In today’s highly competitive and heavily regulated business environment, organizations are expected to execute their business processes efficiently, consistently, and in full compliance with both internal policies and external regulations [1]. As organizations increasingly rely on information systems to support and automate operational activities, ensuring that these systems faithfully implement prescribed process rules has become a fundamental requirement for effective governance. Failures in process rule implementation may not only reduce operational efficiency but also compromise regulatory compliance, increase operational risk, and undermine the reliability of organizational data. Consequently, organizations require objective approaches for evaluating whether actual process executions and their corresponding system records accurately reflect intended business processes [2].

Business Process Management (BPM) provides a systematic framework for analyzing, monitoring, and continuously improving organizational processes. Over the past decade, BPM has increasingly embraced data-driven approaches that utilize operational data generated by enterprise information systems to support evidence-based decision making. Among these approaches, process mining has emerged as one of the most significant developments, enabling organizations to extract knowledge from event logs recorded by information systems [3]. By bridging the gap between process models and real process execution, process mining allows analysts to investigate how business processes are actually performed rather than relying solely on documented procedures or stakeholder perceptions [4]. Event logs generated by Enterprise Resource Planning (ERP), Customer Relationship Management (CRM), Workflow Management Systems (WfMS), and core banking systems provide valuable information regarding the sequence, timing, and execution of process activities. Unlike traditional process analysis techniques that depend primarily on interviews, workshops, or manual observations, process mining offers an objective, data-driven perspective that significantly reduces subjectivity while increasing the accuracy and reproducibility of process analysis.

Process mining comprises three principal categories of analysis: Process discovery, conformance checking, and process enhancement [5]. Process discovery automatically constructs process models directly from event logs without relying on prior knowledge of the underlying workflow. Process enhancement enriches existing process models with additional information such as performance metrics, organizational perspectives, or bottleneck analyses. Conformance checking, however, occupies a unique position because it evaluates the consistency between observed process executions and a predefined reference model representing the intended process [6]. By replaying event logs on a reference model, conformance checking systematically identifies deviations, missing activities, unexpected execution paths, and ordering inconsistencies while quantifying the degree of alignment between recorded behavior and prescribed process rules [7]. These capabilities make conformance checking particularly valuable in domains where strict procedural compliance is essential. The banking industry represents one of the most suitable application domains for conformance checking due to the complexity and regulatory sensitivity of its operational processes. Activities such as loan approval, customer onboarding, payment processing, anti-money laundering controls, and credit assessment involve multiple organizational units, authorization levels, and mandatory control procedures. Even seemingly minor deviations from prescribed execution sequences may expose financial institutions to operational failures, regulatory sanctions, financial losses, or reputational damage [8]. Consequently, banks continuously seek mechanisms for monitoring whether operational processes are executed according to established policies and regulatory requirements. Despite the abundance of operational data available in modern banking information systems, many organizations still depend on manual audits, periodic inspections, or static rule-based monitoring approaches, which often provide only limited visibility into actual process execution.

Although conformance checking has been widely applied for compliance assessment, relatively little attention has been devoted to evaluating whether process rules are correctly implemented within information systems. In practice, deviations identified during conformance analysis do not necessarily correspond to actual violations of organizational procedures. Instead, they may originate from the way activities are recorded, synchronized, or managed within operational systems. Delayed registration of completed activities, incomplete timestamps, manual data entry practices, or insufficient workflow constraints may produce apparent deviations even when employees perform the underlying business process correctly. Distinguishing genuine process violations from deficiencies in the implementation of process rules is therefore essential for correctly interpreting conformance checking results and avoiding misleading conclusions regarding organizational compliance.

To address this challenge, this study applies conformance checking to evaluate the implementation of process rules in the loan approval process of a major Iranian bank. A structured five-phase methodology is employed that combines qualitative process analysis with quantitative event-log analysis. The methodology consists of: 1) defining the scope of the target process through expert interviews and document analysis, 2) constructing a normative reference model representing the bank's prescribed procedures and business rules, 3) extracting, preprocessing, and validating event logs obtained from the operational information system, 4) performing conformance checking by replaying event logs against the reference model and systematically analyzing detected deviations, and 5) validating the findings through discussions with domain experts to determine the underlying causes of observed non-conformances and formulate practical recommendations.

