Skip to content
Prozesstransparenz

Reading processes from system data: where it snags

How to reconstruct the actual workflow - loops and special paths included - from the timestamps your systems already record, instead of guessing or estimating.

13 min read Process MiningProzesstransparenzAutomatisierungMittelstandEreignisprotokoll

In most companies there are two versions of every workflow: the one written in the quality manual, and the one actually lived. The first is a clean flowchart with a single path from left to right. The second contains loops, rework, rush routes, waiting times and special cases nobody wrote down - and that is exactly where the time goes. Anyone who wants to improve a process first has to know how it really runs. Interviews and workshops give a flattering picture, because people describe the intended path, not the daily one. The more reliable source has long been in the house: the timestamps that ERP, inventory management, ticketing and document storage record automatically at every step. From them the real workflow can be reconstructed. This article shows how that works, what becomes visible and where caution is needed. How we support such a recording in a project is set out under process analysis.

Key takeaways

  • Every step in a business system leaves a timestamp. Line those traces up per case and you get the actual workflow - not the described one. The gap between the two is the real finding.
  • An event log needs only three details: a case id, the name of the activity and the timestamp. Those three columns already exist in almost every ERP, inventory system and ticketing tool.
  • Three things become visible that stay hidden in an interview: loops and rework, special paths and variants, and waiting times between steps. Usually more time sits in the waiting than in the work itself.
  • Figures from timestamps are only as complete as what the systems record. Manual work beside the system, media breaks and a quick word across the room do not appear - so the findings always have to be checked back with the team.
  • Where employee data is touched, data protection and, where present, the works council belong in early. The workflow is analysed, not the individual person - that line decides whether the analysis is accepted.

Why interviews and flowcharts miss the real workflow

Anyone recording a process asks the people involved first - and gets an honest but incomplete answer. People describe the workflow as it is meant to be: order comes in, gets checked, approved, delivered, invoiced. What they systematically leave out are the exceptions that have become so ordinary they no longer register. The rush order pushed forward by phone. The query to accounting that leaves a case waiting for two days. The approval that is regularly withdrawn and reissued. These patterns belong to the daily routine, but not to the story people tell about it.

The fault is not bad faith but the way memory works. The standard case is present because it is frequent; the special case is suppressed because it is uncomfortable. A flowchart drawn from such conversations therefore shows the main path in high resolution and the deviations not at all. Yet the deviations are exactly what makes a process slow, expensive and error-prone. Surveys regularly name a lack of process transparency as one of the biggest obstacles to automation; the Deloitte study on the subject lists process transparency at 51 percent (Deloitte) as the main benefit of process mining, ahead of ongoing process monitoring at 41 percent (Deloitte).

There is also the effort. A thorough interview-based recording ties up people from several departments over weeks - and digitisation in mid-size companies most often fails for lack of time anyway: 60 percent (Bitkom) of firms name it as an obstacle, alongside 74 percent (Bitkom) citing the skills shortage. Building the recording instead from data the systems already produce saves exactly that time. That is the core of what the term process mining covers - and the reason Gartner expects 25 percent (Gartner) of organisations worldwide to use such methods by 2026.

Process transparency is not an end in itself

The point is not a pretty diagram but the decision behind it: is an automation worth it, where does an interface bring the most, which step has become redundant? Such questions can only be answered once the actual workflow is known. Deloitte reports that 84 percent (Deloitte) of users draw value from process mining - above all as more transparency and dependable operational insight. The road there does not start with software, but with a clear question.

What the timestamps hold: the event log

The basis is unspectacular: a table in which each row describes a single event. Three details are enough. First a case id that ties all the steps of one case together - an order number, a ticket number, a document number. Second the name of the activity, what happened: created, checked, approved, shipped. Third the timestamp, when it happened. With those three columns, the sequence of steps can be reconstructed for every case - and across thousands of cases, the pattern they follow.

This data is almost always already there, usually without anyone perceiving it as process data. An ERP logs the status changes of an order. A ticketing system records every state change. A document store notes when a receipt arrived, was checked and was posted. Even accounting, with its document date, approval date and payment date, already holds a usable log. The effort is not in the recording but in the joining: recognising the same case id across several systems. That is exactly what data integration is about, and the same question arises when you connect two systems through an interface.

Event log of one order (example, shortened)
Case   | Activity        | Timestamp     | Handler
-------+-----------------+---------------+-------------
A-1042 | Order created   | 12 Aug 08:12  | Sales
A-1042 | Credit checked  | 12 Aug 09:40  | Accounting
A-1042 | Approved        | 12 Aug 10:05  | Management
A-1042 | Checked again   | 12 Aug 14:20  | Accounting   <- loop
A-1042 | Picked          | 13 Aug 09:15  | Warehouse
A-1042 | Shipped         | 13 Aug 11:50  | Warehouse
A-1042 | Invoiced        | 13 Aug 16:30  | Accounting

Three columns are enough: a case id that ties the steps of one case
together, the name of the activity and the timestamp. The fourth value
(handler or department) is optional and shows between which desks a case
bounces. The 14:20 line reveals the rework: checked, approved - and then
checked once more.

