Business Process Analysis of Cloud Incident Management Service with Activity Assignment: A Case of PT. XYZ

Ngakan Made Satrya Wibawa^1*, Gadang Ramantoko¹

1. Faculty of Economic and Business, Telkom University, Bandung

Journal of Business Management and Accounting 12(1) (2022) · https://doi.org/10.32890/jbma2022.12.1.3

Abstract

PT. XYZ is one of the cloud computing service providers in Indonesia. XYZ company started banking and data center software business in 1987, in 2011, the company launched enterprise cloud computing services. This service provides virtual server infrastructure and combines it with network access. The increasing interest of customers who require cloud services allow disruptions to the resources which have been provided. As an experienced company, it has prepared for the disruptions with cloud service management which includes operational aspects of the services. To support the affected services, the company has a Standard Operating Procedure (SOP) which conforms with incident management. However, there are still problems that could potentially interfere with the incident handling process. This can be seen from the observations on the event log where there are indications that activities are not working properly. So, it is necessary to conduct business process analysis to optimize activities of incident management and end-to-end solutions to the customers. The research began with a literature review and data collection. Using the extraction of the event log data and the analysis process, it 806 cases and 5466 activities were found. Then the researchers conducted business process modeling from the event log to run process mining. From the results of process mining and the comparison with the SOP of PT. XYZ, it was found that the business process of incident handling was not implemented. And the average duration of incident handling was 3 to 4 days. This has an impact on the fees charged by PT. XYZ. The result of this research, by processing the data and analyzing the business processes, is knowing the implications for PT. XYZ. Based on the analysis, the researchers provide recommendations that the incident management must increase responsiveness between the service desk and each support team. The optimal incident management development needs to be formed by a functional team for incident monitoring and auto-closed system within a particular time.

Keywords: Business Process, Process Mining, Incident Management, Event Log

digital services become one of the reasons for the potential adoption of the cloud service market in Indonesia. According to Frost & Sullivan’s report in 2018 (Frost & Sullivan, 2018) in Figure 1, it is projected that the cloud service market in Indonesia will grow by software platforms and virtual computing supports business operations for organizations. 38.6% from 2017 to networks, 2022. cloud As well as an increase in market potential Cloud computing services also offer the advantage of being scalable, which can support high versatility and of more than 1,218 million with (USD) in 2022. multi-compartment. It offers adaptability the computing needs relatively fast and less time-consuming compared to traditional ones (Nath, 2019). The trend of digital transformation allows SMEs (Small and Medium Enterprises) to develop productivity with cloud computing in order to compete with other organizations. Figure 1 The high number of business opportunities influenced by the development of digital services become one of the reasons for the potential adoption of the cloud service market in Indonesia. According to Frost & Sullivan's report in 2018 (Frost & Sullivan, 2018) in Figure 1, it is projected that the cloud service market of in Indonesia grow by 38.6% from 2017 to 2022. As well as an increase in market Forecast cloudwillservice market revenue 2017-2022 (Frost & potential of more than 1,218 million (USD) in 2022.

Sullivan, 2018, p.24).

Cloud adoption is an affordable option as it offers a competitive advantage and saves cost so the customers can focus on core business processes and objectives (Modisane et al, 2021). This opportunity is in line with the emergence of cloud computing service providers offering solutions to enterprises and SME customers. Cloud adoption is an affordable option as it offers a competitive With always-on service, delivering value to consumers, it supports to produce profits and business achievements (Foo, advantage and2020). saves cost so the customers can focus on core business processes and objectives (Modisane et enterprises al, 2021). This(Small opportunity One of the cloud computing service providers that targets and SMEs and Medium Indonesia XYZ. This company has introduced cloud computing solutions isEnterprises) in lineinwith theis PT. emergence of cloud computing serviceservice providers since 2011. The cloud computing service models offered are as follows: offering solutions to enterprises and SME customers. With always-on service, delivering value to consumers, it supports to produce profits and business achievements (Foo, 2020). One of the cloud computing service providers that targets enterprises and SMEs (Small and Medium Enterprises) in Indonesia is PT. XYZ.

This company has introduced cloud computing service solutions since 2011. The cloud computing service models offered are as follows: a. b. c.

Infrastructure as a Service (IaaS)

This service model provides a virtual server infrastructure that can be an end-to-end solution for accelerating business growth. Platform as a Service (PaaS) This service model provides a platform for customers to manage applications and data according to business needs. Software as a Service (SaaS)

This service model provides a ready-to-use application that can be accessed anytime and anywhere via internet so that it can support customers’ business productivity. Generally, cloud providers already have the advantage of network infrastructure and data centers. The features of cloud services such as reliability and high availability enabled the customers to manage the required computing resources. However, there are many things that service providers need to be concerned about so that cloud service adoption can be maximized. Providing services that have reliability and availability in cloud computing services is very important to maintain customer trust and satisfaction as well as preventing revenue loss (Mesbahi, 2018). This is a challenge for service providers to optimize service management and end-to-end solutions to the customers. According to Kaiser (2017), service management is a special ability in organizations to provide value to customers in the form of services. One of them is to support daily cloud operational services, especially incidents, because they have a major impact on the normal function of the service. To deal with the service disruptions, PT XYZ has a helpdesk system to respond and help the clients to speed up the recovery of the service. There are some conditions that make completion of incident handling to last longer time. To gain information about this situation in service management, the researchers probed relevant logs on PT XYZ’s helpdesk system. Event logs represented in Figure 2 shows that the number of reported incident tickets and the number of closed tickets show an anomaly in which the number of closed tickets should be in line with the number reported.