Accordingly, the objectives of this research are threefold:

I. To evaluate the extent to which the implementation of process rules in the bank's information system reflects the prescribed business process.

II. To identify and analyze deviations detected through conformance checking and distinguish actual process violations from implementation-related inconsistencies.

III. To investigate the organizational and technological factors contributing to observed deviations and propose improvements that strengthen process rule implementation within the information system.

By achieving these objectives, the study contributes to both research and practice. From a research perspective, it demonstrates how conformance checking can be used not only to assess compliance but also to evaluate the implementation of process rules within operational information systems. From a practical perspective, the findings provide actionable recommendations for strengthening workflow controls, improving the reliability of recorded event data, and enhancing process governance within banking environments.

Conformance checking has emerged as a cornerstone of process mining, providing systematic techniques for comparing observed process behavior, as recorded in event logs, against prescribed behavior defined by reference models or rule sets. The fundamental premise is that deviations between actual and expected behavior may indicate fraud, malpractice, inefficiencies, or compliance risks. Over the past decade, alignment-based techniques have become the state of the art for conformance checking, enabling analysts to identify specific deviations—such as Moves on Log (MoL) (events observed but not permitted), Moves on Model (MoM) (required activities missing from the log), and Synchronous Moves (SM) (complete alignment)—while providing detailed diagnostic information [9].

A related body of work has focused on declarative compliance checking, where process behavior is constrained by rules rather than fully specified process models. These approaches treat compliance rules as constraints that process executions must satisfy, with patterns including occurrence constraints (e.g., existence or absence of activities), order constraints (e.g., response or precedence relationships), and temporal constraints that impose time-based restrictions. Augusto et al. [10] proposed efficient techniques for checking temporal compliance rules over business process event logs, addressing the challenge of interactive compliance checking in large-scale settings.

Recent work has extended conformance checking to handle complex real-world challenges. Raun et al. [11] addressed out-of-order event arrival and partial orders in streaming conformance checking, noting that manual recording of events, data corruption, or low timestamp precision can cause events within the same trace to be recorded with identical timestamps, creating partial orders that complicate conformance analysis. This challenge is particularly relevant in banking environments where manual data entry practices remain common.

The banking sector represents a particularly rich application domain for conformance checking due to the complexity, regulatory intensity, and operational sensitivity of its processes. Activities such as loan approval, customer onboarding, payment processing, and anti-money laundering controls involve multiple organizational units, hierarchical approvals, and mandatory control procedures, making them ideal candidates for systematic conformance analysis.

Several studies have applied process mining in banking contexts, though the majority have emphasized process discovery or performance analysis rather than systematic conformance evaluation. Moreira et al. [12] examined incomplete banking event logs using non-classical probability reasoning but concentrated primarily on process discovery rather than compliance assessment. Blevi et al. [13] investigated throughput times in a financial institution with a focus on customer experience optimization instead of conformance verification. Mongkolrob et al. [14] applied the Fuzzy Miner algorithm to banking workflows to detect bottlenecks but did not conduct detailed deviation analysis.

Other studies have incorporated more advanced or hybrid mining techniques. Bahaweres and Zakiyyah [15] applied multi-perspective mining, including control flow, resources, data, and temporal constraints, to enrich banking process models, demonstrating the value of guard-based control mechanisms. Šperka and Halaška [16] introduced the PPAFR framework, which integrates simulation and process mining to evaluate the feasibility of Robotic Process Automation (RPA) in banking processes, revealing that internal waiting times significantly restrict automation benefits. Marin et al. [17] proposed an integrated system combining process discovery and conformance checking for resource optimization in banking operations, demonstrating improved system performance through real-time process mining techniques.

