Process-Mining Nominal-Actual Comparison¶
Conformance analytics — instantiates Enacted-Control Verification and Closure
Reconstructs what actually happened from event logs and checks it against the documented process, surfacing skipped steps, out-of-order paths, and undocumented variants across the whole population.
A Process-Mining Nominal-Actual Comparison reconstructs the enacted control from the digital exhaust the system already leaves behind — timestamps, transaction records, workflow events — and replays it against the documented process model to find where reality departed. Its defining move is population-scale, log-derived verification: rather than observing a shift or sampling a stack of files, it mines every case that flowed through the system and quantifies how often each step was skipped, taken out of order, or replaced by an undocumented path. Because it runs on data that accrues continuously, the same comparison can be re-run as a standing monitor. It answers "across everything that happened, where and how often does actual behavior diverge from the model, and which divergences carry the most exposure" — an algorithmic, whole-population view no manual method can match.
Example¶
A mortgage lender documents an origination control: every loan must pass an income-verification step and an independent underwriter approval before the funding step, with no back-and-forth that would let funding precede a required check. The workflow system logs every state transition. Instead of pulling a sample of files, an assurance analyst runs a Process-Mining Nominal-Actual Comparison over roughly a year of origination events, discovering the actual process graph and overlaying it on the documented one.
The mined reality diverges in ways a file sample could easily miss. A small but non-trivial share of loans show the funding event's timestamp before the underwriter-approval event — an out-of-order path that inverts the control. A larger share route through an undocumented "expedited" variant that skips the second income check entirely. And a cluster of cases loop repeatedly between verification and approval, a churn pattern the model never anticipated. Crucially, the tool doesn't just list these; it counts them and weights them by exposure — the timestamp inversion is rare but high-severity, the expedited-skip is common and medium-severity — so attention goes to the divergence that actually threatens the control claim. Re-run monthly, the same query becomes a drift monitor that flags the expedited variant's share creeping upward before it becomes the norm.
How it works¶
- Reconstruct the actual process from logs. Event records are stitched into per-case traces, yielding the discovered process — what really happened — rather than the diagrammed intent.
- Replay against the documented model. Each trace is checked for conformance to the nominal control sequence, marking skipped steps, out-of-order events, and undocumented variants.[n1]
- Rank divergences by exposure. Each deviation type is weighted by frequency and by the hazard it touches, so a rare inversion of a critical order can outrank a common but harmless reordering.
- Schedule the re-run. Because it operates on accruing data, the comparison is set to repeat on a cadence, turning a one-off study into a standing drift monitor.
Tuning parameters¶
- Log fidelity — how completely the events capture the real control actions. Richer logs reveal more; sparse or gamed logs mislead, and the tool can only see what is recorded.
- Conformance strictness — how much sequence and timing variation counts as a deviation. Strict settings surface more divergences but flood the analyst with benign noise.
- Severity weighting — how frequency trades off against hazard in ranking divergences; tune it toward rare-but-critical or common-but-minor depending on the control.
- Case-notion boundaries — what counts as one "case" and where a trace starts and ends, which quietly determines what looks in- or out-of-order.
- Re-run cadence — one-shot study versus continuous monitor, trading timeliness against compute and alert fatigue.
When it helps, and when it misleads¶
Its strength is scale and objectivity: it examines the whole population instead of a sample, quantifies how often each divergence actually occurs, and — because it feeds on standing data — becomes a continuous drift detector rather than a periodic snapshot. It is the only mechanism here that can say "this undocumented variant is 8% of volume and rising" with the full population behind the claim.
Its failure mode is that it sees only what the logs record and takes recorded events at face value: a control performed perfectly but logged sloppily looks like a deviation, and a control bypassed outside the instrumented system leaves no trace at all, so a clean conformance result can hide the very workaround that matters. The classic misuse is reading log-conformance as control-effectiveness — the events can line up with the model while the underlying action was hollow. The guarding discipline is to validate that the log actually reflects the control action, treat unlogged paths as a blind spot rather than an all-clear, and confirm the high-severity divergences it flags with a mechanism that observes or reperforms the real work.
How it implements the components¶
enacted_control_trace— reconstructs the actual control execution from event logs, producing a per-case trace of what really happened across the whole population.discrepancy_severity_and_risk_rating— weights each divergence type by frequency and hazard so attention flows to the deviations that most threaten the control claim.drift_monitoring_cadence— because it runs on accruing data, the same comparison is scheduled to repeat, becoming a standing monitor for creeping divergence.
This mechanism does not decompose the documented requirements into a coverage grid or carry a resolvable citation per requirement (nominal_control_specification, evidence_chain_traceability), and it does not itself judge safe-versus-dangerous adaptation (nominal_actual_gap_classifier) — those belong to Document-to-Practice Trace Matrix, which works from a documented requirement list rather than from the log population.
Related¶
- Instantiates: Enacted-Control Verification and Closure — supplies the whole-population, log-derived view of where and how often enacted behavior departs from the model.
- Sibling mechanisms: Work-as-Done Audit · Operator Shadowing and Contextual Inquiry · Control Performance Walkdown · Document-to-Practice Trace Matrix · Line-of-Defense Sample Reperformance · Corrective Action Effectiveness Retest · Safeguard Bypass Probe · Exception, Waiver, and Override Log Review · Near-Miss and Deviation Review
Editorial Notes¶
Form Classification¶
Form family: Monitoring, Sensing & Alerting
Rationale: The mechanism repeatedly reconstructs actual process traces from accruing logs and flags conformance drift, skips, inversions, and undocumented variants.
Nearest alternative: Analysis, Modeling & Optimization — Process discovery and ranking are analytic, but scheduled observation of operational drift is the defining deployment.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Process-Mining Nominal-Actual Comparison is most plausibly rooted in the computer_science tradition because its characteristic form depends on algorithms, data structures, formal interfaces, and software-system practice. The assignment tracks that formative lineage, not the many settings in which the mechanism can now be applied.
Related originating lineages:
- Data Science & Analytics — The data_science tradition materially shaped Process-Mining Nominal-Actual Comparison through its own practice of production data pipelines, predictive modeling, and machine-learning validation.
- Organizational & Management Science — The organizational_management tradition materially shaped Process-Mining Nominal-Actual Comparison through its own practice of the coordination, governance, learning, and redesign of organized work.
Review outcome: Independent reviewer agreement; high confidence.
Notes¶
[n1] Conformance checking is the branch of process mining (formalized in the work of Wil van der Aalst) that compares an event log of what actually happened against a normative process model, measuring fitness and pinpointing where real executions deviate. This mechanism applies it to control processes specifically, asking whether the enacted control still matches the documented one. ↩