The graph shows that there are gaps and indications that the incident handling procedure is not working properly. Based on the observations, there are conditions where the incident management business process The graph shows that there are gaps and indications that the incident has gaps against the standardized operational procedures of PT. XYZ. According to Kaiser (2017), if an handling is not working properly. Basedmanager on theshould observations, incident causes a procedure system or service not to function normally, the incident try his best so that the recovery process does not exceed the deadline for resolution. The incident management process is there are conditions where the incident management business process responsible for customer satisfaction and agility in handling disruptions. In this research, to determine the process occurred, the researchers conducted a operational process analysis procedures starting from incident reporting hasthat gaps against the standardized of PT. XYZ.to services operating normally. According to Aalst (2016), process mining means taking (input) some event According to Kaiser (2017), if an incident causes a system or service data (for example, data event log) and performing fact analysis based on the execution process. The process was not analyzed to show the complexity of the problem and how to handle it should according try to procedures. to function normally, the incident manager his best so that the recovery process does not exceed the deadline for resolution. The incident management process is responsible for customer LITERATURE REVIEW satisfaction and agility in handling disruptions. In this research, to Cloud Service Management determine the process that occurred, the researchers conducted a The process rapid approach of technology has been widely utilized, one of them is cloud computing.operating According to analysis starting from incident reporting to services Wilianto and Fitri et al (2015), cloud computing services allow the customers to directly use the resources According Aalst process mining and normally. services without incurring too to much cost. (2016), Cloud service management allows means provider totaking manage including operate and control cloud(for infrastructure. To assist continuity of this and achieve (input) some eventthedata example, datatheevent log) andservice performing business objectives, cloud providers can adopt the framework of the IT Infrastructure Library (ITIL) fact 2020). analysis based on the execution process.Library The framework process was analyzed (Agutter, Ciesielska (2017) stated that IT Infrastructure is divided into five sections which included in the service lifecycle phase such as service strategy, service design, service to show the complexity of the problem and how to handle it according transition, service operation, and continual service improvement. The IT Infrastructure Library service to procedures. lifecycle illustrated in Figure 3.

Cloud Service Management

The rapid approach of technology has been widely utilized, one of them is cloud computing. According to Wilianto and Fitri et al (2015), cloud computing services allow the customers to directly use the resources and services without incurring too much cost. Cloud service management allows provider to manage including operate and control the cloud infrastructure. To assist the continuity of this service and achieve business objectives, cloud providers can adopt the framework of the IT Infrastructure Library (ITIL) (Agutter, 2020). Ciesielska (2017) stated that IT Infrastructure Library framework is divided into five sections which included in the service lifecycle phase such as service strategy, service design, service transition, service operation, and continual service improvement. The IT Infrastructure Library service lifecycle illustrated in Figure 3.

One of the phases that is the main focus in this research is service operation. According to Kaiser (2020), service operation consists of several practices including incident management, problem management, and One of the phases that is the main focus in this research is service event management. operation. According to Kaiser (2020), service operation consists Incident Management of several practices including incident management, problem When the rented cloud experiences disruption and the customers cannot access the management, andcomputing event service management. service, these situations are referred to as an incidents (Kaiser, 2017). Incident management focuses on ensuring that the services are recovered. Incident Management is the process flow that focuses on getting services up and running after disruptions (Menon, 2021). According to Schnepp, Vidal, and Hawley (2017), "the response to those incidents come in many forms, from one person working on an issue to a large group of people dialing into a conference call bridge or typing into a plethora of communications/workflow/productivity applications from anywhere around the globe."

Incident Management

When the rented cloud computing service experiences disruption and According to Kaiser (2017) in the access incident management lifecycle,these there aresituations 7 steps to resolve incidents as the customers cannot the service, are referred shown in figure 4.

to as an incidents (Kaiser, 2017). Incident management focuses on ensuring that the services are recovered. Incident Management is the process flow that focuses on getting services up and running after disruptions (Menon, 2021). According to Schnepp, Vidal, and Hawley (2017), “the response to those incidents come in many forms, from one person working on an issue to a large group of people dialing into a conference call bridge or typing into a plethora of communications/ workflow/productivity applications from anywhere around the globe.” According to Kaiser (2017) in the incident management lifecycle, there are 7 steps to resolve incidents as shown in figure 4.

Below is the explanation of each step in Figure 4 of incident management lifecycle such as: 1.

Incident identification The incident management process begins with identification. Incident identification can be done in several ways. The most common ways to do this are event management tools, phone calls, e-mail/chat, and web interfaces. Incident logging Each type of incident that occurs must be recorded with information on the incident number (unique), incident category, time of incident (timestamp), description of the incident, name of the person / group responsible for handling, implications of the incident, and timing of closing the case. Incident categorization Incident categories aim to classify incidents to suit the incident response team Incident prioritization The incident handling prioritization can be done based on the magnitude of the implications of the incident on the main business activities of the organization or based on the length of time the incident handling. Diagnosis and investigation The service desk performs an early diagnosis of an incident by understanding the symptoms that occur. Not all incidents can be resolved by the service desk so there is an escalation function to the support level or technician staff. Resolution and recovery Resolution steps can be taken by the service desk as the first party who finds incidents from users, technical staff who is working on configuration activities as well as by suppliers of devices that are still under warranty. Generally, there is a recovery period to observe the incident and anticipate it if it happens again. Incident closure When the incident has been handled and the service has run normally, the next step is for the service desk to confirm to the user for the closure. After an incident is closed, a user satisfaction survey will ask for feedback on the resolution and the ease of incident logging. Then the service desk will inform the user regarding the service status recording.

