The Three Questions: Discover, Check, Enhance

TL;DR: Process mining discovery shows what really happened. Conformance checking shows where reality diverged from the intended model. Enhancement shows where to improve: bottlenecks, decisions, and next best actions.

What you will learn

1. The meaning of discover, check, and enhance in plain language
2. When to use each lens on a real project
3. How the three questions reinforce each other in a loop
4. Example questions you can ask at project kickoff
5. How to avoid treating discovery as the finish line

Why frame process mining as three questions?

Process mining discovery often gets the most attention because maps of how work flows are easy to share. Maps alone rarely change outcomes. The field's durable framing is three complementary questions:

1. Discover: What process did we actually execute?
2. Check: Does that behavior conform to what we intended or required?
3. Enhance: How do we extend the model with performance and insight so we can act?

Definition: Discovery, conformance checking, and enhancement are the three primary process mining perspectives: learn the as-is model from data, compare data to a normative model, and enrich models with performance and other perspectives for improvement.

Keep them as questions, not as feature checklists. A healthy initiative moves fluidly among all three.

What is process discovery?

Discovery algorithms take an event log and produce a process model. Common outputs include a directly-follows graph (DFG), a Petri net, a BPMN-like diagram, or a similar control-flow summary of observed behavior.

You use discovery when you want to:

1. Replace informal process knowledge with a shared as-is view
2. Inventory variants (common path versus long-tail exceptions)
3. Spot unexpected loops, skips, and parallel paths
4. Baseline before a redesign or automation program

Discovery is not a guarantee of a clean model. Messy logs produce dense, hard-to-read maps. Filtering infrequent paths, refining activity names, and scoping the case definition are normal parts of the work.

Numbered starter steps for a discovery pilot

1. Pick one process with clear case IDs and enough volume (thousands of cases ideally).
2. Extract events with case, activity, and timestamp; document known gaps.
3. Mine a first map; compare it to stakeholder intuition without correcting the data yet.
4. Clean synonyms and filter noise; remine and validate with domain experts.
5. Freeze a trusted as-is view before you redesign or automate.

What is conformance checking?

Conformance checking compares an event log to a process model (or set of rules) and reports where they disagree. The model might be a designed BPMN, a policy ("always credit-check before ship"), or a previously discovered model treated as the standard.

You use conformance when you want to:

1. Quantify policy or control violations
2. See which activities are skipped, inserted, or reordered
3. Measure how well a model fits reality (and vice versa)
4. Prioritize compliance or quality issues by frequency and impact

Fitness, precision, and related measures appear in the literature. For business conversations, translate them: "How many cases can the model explain?" and "Does the model allow behavior we never see?"

Deep dive without the jargon: see Conformance Checking Without the Jargon.

What is process enhancement?

Enhancement (sometimes called extension) takes a model and projects additional perspectives from the log onto it. Classic examples:

1. Performance: waiting and sojourn times on edges and activities
2. Organizational: who hands off to whom
3. Decision: which attributes predict path choices
4. Predictive: remaining time or outcome risk for running cases

Enhancement answers "so what?" Discovery shows a loop; enhancement shows that the loop costs three days on average and concentrates in one region.

How the three questions work together

Then loop: after you change the process or the system, re-discover and re-check. Process mining is continuous sensing, not a one-time poster on the wall.

Example questions for your kickoff

Use this table to keep scope honest at the start of a project.

If a stakeholder only wants a prettier flowchart, add at least one check or enhance question. Otherwise you risk a map that nobody uses for decisions.

Common pitfalls when sequencing the work

1. Stopping at discovery. A dense map is not a strategy. Move into check and enhance once the as-is view is trusted.
2. Conformance against a fantasy model. If the normative model never matched reality, "violations" may simply mean the model is wrong.
3. Enhancement on dirty data. Time between events is meaningless if timestamps are batch-loaded.
4. Mixing case notions mid-flight. Changing what a "case" is invalidates prior maps and metrics.
5. No owner for action. Insights without a process owner become unused slide decks.

How this maps to everyday roles

1. Ops / process owners live in enhance and check: where to intervene, which rules matter.
2. Analysts / data teams carry discovery quality: activity vocabularies, joins across systems.
3. Risk / audit lean on conformance, but still need discovery to understand feasible controls.
4. Automation leads need all three: discover candidates, check prerequisites, enhance with ROI estimates from timing data.

Key takeaways

1. Frame work as discover, then check, then enhance, then repeat after changes.
2. Discovery builds the as-is model from the event log; it is necessary but not sufficient.
3. Conformance compares log and model to surface meaningful deviations.
4. Enhancement overlays performance and other perspectives so insight becomes action.
5. Write explicit business questions for each lens before you extract the first log.

FAQ

What are the three types of process mining?

The classic trio is discovery (build a model from the log), conformance checking (compare log and model), and enhancement (extend the model with performance, decisions, or predictions). Most projects cycle through all three rather than treating them as mutually exclusive products.

Should I start with discovery or conformance?

Start with discovery unless you already trust a normative model and care mainly about compliance. Discovery builds shared understanding of as-is behavior; conformance then measures gaps against to-be or policy. Skipping discovery often produces arguments about whether the standard model is realistic.

What does process enhancement mean?

Enhancement enriches a process model with extra insight from the log: bottlenecks, waiting times, decision rules, or predicted outcomes. The model becomes a tool for improvement, not only a drawing of control flow. It is where an interesting map becomes a prioritized backlog.

Can one event log support all three questions?

Yes. The same case, activity, and timestamp log can feed discovery, conformance, and enhancement. Richer attributes (resource, cost, outcome) unlock more enhancement analyses without changing the core case notion, as long as those attributes are trustworthy.

Further reading

1. Process Mining Handbook (open access): https://doi.org/10.1007/978-3-031-08848-3
2. Previous: Process Mining 101: What It Is (and Is Not)
3. Next: Event Logs in Plain English
4. Related: Conformance Checking Without the Jargon
5. Related: From Insight to Action in Process Mining

Attribution

Educational synthesis inspired by the open-access Process Mining Handbook (van der Aalst and Carmona, eds., 2022), https://doi.org/10.1007/978-3-031-08848-3. This article is not a substitute for the handbook. It is not legal, audit, or vendor advice.