The example shows a single order. It gets interesting when you lay the same structure over every order of a quarter. Then you see how often the line checked again appears, how many cases pass through the approval step twice, and between which two steps the longest wait sits. A single story becomes a statistic - and the gut feeling that always takes forever becomes a verifiable number.

Making loops, special paths and waits visible

Once the workflow is built from data, three kinds of pattern emerge that a drawn diagram never contains. The first is loops and rework: cases that pass through a step more than once. An approval that gets withdrawn. An invoice that is cancelled and reissued. A check that becomes necessary a second time because a detail was missing. Every loop is duplicate work, and its frequency can be quantified exactly. In the example log, the share of orders checked twice sits at around a fifth - not a law of nature, but a hint of a missing detail earlier in the workflow.

The second pattern is special paths and variants. The described process knows one path; the lived one often knows dozens. Orders that skip the credit check because they are flagged urgent. Receipts posted directly, past the approval. Customers created without a customer number. Each variant on its own may be rare, but together they make up a substantial share - and they are precisely what stops a workflow from being automated as long as nobody knows about them. Anyone wanting to know which processes to tackle first will find a good initial filter in the number of variants.

The third pattern is waiting times. Between two timestamps sits the wait, and it is almost always longer than the actual work. A receipt is posted in seconds but sits three days in the inbox first. An order is picked in minutes but waits half a day for approval. These gaps can be calculated straight from the timestamps. They are the fastest route to noticeable improvements because they need no new software - the same logic sits behind the idea of shortening lead times through the waiting time rather than through faster processing.

Loops and rework

How often does a case run twice through the same step? Every loop is duplicate work and a hint of a missing detail or rule earlier in the workflow.

Special paths and variants

How many different paths does the same case type really take? A high number of variants is the main reason a planned automation fails in practice.

Waiting times

Between which two steps does a case wait longest? The difference in timestamps shows the wait - usually the largest and cheapest lever.

Ping-pong between desks

How often does a case bounce between two departments? Frequent handovers point to an unclear responsibility or a missing piece of information.

Drop-offs and dead ends

Which cases never reach the end? Cases stuck in an intermediate status reveal gaps that nobody reports in day-to-day work.

Load peaks over time

When do certain steps pile up? Timestamps show patterns by weekday and month-end and explain why one desk regularly becomes the bottleneck.

From question to result: the steps

An analysis from system data does not start with a tool but with a question. Without one, even the finest process diagram is just busywork. The question decides which case type is examined, which systems are relevant and how the result will be recognised. Good questions are narrow: why does order handling from receipt to dispatch take longer on average than promised? Where do incoming invoices get stuck between arrival and approval? How many complaints run through processing a second time? From such a question everything else follows almost by itself.

It starts with a concrete, answerable question about one workflow - not the wish to see everything at once. It sets the case type, the period and the success criterion. Without that focus, the analysis becomes arbitrary.

The fifth step matters most and is skipped most often. Data shows what happened, not why. A loop can be waste or a deliberate second-pair-of-eyes control. A waiting time can be a failing or a legally required period. Without the conversation with the people who run the workflow, every figure quickly leads to the wrong conclusion. How such a recording is structured in a company is described in the article on how a process analysis works step by step.

Measured, not estimated: the difference in practice

The value of the method shows most clearly in comparison. Both routes produce a picture of the workflow, but they differ in what you can rely on. The following comparison sums up where the data-based recording holds and where the conversation is still needed - because one does not replace the other, it complements it.

AspectRead from timestampsEstimated from interview
BasisActual events with a timeMemory of the intended flow
Special casesFully visible, with frequencyUsually forgotten or understated
Waiting timesMeasurable to the hourRough guess, often too low
Effort for the companyOne-off data provisionWeeks of meetings across departments
Blind spotSteps outside the systems are missingThe lived path gets flattered
RepeatabilityRe-run at any timeA new picture each round

The blind spot of data analysis deserves special attention: it only sees what is in a system. If part of the workflow is handled by a quick word, on paper or in a private spreadsheet, it does not appear in the log - and the workflow looks faster than it is. Exactly these breaks between system and manual work are a topic of their own; how to find them systematically is shown in the article on media breaks in your company. Data analysis reveals them indirectly, because where the manual work sits, an unexplained gap opens up in the timeline.

What the figures do not say - and where caution applies

As useful as timestamps are, they have limits, and anyone who overlooks them draws the wrong conclusions. The first limit is data quality. A status change set after the fact, a timestamp in the wrong time zone, a batch posting run at midnight - such artefacts create patterns that do not exist in the business at all. That is why every serious analysis starts with a check of the data itself, not of the workflow. Only once it is clear that a timestamp really captures the moment of the event may anything be derived from it.

The second limit is confusing frequency with importance. A rare special path can be more expensive than the common standard case if a large order or a complaint hangs on it. And a long waiting time is not automatically a problem - sometimes it is a sensible cooling-off phase or a statutory deadline. Figures do not replace judgement, they sharpen it. Deloitte notes that lack of management backing is a growing hurdle: 41 percent (Deloitte) name it as an obstacle, up from 26 percent (Deloitte) a few years earlier. An analysis nobody can interpret fizzles out.

