quick overview of the deviations. In this paper, we propose an approach to categorize deviations, which enables auditors to quickly gain an overview of different types of existing deviations along with their frequencies. Categorizing deviating process instances can also give an insight for assessing the risk at case level.