Business Process Management

According to Rosing, Scheer and Scheel (2015), the word process comes from the latin word processus or processtoat which can be interpreted as the action of something being done and how to do it. A process is a set of tasks or activities that are interrelated and initiated as a response to an event that aims to achieve certain results for the customer from the process. According to Weske (2019), business processes consist of a series of activities carried out in coordination within the organizational and technical environment which supports operational processes in achieving business goals. According to Burattin (2015), the term business process refers to a series of activities and interactions that companies carry out through an approach to simplify business management based on the division of operations into smaller “entities”. A process does not only focus on the processing process but also includes the creative process, supporting process and management process as mentioned by Hammer (2015). Meanwhile, according to Dumas et al (2018) explained that a business process consists of several elements which illustrated in figure 5:

a. Events and activities. An event is something that happens without duration and triggers a series of activities to be carried out. Activities are collections of works / tasks. Decision points are the points in time at which a decision is made that affects how a process is executed. c. Actors, namely humans, organizations, software that carry out tasks for humans or organizations, physical objects such as equipment, materials, products, documents, and other objects that are nonmaterial, such as electronic documents and electronic records. d. Outcomes that ideally bring value to actors involved in the process are called positive outcomes, but the process may only be able to realize some of the expected value or not bring any value at all.

Events and activities. An event is something that happens without duration and triggers a series of activities to be carried out. Activities are collections of works / tasks. Decision points are the points in time at which a decision is made that affects how a process is executed.

Based on the types of business processes quoted from Hammer (2015), there are three groups of business processes as follows:

a. Core Processes, namely processes that add value to external customers, so it is important for business, which includes transactional processes and development processes. b. Support Processes, namely processes that create value for internal customers. c. Governing Process, namely the management processes that enable an organization to run.

Actors, namely humans, organizations, software that carry out tasks for humans or organizations, physical objects such as equipment, materials, products, documents, and other objects that are non- material, such as electronic documents and electronic records. Outcomes that ideally bring value to actors involved in the process are called positive outcomes, but the process may only be able to realize some of the expected value or not bring any value at all.

Based on the types of business processes quoted from Hammer (2015), there are three groups of business processes as follows: a. b. c.

Core Processes, namely processes that add value to external customers, so it is important for business, which includes transactional processes and development processes. Support Processes, namely processes that create value for internal customers. Governing Process, namely the management processes that enable an organization to run.

According to Brocke (2014), “business process management is dedicated to analyzing, designing, implementing and continuously improving organizational process”. Quotation from Maciel et al (2018) which state that business process management understood as a management theme, comprehends several dimensions, such as organizational culture, organizational performance, organizational conduct, corporate governance, and competitive advantage. In other words, Business process management (BPM) can optimize the business process. BPM and process mining have a correlation that can be used as a connection between monitoring phase, discovery phase and analysis phase in the BPM lifecycle (Dumas et al, 2018). Process Mining Aalst (2016) defined that process mining appears as a new subdiscipline of data science and process science, but with the appropriate techniques, it can be applied to all types of operational processes (systems and organizations). According to Nafasa (2019), “the purpose of process mining is to find, monitor, and improve the actual process by taking knowledge of the events log obtained from the system”.

Process mining refers to the task of discovering, monitoring, and improving fundamental processes (such as those that occur in event logs) by extracting knowledge from logs (Aalst, 2016). Figure 6 to the task of discovering, monitoring, and improving fundamental processes (such Process mining refers as those that occur in event logs) by extracting knowledge from logs (Aalst, 2016). Representation of the three main parts in process mining (Aalst, 2016, p.32).

According to Van der Aalst (2016) in Figure 6 the process mining techniques, are consist of three perspectives based on the objectives, including:

According to Van der Aalst (2016) in Figure 6 the process mining techniques, are consist of three perspectives based on the objectives, a. Discovery is an existing sub-discipline of the process mining, and more approaches are being proposed. Finding a model through long steps of approaches and techniques that are possibly different (One of including: them with algorithm based on the log activities). The model found is not limited to a workflow process perspective. If the log contains additional information, it can find other resource-related models. b. Conformance analysis considers event logsub-discipline and the model as input. The process purpose of mining, the conformance a. Discovery is anthe existing of the technique is to match the model behaviors with the behaviors recorded on the log. Conformance is used and more approaches are being proposed. Finding a model which to verify a documented process to remain updated, or the model used a discovery approach long steps of approaches and techniques that are represent thethrough previous process. c. Extension orpossibly enhancement is similar (One to conformance which considers event logbased and model an input. different of them with algorithm on asthe This technique aims to improve a model to match to the behaviors recorded in the log better. Another log activities). The model found is limited to atoworkflow option is to expand the model with additional information andnot add new perspective the process model. process perspective. If the log contains additional information,

According to Burattin (2015), the idea underlying process mining techniques is that most of the business it run canwith find models. processes, which theother supportresource-related of information systems, leave traces of execution of this activity and information. is then stored as "log files." Process mining aims find, starting fromthe this model log, by finding b. It Conformance analysis considers the toevent log and as much information as possible. Typically, these logs are collected in MXML or XES files analyzed as input. The purpose of the conformance technique toisbeto match the model behaviors with the behaviors recorded on the log. Conformance is used to verify a documented process to remain updated, or the model used a discovery approach which represent the previous process. Extension or enhancement is similar to conformance which considers event log and model as an input. This technique aims to improve a model to match to the behaviors recorded in the log better. Another option is to expand the model with additional information and add new perspective to the process model.

According to Burattin (2015), the idea underlying process mining techniques is that most of the business processes, which run with the support of information systems, leave traces of execution of this activity and information. It is then stored as “log files.” Process mining aims to find, starting from this log, by finding as much information as possible. Typically, these logs are collected in MXML or XES files to be analyzed using the ProM tool. Typically, the case ID is a collection of one or more fields from data collection, whose value identifies one process execution. Process Discovery According to Aalst (2016), the definition of a business process emphasizes the behavior of input / output business processes which describes abstractly by collecting activities. Process discovery is one of the challenging processes in the process mining series. According to Dumas et al (2018), determining the arrangement of information collected can be divided into four tasks, namely: a. b. c. d.

