Most quality systems I walk into have the same quiet problem. The process maps on the wall describe how work is supposed to happen, the management review slides describe how work happened on average last quarter, and nobody in the room can say how work is actually flowing through the system on a Tuesday afternoon. Process mining closes that gap, and ISO 9001:2015 gives you more than enough reasons to use it.
This guide covers what process mining is, where it fits against specific clauses of ISO 9001:2015, how to start without buying an enterprise platform, and how to keep auditors comfortable with the evidence it produces.
What Is Process Mining, and How Does It Differ From Ordinary Analytics?
Process mining reconstructs how a process really runs from the timestamped records that your business systems already create. Every ERP, CRM, ticketing tool, MES, or quality management system writes down who did what to which case and when. Stitch those records together and you get a picture of the actual path each order, complaint, or nonconformance took, including the detours.
Ordinary analytics tells you a number: average cycle time, defect rate, on-time delivery. Process mining tells you why the number looks the way it does by showing the route. The field is usually described through three activities: discovery (building the as-is model from data), conformance checking (comparing the real path to the intended one), and enhancement (using the findings to improve the model and the process). The IEEE Task Force on Process Mining published a Process Mining Manifesto in 2011 that set out these categories, and IEEE 1849 (the XES standard; use the current edition) defines the event log format that most tools read.
The minimum data you need is an event log with three columns: a case ID, an activity name, and a timestamp. Resource, cost, and outcome fields make it better, but those three are enough to start.
Where Does Process Mining Fit in ISO 9001:2015?
The standard does not mention process mining. It does, however, ask for things that process mining happens to deliver well. The table below maps the clauses I most often use.
| ISO 9001:2015 clause | What it requires | What process mining contributes |
|---|---|---|
| 4.4.1 | Determine processes, their sequence and interaction, and criteria and methods for effective operation and control | Discovered process models show the real sequence and interactions, not the documented ones |
| 6.1 | Plan actions to address risks and opportunities | Variant and rework analysis highlights where risk is already showing up in the data |
| 8.5.1 | Control of production and service provision under controlled conditions | Conformance checking tests whether controlled steps were actually performed, and in order |
| 9.1.1 | Determine what needs to be monitored and measured, and the methods used | Event-log-derived measures such as throughput time, rework loops, and handoff delays |
| 9.1.3 | Analyze and evaluate appropriate data and information | Root-cause views of where delay and deviation concentrate |
| 9.3.2 | Management review inputs, including process performance and conformity | Dashboards built from live data in place of quarterly averages |
| 10.2.1 | React to nonconformity and take corrective action, determine causes | Case-level traces show where in the flow the failure started |
| 10.3 | Continually improve suitability, adequacy, and effectiveness | A repeatable way to find, prioritize, and verify improvements |
Clause 9.1.3 is the one I lean on most. It lists the topics that analysis should address, among them conformity of products and services, customer satisfaction, performance and effectiveness of the QMS, whether planning was implemented effectively, and the performance of external providers. Process mining can feed several of those at once, particularly the effectiveness of planning and the performance of external providers, because both leave timestamps behind.
Clause 10.3 says the organization shall consider the results of analysis and evaluation and the outputs from management review to determine needs or opportunities that shall be addressed as part of continual improvement. A mined process gives you a ranked, evidence-backed list of opportunities, which is a much better input to that decision than a brainstorm.
What Problems Does Process Mining Actually Find?
Four patterns come up again and again, and each one maps to something an auditor will care about.
Rework loops. A complaint reopened three times, an order that bounces between credit review and sales, a nonconformance report sent back for more information. Loops are invisible in averages but obvious in a process graph.
Process variants. In my project experience it is common to find dozens of distinct paths through what the procedure describes as a single flow. Often most volume sits in a few variants, and the long tail is where the deviations hide.
Bottlenecks and waiting time. In many service and administrative processes, waiting accounts for more elapsed time than working. Event timestamps let you measure the wait between steps, which is the number nobody usually has.
Skipped or out-of-order controls. Suppose your procedure says inspection comes before release and the data shows 6 percent of lots released first (an illustrative figure). That is a conformance problem a sampling-based internal audit could easily miss. That does not make internal audits obsolete. It makes them better targeted, which I will come back to.
How Do You Start a Process Mining Project Under ISO 9001?
You do not need a seven-figure platform. Here is the sequence I recommend.
1. Pick one process tied to a quality objective
Clause 6.2 requires quality objectives that are measurable (if practicable) and monitored. Choose a process that supports an objective you already track and that is not performing the way you want. Order-to-delivery, complaint handling, and nonconformance closure are common first choices. If you need ideas for objectives worth tying to, our quality objectives examples article is a decent starting point.
2. Confirm the data exists
Ask the system owner a plain question: does each record carry a case identifier and a timestamp for each status change? If the answer is yes, you can mine it. If the answer is no, that finding is itself useful, because clause 9.1.1, which asks you to determine what needs to be monitored and measured, points toward fixing the data capture first.
3. Extract and clean a log
Pull enough closed cases to show the normal range of behavior. As a rough rule of thumb, a few hundred cases is a workable minimum and more is better; for low-volume processes, extend the period rather than accepting a thin sample. Expect to spend more time here than anywhere else. Activity names will be inconsistent, timestamps will be in different time zones, and some cases will still be open (exclude those or flag them).
A minimum viable log is a CSV with one row per event:
| case_id | activity | timestamp | resource (optional) |
|---|---|---|---|
| NCR-1042 | Raised | 2026-03-02 09:14 | Inspector A |
| NCR-1042 | Containment | 2026-03-02 15:40 | Supervisor B |
| NCR-1042 | Closed | 2026-03-09 11:05 | QA Manager |
Open-source tools such as PM4Py (a Python library) or ProM, and commercial tools such as Celonis or Disco, can read this format. A simple first workflow is to load the CSV, map the three columns, discover the process graph, then list the variants and the slowest handoffs.
