Fitting It to What You Run
Five connections that make mining part of how the operation works rather than a separate reporting activity.
Reference
An analysis that lives in a specialist tool becomes a specialist activity. The connections decide whether it is operational.
The source systems
Incremental extracts on a schedule, from a replica rather than production.
Alerting when an extract fails or the volume looks wrong, which is the failure that freezes the numbers while they are still quoted.
Notification of system changes, which break the activity mapping. Getting onto the release notification list is a five-minute task that prevents a recurring problem.
The operational forum
A standing slot in an existing review, not a new meeting.
Seven measures on one page, with normal ranges.
Open findings with owners and dates.
This is the connection that matters most. A programme with no audience produces reports nobody reads within a quarter.
The workflow and case systems
Findings out, where they change configuration: routing rules, approval thresholds, validation at entry, staffing windows.
An analysis recommending a change and a system that implements it should be connected, or the recommendation stays in a deck.
Alerts in, as work items rather than as email, so a segregation breach becomes a task with an owner.
The compliance and audit function
Conformance rules agreed with them, so the checks reflect what actually matters.
Findings routed to them directly for the compliance category.
Evidence produced as a by-product, which is the argument that funds continuous operation.
They are also the group most likely to defend the programme when it is questioned, which is worth cultivating early.
The data platform
The log built where your other data lives, if you have a warehouse, rather than only inside a mining tool.
Because the mining tool will be replaced and the extraction and mapping work should survive it.
Export the log and the mapping regularly, and test that the export can rebuild the analysis.
The identity boundary in the architecture
Decide at extraction whether the resource field is included, which is the only place it can be enforced.
Aggregate to role or team by default, with individual-level access separated and logged.
Point routine reporting at the aggregated view, technically, so drift is not possible by accident.
Same principle as the task mining section, and it applies whenever a resource field exists.
The order
Source systems first, because nothing works without the extract.
The operational forum second, because it is free and it is what makes findings act.
Compliance third, because the findings are immediate and the ally is valuable.
Workflow fourth, which closes the loop.
Data platform last, and it is the one that makes the work survive a change of vendor.
Getting on the release notification list
A five-minute task that prevents a recurring failure.
System changes alter activity codes, and unmapped codes silently vanish from the log or appear as new activities.
Which produces a map that changed for no process reason, and a finding that is an artefact.
Ask to be notified of releases for every source system.
Check the mapping after each one, which is a query against unmapped codes.
Report the mapping version with every figure, so a change can be attributed correctly.
Exporting so the work survives the tool
The mining platform will be replaced. The extraction and mapping should not be.
The log query, versioned, outside the tool.
The activity mapping table.
The exclusion register.
The saved analysis queries.
The per-process decision document.
Test the export by rebuilding one analysis from it, which is the only way to know it is complete. A migration with these intact costs weeks; without them it is a restart.
The joins worth making
Four connections that make the analysis operational rather than a parallel exercise.
The source systems, scheduled rather than manual, so the log refreshes without a person.
The process documentation, so conformance is checked against the current model rather than a stale one.
The ticketing or change system, so a finding becomes a tracked item with an owner.
Reporting, so the five continuous measures appear where operational numbers already appear.
Do not build a separate portal. A finding that lives outside the operational review is a finding nobody acts on.