Determine the arrangement: combine a team within the company who will be responsible for the work process. Gather information: related to building an understanding of the process. Different invention methods can be used to obtain information about a process. Perform modeling tasks: related to creating the actual process model. Modeling methods provide a guide for mapping processes in a systematic manner. Ensure the process quality model: aims to ensure that the resulting process model meets different quality criteria. This task is important for building trust in the process model.

The purpose of process mining is gathering information and acquiring process model from the event log which can represent the real business

Process Discovery According to Business Aalst (2016), the definition a business process the behavior of input output Journal of Management andofAccounting, Vol. 12,emphasizes Number 1 (January) 2022, pp: /51–80 business processes which describes abstractly by collecting activities. Process discovery is one of the challenging processes in the process mining series. According to Dumas et al (2018), determining the arrangement of information collected can be divided into four tasks, namely:

et al, 2019). Quotations from Burlton (2001)forstating a.process Determine(Effendi the arrangement: combine a team within the company who will be responsible the work process. that business process models facilitate communication about these b. Gather information: related to building an understanding of the process. Different invention methods business processes and visualize the relationships between process can be used to obtain information about a process. c. Perform modeling tasks: related to creating the actual process model. Modeling methods provide a guide elements. The BPM (Business Process Model) uses a graphical for mapping processes in a systematic manner. representation to see theaimsflow of that processes, tasks,model participants, d. Ensure the process quality model: to ensure the resulting process meets different and quality criteria. This task is important for building trust in the process model. results (Weske, 2019).

The purpose of process mining is gathering information and acquiring process model from the event log which can represent the real business process (Effendi et al, 2019). Quotations from Burlton (2001) stating Figure that business7process models facilitate communication about these business processes and visualize the relationships between process elements. The BPM (Business Process Model) uses a graphical representation to see the flow of processes, tasks, participants, and results (Weske, 2019).

Graphical representation of process model using Petri Nets (Aalst, p.164)

Figure 2016,7

Graphical representation of process model using Petri Nets (Aalst, 2016, p.164)

According to Aalst (2016), in the book titled Process Mining – Data Science in Action, he described the process model on the discovery phase using Petri nets. As illustrated in Figure 7, simple and graphical petri nets reflect activity model (marked with the letter a,b,c,d,e) respective Mining relation (marked with According totrace Aalst (2016), in the book titledandProcess – Data symbols p1,p2,p3,p4).

Science in Action, he described the process model on the discovery phase using Petri nets. As illustrated in Figure 7, simple and graphical petri nets reflect activity trace model (marked with the letter a,b,c,d,e) and respective relation (marked with symbols p1,p2,p3,p4). METHODOLOGY Type of Research As the subject of this research is the investigation of business process from management incident on cloud computing services company of PT. XYZ, the method used in this research is descriptive. According to Indrawati (2015), the purpose of descriptive research is to describe the characteristics of a group. The goal of the process mining is to turn event data into insights and actions which allow (input) some event data (for example, event log data) and perform extracting process-related information (Aalst, 2016). An event log is a collection of events extracted in the context of a process that indicates which activity has happened at a specific time (Fani Sani, 2020). Variable Operationalization According to Indrawati (2015), a variable is anything that has a value, METHODOLOGY and that value can vary and can change. In this research, the variable Type ofis Research used event log. The value of an object at different times can be different, at ofthe same time have incident different As the subject and of this different research is theobjects investigation business process fromcan management on cloud computing services companytoof Sekaran PT. XYZ, the(2016), method used research is descriptive. values. According thein this operational variableAccording is a to Indrawati (2015), the purpose of descriptive research is to describe the characteristics of a group. The goal process carried out to reduce the abstraction of a variable’s concept of the process mining is to turn event data into insights and actions which allow (input) some event data to variable measurable in aprocess-related tangible form. In the event (formake example,the event log data) and perform extracting information (Aalst, 2016).log, An event log is a collection of events extracted in theinformation context of a process thatwill indicates which activity has happened there are four subs variable that be used to build a at a specific time (Fani Sani, 2020). process model as described by Aalst (2016). The four sub-variables Variable Operationalization used are incident ID, activity ID, activity status, and date-time. According to Indrawati (2015), a variable is anything that has a value, and that value can vary and can change. In this Stages research, the variable used is event log. The value of an object at different times can be Research different, and different objects at the same time can have different values. According to Sekaran (2016), the operational variable is a process carried out to reduce the abstraction of a variable's concept to make the The research are form. the steps from beginning the end carried variable measurablestages in a tangible In the event log,the there are four subs to variable information that will be used tothis buildresearch. a process model as described by Aalst (2016). The four sub-variables used are incident ID, out in The following are the stages of the methodology activity ID, activity status, and date-time.

that the author did in the research, shown in figure 8. Research Stages

Figure

8 stages are the steps from the beginning to the end carried out in this research. The following The research are the stages of the methodology that the author did in the research, shown in figure 8.

Steps of research stages (Researcher, 2020)

Data structuring

The description of figure 8, the research stages used in the study as follows: a. b. c. d.

Identification of problems

Tracing the phenomena that exist in the object of research to identify problems as described in the research background. Literature review Collection of in-depth information regarding the observed phenomena through literature review. Formation of a frame of mind Mapping the basic theory used as a concept to answer research questions and research problems. Determination of Data Sources Determining the data sources that are used as a dataset, the data sources in this study are from the event log data by PT. XYZ in 2019. Data collection Data collection for quantitative research was carried out by downloading incident ticket data from the remedy information system and literature studies. Data Structuring The extracted data is then compiled in an event log format with statistical software R. Furthermore, the process mining is carried out using the ProM software (Process Mining). Process Mining The algorithm of process mining where the initial stage is the discovery process which includes processing, analysis, identification of all process agencies and defining the relationship among activities (Burattin, 2015). Analysis & Process Models Visualization of the process mining is a process model that allows researchers to gain insight in the process (Burattin, 2015). The analysis is carried out by studying the pattern of incident handling activities based on the frequency of users (Case Frequency) and analyzing the performance of incident handling. It also provides analysis of the business impact for the XYZ company. Results and Conclusions At this stage the authors described the results of the process analysis that has been carried out and provide recommendation for cloud service management of PT. XYZ.