Despite these efforts, several limitations characterize the existing literature. First, many studies rely on simplified, synthetic, or publicly accessible benchmark datasets, limiting their applicability to real banking environments characterized by noisy logs, diverse exception paths, concept drift, and rigorous regulatory requirements. Second, and more importantly for the present study, existing conformance checking research has predominantly treated deviations as indicators of process non-compliance or human error, with relatively little attention devoted to distinguishing genuine violations from implementation-related inconsistencies. This gap is significant because, in practice, deviations identified during conformance analysis do not necessarily correspond to actual violations of organizational procedures. They may originate from how activities are recorded, synchronized, or managed within operational systems—including delayed activity registration, missing timestamps, manual data entry practices, or insufficient workflow constraints. Distinguishing genuine process violations from deficiencies in the implementation of process rules is therefore essential for correctly interpreting conformance checking results and avoiding misleading conclusions regarding organizational compliance.

This study addresses these gaps by applying conformance checking not merely for compliance verification but as a diagnostic tool for evaluating the implementation of process rules within operational information systems. By systematically distinguishing between actual process violations and implementation-related inconsistencies, and by investigating the organizational and technological factors contributing to observed deviations, the present research contributes to the emerging literature on process mining for IT governance and system implementation evaluation.

This study adopts a structured five-phase methodology that combines qualitative process analysis with data-driven process mining to evaluate the implementation of process rules in a real banking environment. Rather than merely identifying deviations between recorded process executions and a reference model, the proposed methodology aims to determine whether detected non-conformances represent actual violations of prescribed process rules or originate from limitations in the implementation of those rules within the operational information system. The analysis is based on the control-flow perspective of process mining and utilizes event logs containing the essential attributes required for process reconstruction, namely Case ID, which uniquely identifies each process instance; Activity, representing the executed process step; and Timestamp, which records the execution time of each activity and enables both sequencing and performance analysis. Additional contextual attributes, when available, are also considered to facilitate interpretation of detected deviations. Phase 1. Process scoping and rule identification.

The first phase establishes the scope and boundaries of the target banking process. This includes identifying the process trigger, termination conditions, participating organizational units, process owners, and the information systems involved in process execution. Semi-structured interviews are conducted with domain experts, process owners, and system users to capture tacit operational knowledge, undocumented exceptions, and practical execution patterns that may not be reflected in formal documentation. In parallel, official process documentation—including organizational procedures, internal policies, Service-Level Agreements (SLAs), regulatory guidelines, and legal requirements—is reviewed to identify the prescribed process rules governing process execution. These rules define the expected sequencing of activities, mandatory control points, authorization requirements, and acceptable execution paths that later serve as the basis for conformance analysis.

Phase 2. Reference model construction.

The second phase focuses on constructing a normative reference process model representing the bank's intended loan approval process. The reference model integrates information obtained from both official documentation and expert interviews to ensure that it accurately reflects organizational practice while remaining consistent with documented regulations.

Besides modeling the activity flow and decision points, particular attention is devoted to explicitly representing process rules, including mandatory activities, permissible execution sequences, synchronization points, and approval constraints. This reference model serves as the benchmark against which actual process executions are evaluated.

Phase 3. Event log extraction and preparation.

The third phase involves extracting event data from the bank's operational information systems. Since raw operational data are typically distributed across multiple system tables and may contain inconsistencies, substantial preprocessing is required before process mining can be performed.

Data preparation includes attribute selection, event correlation, timestamp validation, duplicate removal, missing value handling, and standardization of activity names to produce a consistent event log suitable for analysis. This phase is particularly important because the quality of conformance checking results directly depends on the quality and completeness of the underlying event data. Poor data quality may generate apparent deviations that do not necessarily correspond to actual process violations, making rigorous preprocessing an essential prerequisite for reliable analysis.

Phase 4. Conformance checking and deviation analysis.

In the fourth phase, conformance checking is performed by replaying the prepared event logs against the predefined reference model. Alignment-based analysis is employed to compare observed process exe cutions with the expected execution behavior defined by the process model. The analysis identifies deviations such as missing activities, unexpected execution paths, incorrect activity ordering, repeated activities, and temporal violations.

To evaluate the implementation of process rules, the detected deviations are analyzed using multiple conformance indicators, including variant analysis, fitness measures, execution frequencies, and process performance metrics. However, unlike traditional compliance-oriented studies, deviations are not immediately interpreted as evidence of process violations. Instead, they are treated as indicators requiring further investigation, recognizing that discrepancies between recorded and expected behavior may also result from system implementation characteristics, delayed activity registration, incomplete event recording, or manual operational practices.

