# Fraud Audit Based on Visual Analysis: A Process Mining Approach
## 4 The Fraud Audits Approach
### Visual Analysis Layer
#### 4.2.4 Phase IV: Sequences Analysis  
The objective, in this phase, is to visually detect anomalous sequences. The aim is to discover irregular sequences according to the order in which the activities appear. This is done using the trace alignment algorithm (the trace alignment algorithm leads to a visual representation of the sequences of process activities; it generates a graph in which each row corresponds to a different sequence of activities, grouping all the instances that follow the sequence. For each sequence (individual row), the activities are represented as different colored boxes, organized from left to right according to the order of occurrence. The algorithm succeeds in aligning activities with the same name in columns, thus increasing the possibility that auditors will visually detect patterns.) [84], whose use during the audit should be oriented as explained below:  
1. [label=0.1]
2. Evaluate the sequences of activities corresponding to instances that were unusual in the previous phases.
3. Discover all behavior patterns in the event log, focusing on the \"exceptional activities\" identified in Phase I. Direct the visual examination towards identifying concentrations of exceptional activities (once vertically aligned, as shown in Figure 3) across multiple different sequences. The agglomerations of exceptional activities in the image could be a symptom of inefficiency or fraudulent activity.
4. Determine the patterns of a higher frequency of occurrence and then visually examine compliance with the main precedence rules between the business activities. Irregular behaviors may be identified, which, according to their high frequency, can be established as part of the usual process execution. In organizations, they are usually assumed to be normal behaviors, and it is, therefore, difficult to detect them using traditional auditing methods.
5. Examine the less frequent sequences. In practice, occasional executions can exceptionally deviate from the designed process. Not all exceptions necessarily indicate fraud. Some deviations are attributable to the process, while others remain withinlegal limits but are ineffective, and others, still, constitute anomalous extreme values that require further investigation. The truth is that they constitute the main source of relevant information for the fraud audit. Therefore, according to the extent to which the sequences move away from the process's usual behavior, the probabilities of being linked to illicit activity increase.
5. Once exceptional sequences have been identified, we use the capability of filtering by business domain attribute. The objective is to conduct a preliminary investigation in order to reach an initial hypothesis regarding the legal nature of the exceptional sequences.  
In order to use the trace alignment algorithm in audits, some adjustments were made:  
* We suppressed the algorithm's initial data pre-processing step. In the algorithm's initial stage, loop-type structures and outliers are eliminated (traces whose number of activities differs significantly from the average length of the remaining traces). This initial refinement process improves the alignment but limits the possibilities of detecting anomalies. With the executed adaptation, all the traces are processed and the process's anomalous sequences are identified.
* As an alternative, in this step, we group the traces based on the similarity of the sequences of activities carried out; the subsequent alignment is thus performed on groups of instances sharing a similar behavior, which improves the quality of the alignment and makes it easier for the auditor to visually interpret any suspicious fraud patterns.