Population and Sample

The population of this study is the incident data population of the company. The incident management data recorded in the helpdesk system of PT. XYZ for the period 2019 amounted to 843 tickets. Samples used after filtering the complete activities were 806 tickets. According to Vázquez-Barreiros (2015), each ticket has sequence of events (number ticket, datetime, activities) and there are 37 tickets which cannot be used as samples due to missing events or incomplete events. Data Collection According to Indrawati (2015), secondary data refers to information collected from existing sources. Researchers obtained various relevant information related to the research. The secondary data of the research were obtained from internal data at the company PT. XYZ. The secondary data collection is done by manual query from the helpdesk system for history data of Cloud incident management. Preprocessing Data In processing the event log using R software, there are some steps that must be passed: a. b.

Event log data from the manual query server of incident management is collected. Preprocessing event data with complete activity filters. Then, sort the activity frequency and log trace based on completion task. This step has similarity with the study conducted by Putri (2020). Identify variants of the business process model that arise due to different incident handling situations. This section shows activity based on the frequency of activity. Furthermore, mapping attributes and making process discovery in the ProM software. The paper written by Nafasa (2019) and Burattin (2015) examined process discovery. In this research the authors used alpha algorithms to visualize business process models and provide recommendations on existing findings.

RESULTS Analysis Process Discovery This research applied the process mining concept to the incident management process in the Cloud Computing service provider in PT. XYZ. The analysis of the incident management process was carried out by observing the incident handling business process of the Cloud Computing service in the Cloud operational unit in PT. XYZ with the following descriptions: a. b. c. d. e. f.

Customers contact customer care to convey information about the incident occurred. Customer care responds to complaints from customers and identifies the incident. Customer care records incidents based on information from customers and submits them to the support team. The support team checks the incident and confirms it to the customer. If the incident has not been resolved within a few hours, an escalation will be carried out. After the incident is handled and the customer’s cloud service is running normally, the incident ticket will be closed.

PT. XYZ implemented a remedy system to organize and record operational management activities. One of the modules extracted from the remedy system database is incident management related to the Cloud Computing service. The extracted data is then identified according to the data format used in the process mining. The identification of information from event log data is in the form of incident handling activities, resources, and time. Identification Log Data At this stage, to analyze the business processes that occur, it is necessary to identify the event data. The data is selected and adjusted to the relation of incident activities, then the incident data is extracted from the database on the remedy system. Extraction Log Data The data extraction stage consists of preparing and extracting incident data starting from January 2, 2019 to December 18, 2019. Preparation starts from identifying activities, tables and attributes related to incidents on the Cloud Computing service. The results of these preparations are used to extract the database from the remedy system. From the data that were successfully extracted, there were 843 tickets, 37 tickets are indicated as missing. Data Structuring After gaining the data by extracting database and filtering data, then they will be followed by activities and attributes mapping as shown in table 1.

Note : Attributes mapping is adapted from Aalst’s book (2016)

Table 1 shows the event log data consisting of attributes used which are identifier (ID), activity status, and date timestamps. The following is the explanation of the attributes in table 1: a. b.

Incident id is a record of incident ticket number Activity status is the activity performed at the time of the incident. The activities determined by company XYZ are: reported, submit, support L1 as support by team level one, communication user as communication user, update issue, support L1 as support by team level two, and case solve. date timestamp is the day/date and time when the activity was performed org:resource is a person who did the activities.

After obtaining these attributes, the next step is adjustments to the eXtensible Event Stream (XES) format in the ProM software. Business Process Model Before continuing to the analysis with ProM software, the researchers explored data with R software. Identification of the variants of business process models that arise due to different incident handling situations for the customers. The purpose of this research is to understand business processes in incident management on Cloud Computing services in PT. XYZ.

From data exploration, the number of incident tickets amounted to 806 cases and 5466 activities. The explanation from Table 2 shows the frequency of activities of all cases that are often carried out, namely support level 1, submit, reported, user communication, closed tickets, case solve, update issues, support level 2, user confirmation, on progress handling, management escalation, support level 3. Furthermore, the researchers conducted a process mapping using activity ratios and activity paths. This aims to understand the main activities in the process. Here are the results of a series of activities by adjusting the activity ratio:

The first, screening identification process with 100% activity ratio and 100% activity path got 806 cases. The result of process mapping with a ratio of 100% resulting in 12 activities including reported, submit, support level 1, user communication, update issues, support level 2, user confirmation, management escalation, support level 3, on progress handling, cases solved and closed tickets. The second, screening identification process with an activity ratio of 100% and an activity path of 80% -90% got 746 cases. The result of process mapping with a ratio of 90% resulting in 9 activities including reported, submit, support level 1, user communication, update issues, support level 2, user confirmation, case solve, and closed ticket. The third, screening identification process with an activity ratio of 100% and an activity path of 65% - 75% got 509 cases. The result of process mapping with a ratio of 60% resulting in 6 activities including reported, submit, support Level 1, user communication, case solve and closed ticket. The fourth, screening identification process with an activity ratio of 100% and an activity path of less than 60% gets 509 cases. The result of process mapping with a ratio of 60% resulting in 6 activities including reported, submit, support Level one, user communication, case solve and closed ticket.