Employee data: draw the line clearly

Timestamps often carry a handler name. In theory that would let you measure the performance of individuals - and that must not be the goal. The workflow is analysed, not the person. Where a works council exists it belongs in early; assessing the data-protection position in a specific case remains a matter for professional advice. How to plan co-determination cleanly is covered in the article on the works council in IT projects, and the data-protection side in the article on data protection when digitising processes. Drawing this line early and in writing decides whether the whole analysis is accepted.

The third limit is scale. The market for such methods is growing strongly - estimates put it at an annual rate of around 21.7 percent (MarketsandMarkets), and spending recently rose by over 30 percent (Gartner) in a year. For a mid-size company, though, that does not mean a large platform is needed. For a single, clearly framed question, a data export and a manageable analysis are often enough. The value comes from the right question and the sound cross-check, not from the size of the tool.

From finding to improvement

An analysis that ends in a report has not earned its keep. The point lies in the decisions it enables - and those usually fall into one of four directions. A loop is removed by asking for the missing detail earlier. A waiting time is shortened by allowing an approval to pass to a deputy. A media break is closed by connecting two systems through an interface. Or a recurring, cleanly running step is automated, because the analysis shows it runs without variants.

  • Remove the loop: the most common cause of double checks is a detail asked for too late. Make it mandatory at creation and the second round disappears - a change without new software.
  • Shorten the waiting time: where cases wait on a single approval, an arranged deputy helps more than any speed. The wait from the timestamps shows which approval is worth it.
  • Close the media break: where an unexplained gap opens in the timeline, manual work sits there. An interface or an automation at exactly that point saves the most.
  • Automate a step: if a step runs the same way in nearly all cases and without variants, it is a good candidate. The number of variants from the analysis is the best suitability test.
  • Relieve the bottleneck: if a load peak shows up at fixed times, work can be brought forward or spread out before extra capacity is even considered.
  • Re-measure the effect: after every change the same analysis is repeated. That makes it provable whether the loop really became rarer and the wait really shorter.

The last point is the real advantage of the method over the interview: it is repeatable. The same analysis, re-run a quarter later, shows whether a measure worked - without a new round of meetings. That turns a one-off recording into an ongoing check, which can be carried over into a regular metrics and reporting routine. Whether an automation pays off at all then no longer hangs on a gut feeling but on measured figures; the calculation behind it is described in the article on bottlenecks in order processing.

A small start beats the big project

You do not have to measure the whole company. A single, well-chosen workflow - order handling, invoice intake, complaint processing - is enough as a starting point. From it the company learns what its own data looks like, which questions it answers and which it does not. This first, manageable run almost always delivers a concrete finding that justifies the effort, and it lays the ground to tackle the next workflow faster.

What a company can prepare itself

The larger part of a successful analysis lies in the preparation, and any company can do that itself - before anyone even looks at the data. Working through the following list shortens the actual analysis considerably and produces a more dependable result at the end. None of it needs specialist knowledge; it only needs an honest look at your own systems and your own workflow.

  1. Write down one concrete question: which workflow, which period, how will you recognise the result? Without that focus no meaningful analysis begins.
  2. Name the systems involved: which system touches the case at which point, and does it hold a timestamp? A simple list is enough.
  3. Check the shared case id: can the same case be recognised across all systems? If not, that is already the first important finding.
  4. Pull out two or three real example cases: a standard case, a special case, a particularly stubborn one. They help check the data against reality.
  5. Settle data protection and co-determination early: where employee data is touched, works council and data protection belong at the start, not the end.
  6. Schedule a session for the joint cross-check: the analysis is only finished once the people doing the work have interpreted the findings.

The most expensive process is the one everyone believes they know. The timestamps almost always disagree - and that disagreement is not a nuisance but the cheapest improvement a company can get.

Project experience

Anyone using this recording as a starting point can derive the next steps deliberately - from automating a cleanly running case to connecting two systems. Adjacent everyday topics can be approached just as soberly: for instance automating dunning to get paid faster, or rolling out digital time tracking cleanly. In every case the same principle holds: know the real workflow first, then decide.

This article is based on data from: Gartner, the Deloitte Global Process Mining Survey, Bitkom, the German Chambers of Commerce (DIHK), MarketsandMarkets and our own project experience from process analyses in mid-size companies.

Related Articles

Forderungsmanagement

Automating dunning: reach the money in the bank sooner

How a rule-based dunning run staggers reminders automatically, links invoicing and accounting and shortens days sales outstanding - explained step by step.

13 min read
Recht und Prozesse

Digital time tracking 2026: meeting the mandate cleanly

Recording working time is mandatory; the electronic form arrives in 2026. Implement it digitally: mobile capture, automatic rules, clean handover to payroll.

14 min read
Automation & interfaces

Interface or manual work: doing the maths

When does an interface pay off and when is manual work cheaper? A decision framework based on volume, frequency and error rate, plus the interim steps.

13 min read