İnşaat projelerinin satınalma yönetiminde iç kontrol aracı olarak süreç madenciliği
Process mining as an internal control tool in procrument management of construction projects
Yazar: BURHAN SARAL
Danışman: DR. ÖĞR. ÜYESİ CEMİL CEYLAN
İstanbul Teknik Üniversitesi / Lisansüstü Eğitim Enstitüsü / Endüstri Mühendisliği Ana Bilim Dalı / Mühendislik Yönetimi Bilim Dalı
Derece: Yüksek Lisans, 2021
Konu: Endüstri ve Endüstri Mühendisliği = Industrial and Industrial Engineering ; Mühendislik Bilimleri = Engineering Sciences
Dizin: İnşaat projeleri = Construction projects ; İç denetim sistemi = Internal control system ; İç denetim ve iç kontrol = Internal control and internal audit ; İş süreçleri = Business processes

Özet:
Artan rekabet ortamı ve dijitalleşmenin giderek büyümesi iş yapma biçimlerinin değişmesine sebep olmaktadır. Pek çok süreç dijitalleşirken şirketler için süreç yönetiminin de önemi günden güne artmaktadır. Böyle bir ortamda süreç madenciliği ile mevcut süreçler keşfedilebilir, geliştirilebilir ya da yönetilebilir. Bu artan rekabet ortamında daha güçlü ve sürekli gelişen süreçleri kurgulamak bir gerekliliktir. Ayrıca verinin artık çok önemli bir meta olduğu çağımızda, süreç madenciliği veriye dayalı rafine ve doğru bilgiyi sağlamak için günden güne ilgi duyulan bir araştırma alanıdır. 
Yalnız şirketler değil büyük kurumların tamamının son dönemde gittikçe önemsediği bir diğer kavram ise iç kontroldür. İç kontroller kurumlar üzerinde riskleri azaltmayı amaçlayan uygulamalardır. İç kontrol sistemi ise şirketlerin faaliyetlerine ilişkin güvenli ve doğru bir raporlama sağlayarak, işletme verimliliğini arttırmayı ve şirket süreçlerinin şirket politikalarıyla uyumunu denetleyen ve tüm bunlarla beraber şirketin varlıklarını korumayı amaçlayan sistemdir. Bu sistemde görev, yetki ve sorumluklar ile beraber ölçü ve yöntemler belirlenerek buna uygun bir raporlama sistemi kurulur.
Literatür incelemelerinde süreç madenciliği ve şirket içi iç kontrol ya da iç denetim faaliyetleri kısıtlı yayınlar dışında genel itibariyle ayrı ayrı ele alınmaktadır. Bu tez çalışmasında ise bu iki kavram bir arada ele alınmış ve süreç madenciliğinin şirket içi kontrol faaliyetlerinde araç olarak kullanılabileceği irdelenmiştir.
Bu tez beş bölümden oluşmaktadır. Birinci bölüm konuya ilişkin bir giriş niteliği taşımaktadır. İkinci bölümde ise süreç madenciliği kavramına ilişkin literatür taraması yapılmış ve konuya ilişkin daha önce ele alınan kavramlar paylaşılmıştır. İkinci bölümün sonunda süreç madenciliğinin bir iç kontrol aracı olarak kullanılabilmesi irdelenmiş ve bu bölümde iç kontrol, iç denetim gibi kavramların literatürdeki karşılıkları verilmiştir. 
Tezin üçüncü ve dördüncü bölümü uygulamayı içermektedir. Üçüncü bölümde incelenecek uygulama verisinin oluşturulma metodolojisi paylaşılmıştır. Bu veri bir inşaat firmasına ait satın alma verileridir. 
Dördüncü bölümde iki farklı aşama ile uygulama yapılmaktadır. Birinci aşamada satın alma programından alınan ve herhangi bir şekilde müdahale edilmeyen ham veri incelemeye alınmıştır. İnceleme için ProM 6.9 programı kullanılmıştır. Uygulamanın birinci bölümünde süreç yapısal açıdan incelendikten sonra uyumluluk denetimi yapılmıştır. Ayrıca birinci bölümde yapılan inceleme sonucunda olay günlüğündeki tüm gürültüler tespit edilerek temizlenmiş ve ikinci bölümde incelenecek veri oluşturulmuştur. İkinci bölümde ise gürültülerden arındırılarak temizlenmiş ancak süreç akışını hiçbir açıdan değiştirmeyen yeni veri iç kontrol mantığıyla değerlendirmeye alınmıştır. Burada da ProM 6.9 programı üzerindeki eklentiler kullanılmıştır. İkinci bölümde satın alma programından alınan veriler (talebin açılışından, mal ve hizmet kabul aşamasına kadar uçtan uca süreçler), bazı başlıklarda inceleme için muhasebe programından alınan fatura verileriyle eşleştirilmiştir. Bu çalışmada iki ayrı programa ait veriler üzerinde süreç madenciliği uygulaması yapılması açısından da farklı bir bakış açısı gösterilmektedir. Muhasebe programından alınan fatura verileriyle, satın alma programından alınan veriler birleştirildiğinde ortaya çıkan en çarpıcı sonuç faturalanan 773 vakanın yalnızca 44 tanesinin akışa uygun şekilde ilerlediği gerçeğidir. Ayrıca tüm süreçler üzerinde hem performans hem de rol analizleri yapılarak, katılımcıların görev dışı aksiyonları tespit edilmiştir. İnceleme sonucu bulunan bulgular ve buna yönelik çözüm önerileri dördüncü bölümün sonunda paylaşılmıştır. Tüm incelemeden çıkartılacak en önemli sonuç; kullanıcı alışkanlıkları nedeniyle kaynaklanan usulsüzlüklerin giderilmesi adına satın alma programının geliştirilmesi ve organizasyonun da buna uygun olarak düzenlenmesidir.
Beşinci bölümde ise süreç madenciliğinin iç kontrol aracı olarak kullanılmasına yönelik uygulama ve süreç madenciliği literatüründeki bilgiler bir arada ele alınarak toplu bir değerlendirme yapılmış ve gelecekte önem kazanabilecek alanlara değinilmiştir.