Analysis Process Mining

After preprocessing event log data in 2019, information on the number of incident tickets amounted to 806 cases and 5466 activities. As seen on Table 3, the result of the mapping process using the ratio connection activity, which shows the number of activities that are often passed by all cases in the event log.

Sum Incident

Note : adapted from Putri’s Research (2020)

Sum Activity

Continuing the results of the process mapping from software R, the following is the discovery process analysis by showing the analysis of activity performance and case handling duration attributes: a.

Pattern of the process with 100% activity path ratio

analysis by showing the analysis of activity performance and case handling duration attributes:

Pattern of process model with 100% activity path ratio (Researcher, 2020)a. Pattern of the process with 100% activity path ratio

The pattern from figure 9 is a process mapping with an activity path ratio of 100%. It is known that the red box performance analysis is a closed ticket activity with a duration of 3.61 days and the orange box is the case solve activity with a period of 17.48 hours. Meanwhile, for the attribute value, it is known that the average time for case resolution is 4.13 days.

The pattern from figure 9 is a process mapping with an activity path b. Pattern of the process with 80%-90% activity paths ratio ratio of 100%. It is known that the red box performance analysis is a

Pattern of process model with 80-90% activity paths ratio (Researcher, 2020) is the case solve activity with a period of 17.48 hours. Meanwhile, for the attribute value, it is known that the average time for case resolution is 4.13 days. b.

Pattern of the process with 80%-90% activity paths ratio

The pattern from figure 10 is a process mapping with an activity path ratio of 80%-90% in which there are 746 cases from the log. It is known that the red box performance analysis is a closed ticket activity with

The duration pattern figurethe10 is avalue process mapping with an activity path of 3.48from days. Meanwhile, attribute shows that the average time for case resolution is 3.85 ratiodays. of 80%-90% in which there are 746 cases from the log. It is c. Pattern of the process with 65%-75% activity path ratio known that the red box performance analysis is a closed ticket activity withFigure duration of 3.48 days. Meanwhile, the attribute value shows that Pattern of process modelfor with case 65-75% activity path ratio (Researcher, the average time resolution is 3.852020) days. c.

Pattern of the process with 65%-75% activity path ratio The pattern from figure 10 is a process mapping with an activity path ratio of 80%-90% in which there are

Figure 746 11 cases from the log. It is known that the red box performance analysis is a closed ticket activity with duration of 3.48 days. Meanwhile, the attribute value shows that the average time for case resolution is 3.85 days.

Pattern of process model with 65-75% activity path ratio c. Pattern of the process with 65%-75% activity path ratio (Researcher, 2020)

The process model pattern from figure 11 is a process mapping with an activity path ratio of 65%-75% in which there are 658 cases from the log. In the process model, it is known that from the performance analysis there is closed ticket activity with a duration of 3.48 days and the case solve activity with duration 9.92 hours. Meanwhile, for the attribute value, it shows that the average time for case resolution is 4.02 days.

The process model pattern from figure 11 is a process mapping with an activity path ratio of 65%-75% in which there are 658 cases from the log. In the process model, it is known that from the performance analysis there is closed ticket activity with a duration of 3.48 days and the case solve activity with duration 9.92 hours. Meanwhile, for the attribute value, it shows that the average time for case resolution is 4.02 days.

The process model pattern from figure 11 is a process mapping with an activity path ratio of 65%-75% in which there are 658 cases from the log. In the process model, it is known that from the performance analysis there is closed ticket activity with a duration of 3.48 days and the case solve activity with duration 9.92 hours. Meanwhile, for the attribute value, it shows that the average time for case resolution is 4.02 days. d.

Process model with less than 60% activity path ratio

The pattern from Fgure 12 is a process mapping with an activity path ratio less than 60% with 509 cases from the log. It is known from the performance analysis that there is closed ticket activity with a duration of 3.92 days and the case solve activity with duration 8.74 hours. Meanwhile, the attribute value, shows that the average time for case resolution is 4.31 days.

The pattern from 12ofisthe aactivity process mapping with activity Based on the results Fgure of the analysis performance and the attributes of thean duration of case path handling, it is summarized in Table 4 which the recorded activities have handling time more than 8 hours, ratio less than 60% with cases from the log. It is known from namely the case solved and closed ticket activities. the performance analysis that there is closed ticket activity with a

of 3.92 days and the case solve activity with duration 8.74 Summary of the results of activity performance analysis and the attributes of incident case duration the attribute value, shows that the average time for hours. handling Meanwhile, case resolution is 4.31 days. Duration incident handling using activity frequency ratio Activity Name

Submit Reported Support level 1 User communication Case solve Closed ticket Average resolve time

100% 1,13 minutes 2,68 hours 16 minutes 30 minutes 17,48 hours 3,61 days 4,13 days

90% 1,16 minutes 15 minutes 30 minutes 12,22 hours 3,48 days 3,85 days

75% 1,12 minutes 15 minutes 30 minutes 9,92 hours 3,58 days 4,02 days

60% 1,09 minutes 15 minutes 30 minutes 8,74 hours 3,92 days 4,31 days

Based on the results of the analysis of the activity performance and the attributes of the duration of case handling, it is summarized in Table 4 which the recorded activities have handling time more than 8 hours, namely the case solved and closed ticket activities. Note : Average resolve time: total time needed from ticket submit activity to closed ticket activity

Summary of the four process model patterns generated in table 4 showing the activities recorded which have a handling time of more than 8 hours, namely the case solved and closed ticket activities.