Phase 5. Root cause analysis and improvement recommendations.

The final phase consists of validating the analytical findings through collaborative discussions with process owners, operational personnel, and domain experts. The objective of this phase is to determine the underlying causes of the detected deviations and distinguish genuine process violations from implementation-related inconsistencies. Based on this analysis, practical recommendations are formulated to improve the implementation of process rules within the banking information system. These recommendations may include strengthening workflow constraints, preventing progression to subsequent activities before mandatory tasks have been properly recorded, improving event registration mechanisms, redesigning selected process components, or providing targeted training for system users. By combining conformance analysis with expert validation, the proposed methodology supports both accurate compliance assessment and continuous improvement of process rule implementation.

Overall, the proposed methodology integrates qualitative organizational knowledge with quantitative event-log analysis to provide a comprehensive evaluation framework for banking processes. Beyond identifying deviations, it enables organizations to investigate their underlying causes and determine whether observed non-conformances originate from actual business process violations or from deficiencies in the implementation of process rules within operational information systems.

In this research, a case study was conducted on the loan approval process of a leading Iranian bank. The loan approval process is one of the most critical banking operations, aimed at providing financial facilities to eligible customers while ensuring risk management, regulatory compliance, and operational efficiency. Conformance of this process with business rules and internal regulations is particularly important, as deviations may lead to financial, operational, or reputational risks. Being a core banking process, it directly affects both customer satisfaction and the bank’s operational integrity. In the studied bank, the loan approval process begins with the registration of the applicant's request at the branch. After an initial review, the branch's proposal is sent to branch management for approval, where experts prepare the initial assessment report. The case is then referred hierarchically to the head of the branch management unit and subsequently to the branch management committee. Upon approval at this level, the case enters the General Credit Department, where experts commence the supplementary review. If document deficiencies are detected, the case follows an exception path in which the credit department expert communicates the deficiencies, and the branch expert rectifies them before resubmission. In the main process path, the completed expert report is referred to the head of the general credit department and subsequently to the Credit Committee, which makes the final decision on loan approval or rejection.

The dataset for this study includes event data capturing the loan approval process from the initial application registration to final committee decision. The extracted event log consists of 9,966 events corresponding to 774 loan cases, recorded over the first six months of 2024 (January to June) in the bank’s operational systems. Data preprocessing involved several steps to ensure accuracy and consistency for process mining analysis. Incomplete events or records missing timestamps were removed, as accurate timestamps are essential for reconstructing event sequences, calculating case durations, and performing conformance analysis. Activity names were standardized to eliminate variations caused by inconsistent data entry or system differences, preventing duplicate nodes and noise in the discovered process model. Only fully completed cases were included in the analysis to avoid misinterpreting incomplete traces as deviations. This resulted in a final dataset structured with three primary fields: Case ID, Activity Name, and Timestamp, making it compatible with process mining tools. Process rules and regulatory requirements were derived from interviews with domain experts and an in-depth review of internal process documentation. This information was used to create a reference model representing realistic process flows, ensuring that the analysis was based on a valid operational framework. The preprocessed dataset was then loaded into the BehfaLab process mining tool, where process discovery was conducted to produce a comprehensive process map. This map included both the main and exceptional paths, observed repetitions, and actual execution patterns. The process model served as the basis for conformance checking, which involved validating the conformance of the observed process against the defined rules. Both activity sequence and temporal compliance were assessed, with valid execution variants defined in the system as acceptable paths.

The conformance analysis revealed substantial differences between the normative reference model and the recorded process executions. While the reference model defined only three valid execution variants, the event log contained 27 observed variants, of which 24 deviated from the prescribed process rules. Although the number of invalid variants appears relatively small in absolute terms, it is significant considering that the loan approval process is supported by an operational information system intended to guide and control process execution. Consequently, the existence of numerous unexpected execution paths prompted a more detailed investigation into whether these deviations reflected actual violations of process rules or deficiencies in their implementation within the information system.

