# Fraud Audit Based on Visual Analysis: A Process Mining Approach
## 2 Background and Related Works
### Process Mining and Audit  
[PERSON]'s proposals, in [3; 47], stand out among the approaches to apply process mining techniques in audits. Both proposals include applications of all process mining perspectives to audits. The first part of the discovery of the process model subsequently covers the conformance checking and also includes rule verification, organizational analysis, and performance evaluation. The second part proposes an audit framework based on process mining. It focuses on the detailed technical design of the data layer and includes risk assessment and context analysis of the detected irregularities. Its limitation is that it does not conceive the analysis of behavior patterns, which is an important tool in this field. Pattern analysis based on process mining for auditing was developed by [PERSON] in [48; 49]. Its methodology includes the evaluation of sequences of activities, along withthe analysis of roles, attributes, and social networks; however, it does not take advantage of the potential of visual sequence analysis to detect unusual elements. Several approaches have similarly simplified the use of process mining for audits or conformance checking, directing their analysis towards the evaluation of rules or restrictions in the event log. A proposal based on the use of temporal logic operators, specifically an extension of linear temporal logic (LTL) for checking restrictions on the trace, is included in [50], while a detailed explanation of the LTL language can be found in [51]. As a result of this proposal, a repository is created with 60 standard rules for audits, which can be reused in any business environment by users without any technical knowledge of the LTL language. Another interesting approach oriented toward conformance checking was proposed by [PERSON] [52]. It combines the event log comparison with a pre-established process model in order to detect irregularities, and the analysis is based on checking restrictions by using declarative approaches such as LTL. The author points out the limits of the approaches based on rule checking, which do not allow detecting that a rule is broken multiple times in the same trace. To use rule-based audits, it is imperative that the auditor visualize the risk scenarios in advance. The effectiveness, therefore, depends on the acting auditors' experience and knowledge of the business. Other approaches, such as those formalized in [53; 54; 55], are based on the detection of anomalies as a basis for audits using process mining. (An anomaly is understood as an exceptional execution or noise in the event log, possibly caused by system failures, error in data entry, or by fraud attempts; generalizing the term anomaly could make inference to rare and infrequent events, deviations from normal or regulated behavior, unexpected results, or to states outside the usual range of variation [53].) The first includes a conformance checking of the traces against the model discovered, classifying them as normal and anomalous. The second proposal focuses on security. It proposes conformance analysis based on \"token games\", comparing the trace against pre-established or discovered process models. In both cases, the proposed audit analyses are limited since they only include the perspective of control flow without evaluating particular sequences or behavior patterns. The third approach presents the search for anomalous situations based on the frequency of occurrence of sequences in traces (it assumes that the frequency is lower for anomalous sequences), ignoring the cases in which fraud becomes a frequent practice. None of these three approaches exploits the visual possibilities of process mining for the detection of anomalies. In [56], [PERSON] presents a framework to apply process mining to the detection of potentially fraudulent transactions. The proposal links activity patterns to possible fraud schema and assigns a level of risk to each.