4. Discover the as-is process and compare to the documented one
Lay the discovered model next to the procedure. The differences become your first findings. I have seen the conversation change completely the moment a process owner sees the real map for the first time. It stops being an argument about opinion.
5. Prioritize with risk-based thinking
Not every deviation matters. Rank by customer impact, regulatory exposure, and cost, using the same logic you would apply under clause 6.1. Our risk-based thinking guide walks through how to score and decide.
6. Change the process, then measure again
A mining project that ends with a report has not improved anything. Make the change, record it under clause 10.3, and rerun the analysis on the next period of data. The before-and-after comparison is the evidence that the improvement was effective, which is the word clause 10.2.1 uses when it asks you to review the effectiveness of corrective action.
Which Analytics Techniques Complement Process Mining?
Process mining is one tool in a broader set. Clause 9.1.3 does not prescribe methods, so choose by question.
| Question | Technique | Typical ISO 9001 use |
|---|---|---|
| Is the process stable? | Statistical process control charts | Monitoring cycle time or defect rate over time (9.1.1) |
| What is the dominant cause? | Pareto analysis | Prioritizing corrective actions (10.2.1) |
| Does the real flow match the procedure? | Conformance checking | Process audit preparation (9.2.2) |
| What will likely happen next? | Predictive models on case data | Early warning for late or defective work (6.1) |
A caution on the last row: predictive models are attractive and easy to overbuy. I would not reach for them until discovery and conformance work have been done well, since a model trained on a messy process mostly learns the mess.
How Do You Use Process Mining in Internal Audits and Management Review?
Clause 9.2.2 requires an audit programme that takes into account the importance of the processes concerned, changes affecting the organization, and results of previous audits. Mined data gives you a defensible way to do that. If conformance checking shows one process has a high rate of skipped steps, it earns more audit attention than one that runs cleanly. Auditors can also test the exceptions directly instead of drawing a random sample and hoping to land on one. I cover the audit side in more depth on our internal audits page.
For management review under clause 9.3.2, the useful shift is from reporting averages to reporting variation. Suppose the cycle-time average is four days: that can hide the fact that a fifth of cases take eleven. Show the distribution and the top three variants and your top management conversation gets sharper quickly.
What Will an Auditor Ask About Process Mining Evidence?
Certification body auditors are not usually going to challenge the technique. They will challenge the reliability of the evidence, and they are right to. Be ready for these questions.
- Where does the data come from, and who controls it? Clause 7.5.3 on control of documented information applies to the extracts and models you keep as records. Define the source system, extraction date, and owner.
- Was the data validated? Keep a short note of how you cleaned the log and what you excluded. Excluding the ugly cases without saying so is the fastest way to lose credibility.
- Did you act on it? Clause 10.3 and 9.3.3 expect outputs from management review that include decisions on improvement opportunities. Show the line from finding to decision to change to verified result.
- Does your process model match your documented information? If mining reveals the documented procedure is wrong, update the procedure under clause 7.5.2 rather than forcing people back to a flow they have outgrown. Sometimes the people are right and the document is stale.
If personal data appears in your event logs, such as employee names attached to activities, treat it under your applicable privacy obligations before you share or retain it. Pseudonymizing the resource field is usually enough for quality analysis.
What Mistakes Should You Avoid?
I have watched organizations stumble in the same few places.
Starting with the tool and not the question is the most common one. A beautiful process map with no objective attached produces applause and no action. Starting too wide is the second: mining the entire company at once buries the team in data cleanup. The third is treating discovered deviations as people problems. The map shows where the system lets work wander, and in my experience a surprising share of those deviations are workarounds that exist because the official process does not fit reality. Blaming the person who built the workaround teaches everyone to hide the next one.
The last mistake is skipping the human check. A discovered model is a hypothesis built from system records, and the shop floor or service desk will tell you what the data cannot, such as why a step happens on paper after the work was done. Walk the map with the people who do the work before you act on it.
How Does This Scale for Small Organizations?
You do not need a data science team. A small company with a ticketing system or even a well-kept spreadsheet that logs status changes can run a basic analysis in a few days with free tools. If your process data lives in a spreadsheet with a date per status, you already have an event log in rough form. Our small business guide to ISO 9001 covers how to size the rest of the system proportionately.
Start with one small analysis on one process, and expand to the next once you trust what you are getting.
If you want help choosing a first process or setting up the evidence trail for your next audit, reach out through Certify Consulting.
Last updated: 2026-11-06
Frequently Asked Questions
Does ISO 9001 require process mining?
No. ISO 9001:2015 does not mention process mining or prescribe any analysis method. Clause 9.1.3 requires you to analyze and evaluate appropriate data, and clause 10.3 requires continual improvement. Process mining is one effective way to meet both.
What data do I need to start process mining?
An event log with a case identifier, an activity name, and a timestamp for each event. These three fields are enough for process discovery. Adding resource, cost, and outcome fields enables deeper analysis.
Which ISO 9001 clauses does process mining support most directly?
Clauses 9.1.1 and 9.1.3 on monitoring, measurement, analysis and evaluation, clause 8.5.1 on controlled production and service provision, clause 9.2.2 on audit programme planning, and clause 10.3 on continual improvement.
Will a certification body accept process mining results as audit evidence?
Generally yes, provided you can show where the data came from, how it was validated, and how findings led to decisions and verified improvements. Records should be controlled under clause 7.5.3.
Can small organizations use process mining?
Yes. Any system that records status changes with dates, including a ticketing tool or a well-kept spreadsheet, can produce an event log. Open-source tools can analyze it without a large budget.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.