Among the 774 analyzed loan cases, 492 cases (63.6%) fully conformed to the reference model, whereas 282 cases (36.4%) contained at least one detected deviation. A detailed examination of these non-conforming cases revealed three primary deviation patterns.

The first pattern consisted of 148 cases (52.4% of non-conforming traces) in which additional activities were recorded after the final approval decision. Since these activities occurred after the logical completion of the process, they could not represent legitimate execution behavior. Discussions with process owners confirmed that these events corresponded to activities completed earlier but registered in the information system after the process had already finished. Therefore, these deviations reflected delayed activity registration rather than violations of the prescribed process rules.

The second deviation pattern involved 17 cases (6.0% of non-conforming traces) with apparently missing activities. Further investigation demonstrated that the missing activities had in fact been performed but were absent from the event log due to user oversight or limitations of the operational system. Consequently, these deviations represented deficiencies in event recording rather than failures in process execution.

The third and most frequent deviation pattern was observed in 265 cases (94.0% of non-conforming traces), where all required activities were present but appeared in an order different from that prescribed by the reference model. Initial conformance checking suggested sequence violations. However, interviews with operational personnel revealed that employees generally completed the activities in the correct operational order but postponed recording their completion in the information system. As a result, the event log reflected an execution sequence that differed from the actual business process. This finding demonstrates that sequence deviations identified through conformance checking should not automatically be interpreted as process rule violations, as they may instead reveal shortcomings in the implementation and use of the supporting information system.

To further investigate process conformance, three alignment-based indicators were analyzed: MOL, MOM, and SM. MOL represents events observed in the event log but not permitted by the reference model, indicating unexpected recorded behavior. MOM identifies activities required by the reference model that are absent from the event log, revealing missing recorded executions. SM measures activities that appear in both the reference model and the event log in the expected execution order, indicating complete alignment between recorded behavior and prescribed process rules.

The alignment analysis showed that early process stages—including applicant submission, branch recommendation, regional entry, and branch management assessment report—achieved perfect conformance (SM = 774, MOL = 0, MOM = 0), reflecting highly standardized execution supported by well-established operational procedures. In contrast, deviations became increasingly concentrated in the later approval stages, particularly head office assessment report, referral to head office manager, and refe rral to head office credit committee. These activities involve multiple organizational units, manual documentation, and hierarchical approvals, thereby increasing the likelihood of delayed activity registration and inconsistent event recording. Similarly, activities such as referral to branch management committee, head office credit entry, and Referral to Head Office Analyst exhibited comparatively higher deviation frequencies. Rather than indicating systematic non-compliance, these deviations primarily reflected operational practices in which process execution and event registration occurred asynchronously. exception-handling activities—including deficiency notification and document completion—displayed relatively low synchronous move counts because they were executed only for a limited subset of cases. Nevertheless, their corresponding deviation rates remained minimal, indicating that exception handling itself was implemented consistently whenever required.

Temporal analysis provided additional insight into the implementation of process rules. Among the analyzed cases, 233 loan applications (31.3%) exceeded the bank's prescribed two-month processing period, while 27 cases required more than four months to complete. The principal bottlenecks were identified in the credit department expert report, head office assessment report, and branch management assessment report stages. Discussions with process stakeholders indicated that these delays were largely attributable to manual report preparation, departmental workload, and the absence of automated workflow controls rather than deficiencies in employee performance. Consequently, the observed temporal deviations pointed to weaknesses in workflow implementation and system support rather than failures to comply with organizational procedures. The collaborative validation sessions conducted with process owners and system administrators proved essential for interpreting the detected deviations. Although conformance checking successfully identified discrepancies between recorded executions and the reference model, the subsequent root-cause analysis demonstrated that the majority of these discrepancies originated from delayed event registration, incomplete event recording, and insufficient workflow constraints within the operational information system. Therefore, the apparent non-conformances identified by the process mining analysis did not necessarily correspond to actual violations of process rules .