Duration incident handling using activity frequency ratio 100%

Submit

1,13 minutes

1,16 minutes

1,12 minutes

1,09 minutes

Reported

2,68 hours

Support level 1

16 minutes

15 minutes

15 minutes

15 minutes

User communication

30 minutes

30 minutes

30 minutes

30 minutes

Case solve

17,48 hours

12,22 hours

9,92 hours

8,74 hours

Closed ticket

3,61 days

3,48 days

3,58 days

3,92 days

Average resolve 4,13 days 3,85 days 4,02 days 4,31 days time Note : Average resolve time: total time needed from ticket submit activity to closed ticket activity

Summary of the four process model patterns generated in table 4 showing the activities recorded which have a handling time of more than 8 hours, namely the case solved and closed ticket activities. Analysis of Findings The next is business process mismatches which are analyzed from event log data and Incident Management Standard Operating Procedures.

Analysis of Findings

Standard Operating Procedure of the incident management for cloud service in PT. XYZ (Internal Data of PT XYZ, 2019)

The Standard Operating Procedure (SOP) in Figure 14 describes the process of handling service problems for the customer complaints, followed by the process of finding solutions and resolving these problems. Starting from the customer reporting a service problem to the service desk. The next stage is the service desk responds and records the incident log. The urgency of the reports received based on the category and priority matrix will determine the handling procedures performed. In this case, if the disruption is categorized as a major incident, it is immediately escalated to an incident manager and support level 3. If it is categorized as a minor incident, the incident ticket will be given to support level 2. After the disruption can be handled and the service can be reused by the customer, furthermore, the incident will be investigated regarding the causes and actions taken. The results of the analysis will be stored in the knowledge management system. Incident tickets and analysis results are submitted to the service desk so that incident tickets can be resolved.

The Standard Operating Procedure (SOP) in Figure 14 describes the process of handling service problems for the customer complaints,

Results from the analysis can be seen in Figure 13 business process from the event log and Figure 14 Standard Operating Procedure of Incident Management from PT. XYZ. It was found that the process was followed by the process of finding solutions and resolving these problems. Starting from the customer reporting a service problem to the service desk. The next stage is the service desk responds and records the incident log. The urgency of the reports received based on the category and priority matrix will determine the handling procedures performed. In this case, if the disruption is categorized as a major incident, it is immediately escalated to an incident manager and support level 3. If it is categorized as a minor incident, the incident ticket will be given to support level 2. After the disruption can be handled and the service can be reused by the customer, furthermore, the incident will be investigated regarding the causes and actions taken. The results of the analysis will be stored in the knowledge management system. Incident tickets and analysis results are submitted to the service desk so that incident tickets can be resolved. Results from the analysis can be seen in Figure 13 business process from the event log and Figure 14 Standard Operating Procedure of Incident Management from PT. XYZ. It was found that the process was not executed according to the PT. XYZ’s standard operating procedure. At this stage of the process, support level 2 examines and identifies all efforts/actions that have been taken to resolve the incident. The process of initiating change. Before starting the incident correction process, the support must complete a change request form with the necessary information related to the correction plan. They conduct post-implementation review process. The support prepares a report after implementing the incident correction process by describing the incident resolution action and the results achieved. The incident report process is managed by incident management. The incident manager conducts a review of the incident report, ensuring that the incident is validly described in the report. Impact on company business From the identification that has been described in the business process analysis, it is known that it can affect the Cloud Computing business unit of PT. XYZ. One of the issues is penalty, which affects the company’s margins. The parameter in the calculation is the time resolution of the incident. PT. XYZ provides cloud services with 99% uptime. If using the average time of incident resolution (Table 4),

4.13 days, where the percentage of incident resolution is 86.2%. As portrayed from the calculation of additional expenses from PT. XYZ, it is known that one incident case can give an additional burden of 14% of the cost of the product. This certainly reduces the margin set to only 10% of the product’s price so that it resulted in the loss of the company’s capital and margins. Recommendation After analyzing the discovery process by providing an overview of the findings, there are three diagnoses from the research. First, a business process that is not in accordance with the Standard Operating Procedure of PT. XYZ. The second is from the analysis of activity performance that lasts more than eight hours, there were found closed ticket and case solve activities. The third is that the impact on the additional burden caused by the incident time resolution is less than the minimum percentage of incident time resolution, namely 99% in a month. In accordance with the result of the analysis, the researcher made the following recommendations. More in-depth mapping of duties and authorities so that business processes can be carried out following the PT.XYZ’s standard operating procedure. Incident management must increase responsiveness as an intermediary between the service desk and support level 2. The development of optimal incident management needs to be formed by a functional team for incident monitoring and auto-closed system within a particular time. CONCLUSION Based on the results of the research, data analysis, and discussion of incident management business processes on the Cloud Computing service of PT. XYZ, and the process mining results, which process mapping and matching with standard operating procedures of PT. XYZ carried out in the incident management business process in 2019, it was found that several processes were not carried out according to the standard operating procedures of PT. XYZ. The result of activities performance analysis for the recorded processes shows that there is a long incident handling time with a duration of more than 8 hours in the solved case and closed ticket activities. The impact of the incident management business process’s incompatibility with standard operating procedures resulted in the case handling exceeding the stipulated resolution time and poses a lot of financial risks for the business. ACKNOWLEDGMENT We would like to thank the Faculty of Economics and Business Telkom University for supporting this research.