Abstract:
The increasingly competitive environment and the gradual growth of digitalization cause the ways of doing business to change. While many processes are now being digitized, the importance of process management for companies is increasing day by day. This situation also increases the importance of process mining. Thanks to process mining, processes can be discovered, improved or managed. In an increasingly competitive environment, there is a growing interest in process mining because it helps to be open to enhance processes, to provide refined and accurate information based on data, and to improve existing processes. 

Processes regarding the real world are recorded as event logs via information systems. Process mining starts with the analysis of event logs. Basically, there are three types of process mining which are discovery, conformance checking and enhancement. The first step for the process mining is the discovery step. Generating a model from event logs constitutes the discovery method of the process mining. In the conformance check step, the comparison of an existing process model with the model obtained from the event log of the same process is made. This comparison reveals deviations between the real process and the modeled process. In other words, with the help of the conformance step, it is possible to check whether the actual flow recorded in the log is suitable for the model or vice versa. In the enhancement step, the model is enhanced based on the observed events after comparing an event log and the process model. In the conformance check step; while examining the deviations between the model and the reality, the enhancement method aims to change and improve this model in accordance with the reality. 
 
Process mining is mainly studied in 4 contexts. The first one is the context of the instance. In the context of the instance, there are rather less extensive relationships, such as the customer order, the type of the order and the size of the order. The second context can be described as the process context. The process context, on the other hand, serves to understand the observed behavior through different examples describing the same process. Processes cannot proceed independently of individuals. Thus, social context, which is described as the third context, characterizes people's influence on processes. There is a high tendency to leave out this context in today's process mining techniques. The last one is the external context. This one addresses the ecosystem in which the organization belongs beyond its control area and the factors stemming from that ecosystem. The scope expands from the context of the event to the external context, and the relationships become more complex.

There are three main perspectives in process mining applications. The first of these perspectives is the process perspective. Process perspective focuses on the processes extracted from the event log. Process perspective aims to find the answer for the question "How?". The second perspective is the organizational perspective. The organizational perspective focuses on the relationship between the information in the event log and the actors. Therefore, the organizational perspective intends to find an answer for the question "Who?". The third perspective is the case perspective. Case perspective deals with the characteristics of the cases and seeks for the answer to the question "What?".

Several different algorithms are used to perform process mining. These can be listed as alpha algorithm, heuristic algorithm, inductive algorithm, fuzzy mining algorithm and etc. Through these algorithms, conformance check in processes can be performed to make more realistic comments on processes. Structural improvements can be made in line with the present findings for all processes that have been checked within the scope of their conformance.