Based on these findings, the bank initiated several corrective actions aimed at strengthening the implementation of process rules within its information system. First, historical cases containing identified inconsistencies were reviewed to determine the exact causes of the recorded deviations and improve the reliability of operational data. Second, the bank decided to introduce additional workflow constraints that prevent users from progressing to subsequent activities before mandatory tasks have been formally completed and recorded. Finally, automated controls were planned for critical approval activities, particularly Head Office Assessment Report and Branch Management Assessment Report, to reduce manual intervention, minimize delayed registrations, and improve the consistency between actual process execution and its representation in the event log.

Overall, the results demonstrate that conformance checking provides value beyond traditional compliance assessment. In addition to identifying deviations from prescribed process models, it enables organizations to evaluate whether process rules have been effectively implemented within operational information systems. The findings further highlight the importance of complementing quantitative conformance analysis with qualitative root-cause investigation before interpreting detected deviations as evidence of process non-compliance. This capability represents the principal contribution of the present study and illustrates how conformance checking can support both process governance and continuous improvement of workflow implementation .

This study presented a structured methodology for evaluating the implementation of process rules through conformance checking in a real banking environment. By integrating qualitative process knowledge with quantitative process mining techniques, the proposed approach provides a systematic framework for comparing recorded process executions with a normative reference model while investigating the underlying causes of detected deviations. Unlike conventional conformance analyses that primarily focus on identifying non-compliant behavior, the proposed methodology emphasizes the interpretation of detected deviations to determine whether they represent genuine process rule violations or deficiencies in the implementation of those rules within the supporting information system. The methodology was evaluated through a case study of the loan approval process in a leading Iranian bank. Conformance analysis initially revealed a considerable number of deviations between the observed event logs and the reference process model. However, subsequent root-cause analysis demonstrated that the majority of these deviations did not originate from incorrect execution of the business process. Instead, they were primarily caused by delayed activity registration, incomplete event recording, manual reporting practices, and insufficient workflow constraints within the operational information system. These findings highlight the importance of complementing quantitative conformance analysis with qualitative investigation before interpreting detected deviations as evidence of process non-compliance. The study therefore contributes to the process mining literature in three important ways. First, it demonstrates that conformance checking can be employed not only for compliance assessment but also for evaluating the implementation of process rules within operational information systems. Second, it illustrates the importance of distinguishing actual process violations from implementation-related inconsistencies, thereby reducing the risk of drawing incorrect conclusions from conformance analysis alone. Third, it shows how the outcomes of conformance checking can be translated into practical system improvements by identifying opportunities to strengthen workflow constraints, improve event recording practices, and enhance the reliability of process execution data.

From a practical perspective, the proposed methodology provides organizations with a structured approach for evaluating whether operational information systems accurately reflect intended business processes. In the presented case study, the findings enabled the bank to identify implementation weaknesses that were not apparent through conventional monitoring approaches and to define corrective actions aimed at strengthening workflow controls, improving data quality, and increasing process traceability. These improvements are expected to enhance both operational efficiency and process governance while reducing the likelihood of artificial deviations caused by inconsistent system usage. Despite these contributions, the present study has several limitations. The empirical evaluation was conducted using event logs from a single banking process within one financial institution, which may limit the generalizability of the findings to other organizational contexts. Furthermore, the analysis focused primarily on the control-flow and temporal perspectives of conformance checking, while other perspectives, such as organizational, resource, and data conformance, were beyond the scope of this research. Future research may extend the proposed methodology in several directions. First, the approach can be validated across additional banking processes and other highly regulated domains, such as healthcare, insurance, and public administration, to evaluate its broader applicability. Second, future studies could incorporate multi-perspective conformance checking by combining control-flow analysis with organizational, resource, and data perspectives to provide a more comprehensive evaluation of process rule implementation. Third, investigating predictive process monitoring techniques capable of identifying potential implementation deficiencies before they result in observable deviations represents another promising research direction. Finally, evaluating the proposed methodology after implementing the recommended workflow constraints would enable researchers to quantitatively measure their impact on process compliance, event-log quality, and overall operational performance.

Overall, this study demonstrates that conformance checking should not be viewed solely as a mechanism for detecting process deviations. When combined with systematic root-cause analysis, it becomes a powerful approach for evaluating the implementation of process rules, improving operational information systems, and supporting continuous process governance in complex organizational environments.