Process mining on SAP tables, with no system integration
Internal audit could not see how purchase-to-pay and order-to-cash transactions really moved through SAP. We built the event log straight from SAP tables, so every case is traced from order to payment.
From our own project and product work. Client names and identifying details are removed, and some figures are rounded.
The situation
Internal audit could not easily see how purchase-to-pay and order-to-cash transactions moved through SAP. Delays and bypassed controls were hard to spot, and testing relied on samples. Process mining tools usually need a system-level integration, which takes time and approvals.
How we built it
- Build the event log from tables. KNIME workflows turn document headers, items and change records into one log: case, activity, time and user, with the company code, vendor or customer and value alongside.
- Link each case. Each document is chained to the one that follows it in SAP's document flow. An order, its goods receipt, invoice and payment become one case, even when deliveries are split or invoices combined.
- Analyse. Python computes the process variants, the time between each step and a set of rule checks.
- Show it. A web dashboard goes from the process map down to the individual document. PostgreSQL holds the log and the results.
Users can start in two ways: upload the SAP tables the application lists for the process, or upload an event log they already have as CSV or Excel.
The rule checks
| Check | What it flags |
|---|---|
| Invoice before goods receipt | Payment risk before delivery is confirmed |
| Payment before invoice | Money out with no bill |
| Delivery or billing with no order | Sales outside the approved flow |
| Same user posts and approves | A segregation-of-duties breach |
| Long waits between steps | Where cases get stuck |
What happened
- Every recorded transaction was covered, not a sample.
- Invoices posted before the order or the goods receipt were found, some posted and approved by the same user.
- The longest wait was between releasing a requisition and creating the order, which pointed to low-risk requisitions that could be automated.
What changed
- No integration needed. The whole method runs on table extracts, so it can start in days.
- One case, end to end. Split and combined documents still resolve to one traceable case.
- From samples to the full flow. Auditors see every path, including the ones nobody designed.
Products and services
The Audit Suite runs process checks across every transaction. See AI accelerators and audit effort.