An internal control system is the system established to provide reliable and accurate information about an organization's activities, to increase efficiency, to determine the harmony between the policies and processes determined by the management and to report all of them correctly. Aforementioned systems basically aim to protect organizations' assets while minimizing the risks. Thanks to the control function, which is the last stage among management functions, organizations may eliminate several shortcomings with the feedback mechanism and take measures by predicting future threats.

In the literature reviews, process mining and internal audit or control activities are generally considered separately. Although process mining is mostly used to improve business processes, it can actually allow us to perform internal audit and control activities. The data recorded in the event logs are the most basic records that are in use. The most important point of these records is that they are registered automatically and are independent of the subject or persons subject to audit.  In this study, the two concepts are discussed together and it is proposed that process mining can be used as a tool in internal control activities.

The study consists of five chapters. Chapter 1 is an introductory chapter in which two different concepts are evaluated together.

Chapter 2 provides the literature on process mining including concepts. Starting with the definition of process mining, this section presents the types of process mining, the difficulties encountered, the guiding principles in process mining, the difficulties encountered in creating process models, conformance checking and some of the process mining algorithms. At the end of this section,the concept of process mining and the internal control have been examined together and the equivalents of these concepts in the literature have been explained. The ability of process mining, which is used to improve business processes, for performing control activities has been discussed.

Chapter 3 explains the methodology of data generation, which is applied in Chapter 4. The sample consists of the purchasing data made between June 2019 - October 2020. Also, the purchasing system of the company has been explained in this section. Afterwards, information on how the created data sets are created and how they are organized have been shared. All these data have been analyzed in ProM 6.9 program.

Chapter 4 presents the application phase. This chapter consists of three sections. In the first section, the company's purchasing process has been examined from a structural point of view. In this section, the raw data (1289 cases, 11.415 events) received from the procurement program have been subjected to various analyzes on ProM 6.9 and then the data have been run with process mining algorithms. The conformance check has been conducted among three of the four algorithms used (inductive algorithm, heuristic algorithm and alpha algorithm). As a result, the inductive algorithm has given the optimum result. Essentially, all the analyzes which have been made in the first section are for detecting the noise in the process. In the second section, the data to be analyzed in terms of internal control has been formed as a result of the analyzes provided in the first section. In the second section, the noise-free data have been analyzed with different add-ons on ProM 6.9 in a way that the processes will not change. Another important element of the second section is evaluating some analyzes by combining the data obtained from the purchasing program with the invoice data obtained from the accounting program. In this sense, a different perspective has been shown in terms of process mining applications on the data of two different programs. When the invoice data from the accounting program is combined with the data from the purchasing program, the most striking result is that only 44 of the 773 invoicing transactions proceed in accordance with the flow. In addition, the off-duty actions of the participants have been determined by performing both performance and role analyzes on all processes. In the performance analysis, the average completion time of the activities and the time for the people to take action on the basis of activity have been examined. By comparing the average completion time for each activity with the average completion time of the activities in problematic cases, it has been determined whether there are any unusual situations. Prior to the role analysis, the role-task matrix has been created and thanks to this matrix, users involved in transactions that are not within their authority have been identified. In addition, the network of relationships between users has been visualized using ProM 6.9 plugins, and these relationship networks have also been examined in problem cases.

At the end of Chapter 4, errors detected as a result of the analysis are summarized. The most important of these are the user habits that do not change despite the program. The resistance of user habits brings a series of involuntary organized violations. Mail flow continues instead of the program process for demands and orders. The control mechanism lacks in goods / service acceptance transactions. Authorizations to be used for special cases are used excessively due to the nature of the users. There is no mechanism that reports all these errors instantly. A series of suggestions that will regulate the program and the organizational structure for fixing these problems are discussed.

Chapter 5 provides a collective evaluation by considering the application and process mining literature for the use of process mining as an internal control tool. The study has had the opportunity to apply internal control and process mining concepts, which are considered as two different concepts in the literature, together in a case. This opportunity enables us to evaluate the perspective of using process mining as an internal control tool. In this section, the situations regarded as incomplete due to various restrictions but can be investigated more are stated. In addition, the future effects of the use of process mining as an internal audit and control tool and ideas about the research areas that may occur in line with this need in the future are stated.  In particular, the importance of process mining algorithms that can be carried out in internal audit activities in the future is emphasized.