# Fraud Audit Based on Visual Analysis: A Process Mining Approach
## 4 The Fraud Audits Approach
### Visual Analysis Layer
#### 4.2.1 Phase I: Preliminary Analysis  
The purpose of the preliminary analysis is to acquire an initial view of the process under analysis.  
To execute this phase, we use the fuzzy miner discovery algorithm [81], previously selected by the experts. Fuzzy miner stands out for its potential as regards processing events in unstructured processes and its ability to handle large amounts of data [60]. Once the process model is discovered, a visual inspection is carried out in order to identify the following elements:  
1. Missing activities: activities that, despite being known to be part of the process, are not recorded in the traces or cannot be reconstructed on the basis of the information available in the business databases. They are not, therefore, shown in the process model.
2. Exceptional activities: activities that are not part of the so-called \"expected flow\" of the process. These usually constitute rejection, cancellation, or compensation activities (triggered by system errors). It is common for there to be alternative flows to the normal process behavior, but their execution significantly increases the risk of fraudulent activity and the auditors must pay particular attention to them.
3. Exceptional sequences: We preliminarily analyze the main branches of the model discovered in an attempt to identify the sequences of activities that are clearly exceptional and violate its normal behavior logic. For example, an activity that runs after any activity that ends the process; that is, if we were analyzing an accounting process that included the payment of checks, and two activities of the type \"collect check\" were successively executed, we would clearly be in the presence of exceptional behavior, with a high probability of constituting a fraudulent action.  
Figure 2: Selection of the process discovery technique using AHP.  
For unstructured processes, the visual identification of irregular behaviors is difficult at this stage of the analysis. In these cases, it is necessary to use functionalities to manage the process's level of abstraction. Auditors must identify which event attributes would be relevant for fraud audits and cluster the activities according to these attributes. This makes it possible to simplify the model according to audit interests, and different views of the process are obtained.  
Worthy of note, some adaptations were made to the fuzzy miner algorithm for use in audits:  
* Enabling the grouping of activities based on the value of an event attribute defined by the user (group consecutive events with an equal value in the specified attribute). When an event does not have this attribute, it continues to be a primitive node within the resulting model.
* The establishment of a single configuration parameter to use the algorithm, depending on an edge's desired strength. A color scale is established for the graphic representation of the model according to the parameter. Greater opacity is given to those edges whose relative frequency of appearance is below the value of the parameter. Those nodes whose input edges have a value lower than the defined frequency threshold will be represented together with greater opacity.