References

1. Aalst, W. M. P. (2016). Process Mining: Data Science in Action (2nd ed.). Berlin, Heidelberg: Springer.
2. Agutter, C. (2019). ITIL 4 Essentials (2nd ed). United Kingdom, Cambridgeshire: IT Governance Publishing Ltd.
3. Attaran, M., & Woods, J. (2018). Cloud computing technology: Improving small business performance using the internet. Journal of Small Business & Entrepreneurship, 13(2), 94-106. doi:10.1080/08276331.2018.1466850
4. Brocke, J. V., & Rosemann, M. (2015). Business Process Management. Wiley Encyclopedia of Management, 1–9. https://doi.org/10.1002/9781118785317.weom070213
5. Burattin, A. (2015). Process Mining Techniques in Business Environments. Switzerland: Springer.
6. Burlton, Roger T. (2001). Business Process Management: Profiting from Process. USA, Indiana Polis: Sams Publishing.
7. Ciesielska, M. (2017). Implementation of itil service lifecycle in small and medium-sized enterprises of polish ICT sector. Information System in Management, 6(2), 85–96. doi:10.22630/isim.2017.6.2.1.
8. Dumas, M., La Rosa, M., Mendling, J., & Reijers, H. A. (2018). Fundamentals of Business Process Management. Springer. Switzerland.
9. Effendi, Y. A., & Nuzulita, N. (2019). Process discovery of business processes using temporal causal relation. Journal of Information Systems Engineering and Business Intelligence, 5(2), 183. doi: 10.20473/jisebi.5.2.183-194.
10. Fani Sani, M. (2020). Preprocessing Event Data in Process Mining. Proceedings of the Doctoral Consortium Papers Presented at the 32nd International Conference on Advanced Information Systems Engineering, France, June 08 – June 12. pp. 1-10. Retrieved from http://ceur-ws.org/Vol-2613/paper1.
11. Foo, A. T. L., Mah, P. Y., Ng, A. C. S., & Choy, J. Y. (2020). The changeless core in a changing business environment. Journal of Business Management and Accounting, 10(1), 95–107. doi: 10.32890/jbma2020.10.1.6
12. Frost & Sullivan. (2018, 25 May). Digital Marketing Overview: Indonesia. Industry Research Analysis. Retrieved November 12, 2020 from https://ww2.frost.com
13. Hammer, M. (2015). “What is business process management?”, International Handbooks on Information Systems, in: Brocke J., & Rosemann, M. (ed) Handbook on Business Process Management 1 (1st ed.). Berlin, Heidelberg: Springer. doi:10.1007/978-3-642-45100-3_1
14. Indrawati. (2015). Metode Penelitian Manajemen dan Bisnis: Konvergensi Teknologi Komunikasi dan Informasi. Indonesia, Bandung: Refika Aditama.
15. Kaiser, A. K. (2017). Become ITIL Foundation Certified in 7 Days: Learning ITIL Made Simple with Real-life Examples. USA, California: Apress Media.
16. Kaiser, A. K. (2020). Become ITIL® 4 Foundation Certified in 7 Days: Understand and Prepare for the ITIL Foundation Exam with Real-life Examples (2nd ed.). USA, California: Apress Media. Renato Neder, Paulo Ramalho, Olivan Rabelo, Elizandra Zambra, Cristiano Maciel & Nathalia Benevides. (2018). Business Process Management: Terms, Trends and Models. 163-170. doi: 10.15439/2018F334.
17. Mesbahi, M. R., Rahmani, A. M. & Hosseinzadeh, M. (2018). Reliability and High Availability in Cloud Computing Environments: A Reference Roadmap. Human-centric Computing and Information Sciences, 8(1). doi:10.1186/s13673-018-1043
18. Menon. (2020, November 12). Process flow status and the lifecycle of an incident request - Documentation for Remedy Service Desk 18.05 - BMC Documentation. Retrieved from https://docs. bmc.com/docs/servicedesk1805/process-flow-status-and-the-lifecycle-of-an-incident-request-805363805.html.
19. Modisane, P. & Jokonya, O. (2021). Evaluating the benefits of Cloud Computing in Small, Medium and Micro-sized Enterprises (SMMEs). Procedia Computer Science, 181, 784-792. doi:10.1016/j.procs.2021.01.231
20. Nafasa, P., Waspada, I., Bahtiar, N., & Wibowo, A. (2019). Implementation of Alpha Miner Algorithm in Process Mining Application Development for Online Learning Activities Based on MOODLE Event Log Data. 2019 3rd International Conference on Informatics and Computational Sciences (ICICoS). Published. doi:10.1109/icicos48119.2019.8982384
21. Nath, M. P., Sridharan, R., Bhargava, A., & Mohammed, T. (2019). Cloud computing: an overview, benefits, issues & research challenges. International Journal of Research and Scientific Innovation (IJRSI), 6 (II), February 2019.
22. Putri, L. S., & Ramantoko, G. (2020). Implementasi Process Mining Dengan Metode Process Discovery Studi Kasus Pada Aplikasi Integrated Flexible Learning Experience (IFLEX). Jurnal Ekonomi : Journal of Economic, 11(2). doi:10.47007/jeko.v11i2.3379
23. Rosing, M. von, Scheel, H. von & Scheer, A.-W. (2015). The Complete Business Process Handbook: Body of Knowledge from Process Modeling to BPM. Volume I (1st ed.). San Francisco, CA: Morgan Kaufmann Publishers Inc.
24. Schnepp, R., Vidal, R., & Hawley, C. (2017). Incident Management for Operations (1st ed.). Sebastopol, CA: O’Reilly Media Inc.
25. Sekaran, U., & Bougie, R. (2016). Research Methods for Business: A Skill Building Approach (7th ed.). New York: Wiley
26. Vázquez-Barreiros, B., Chapela, D., Mucientes, M., Lama, M., & Berea, D. (2016). Process Mining in IT Service Management: A Case Study. International Workshop on Algorithms & Theories for the Analysis of Event Data. Brussels. Belgium.
27. Wilianto, & Fitri, I. (2015). Information Technology Service Management with Cloud Computing Approach to Improve Administration System and Online Learning Performance. CommIT (Communication and Information Technology) Journal, 9(2), 51–57. doi.org:10.21512/commit.v9i2.1655
28. Weske, Mathias. (2019). Business Process Management – Concepts, Languages, Architectures (3rd ed). Springer.Berlin.