Picture an internal auditor’s desk: a procurement file opened once a year, one hundred and fifty transactions selected, three weeks of analysis, and a final report. For many mid-sized and large companies in Turkey, auditing still runs on this cycle. The question worth asking is: how representative are those one hundred and fifty transactions of the tens of thousands processed annually? And what does the assumed sample actually hide? Process mining offers a fundamentally different answer. By analysing event logs from ERP, accounting, and workflow systems, it makes the entire transaction universe visible — and in doing so, it challenges the logic of sampling at the core of conventional audit practice.
In the compliance context, process mining’s primary function is to compare actual process behaviour against a defined control framework. Questions such as ‘did the approval hierarchy always follow the correct sequence?’, ‘did the same person both create a purchase request and approve the invoice?’, or ‘was the second approval step bypassed when a defined spending limit was exceeded?’ are typically answered in classical auditing through sample analysis. Process mining answers them across the full transaction population. Tools such as Celonis, Minit, or open-source alternatives extract a process model from ERP event logs and automatically flag deviations against the expected model. This does not eliminate sampling error entirely, but it moves well beyond sampling constraints.
In Turkish implementations, the most frequently encountered scenario is detecting control violations in the procure-to-pay cycle. As the scope of mandatory e-Invoice (e-Fatura) requirements has expanded and ERP usage has deepened, event logs have become richer and more reliable. In manufacturing and retail companies running SAP or Logo Tiger, monitoring supplier approval workflows and payment term compliance through process mining can replace the manual monthly work that audit teams would otherwise conduct. One distinction matters here and is often missed when teams first encounter the tool: process mining does not make audit decisions — it flags deviations. The decision still belongs to a human. Conflating the two leads to overconfidence, which is arguably more dangerous than the sampling problem it was meant to solve.
Continuous auditing has been discussed in theory for years; in practice, it has consistently run into data access problems. Process mining partly removes this barrier because ERP event logs are existing data — no additional collection infrastructure is needed. A finance director or head of internal audit can monitor deviation rates in procurement, collections, or expense approval processes through a process mining dashboard refreshed weekly or monthly. This has real potential to shift auditing from an annual event to an operational monitoring routine. In a Turkish business environment where currency fluctuations regularly ripple through supplier contracts, near-real-time visibility into payment term violations can surface cash flow risks before they become material.
The most significant practical challenge is data quality. Incorrectly entered transactions, missing timestamps, and manual corrections corrupt event logs and can make process mining outputs misleading. This problem is more acute in Turkish SMEs: ERP is installed but data entry discipline is inconsistent, modules are not fully integrated, and some transactions still run through spreadsheets. Under these conditions, process mining risks making data entry habits visible rather than actual business processes. A data quality assessment is therefore a non-negotiable prerequisite before any tool deployment. If skipped, the findings produced will not represent audit assurance — they will be a catalogue of data hygiene problems. Equally, the internal audit team needs sufficient analytical capability to interpret process mining outputs; the tool installation alone does not create that capability.
For an internal audit or finance leader evaluating investment in process mining for compliance visibility, a practical sequence looks like this. First, assess the quality and completeness of ERP event logs independently — before any vendor conversation. Second, select a single high-risk process as a pilot; the procure-to-pay cycle is a sound starting point for most organisations. Third, define clearly how tool outputs will integrate with existing audit methodology: a process mining finding should be positioned as a signal to initiate investigation, not as an automatic violation. Without these three steps in place, a process mining licence is likely to sit unused on a shelf. The technology is capable; the preconditions for making it useful are organisational, not technical.
This article was originally written in Turkish by Gökhan MERCANOĞLU on April 1, 2019 and has been automatically translated into English and other languages using machine translation.