A developer starts a timer at 16:55 on Friday. They close the laptop and go home. At 09:00 on Monday, they notice the timer is still running and press Stop.
The record contains 64 hours and five minutes. The developer did not spend the weekend working. The clock did.
This is an illustration, not a finding from a customer dataset. It describes a possible failure with an obvious consequence: if a report presents that interval as continuous human effort, the report is wrong. Its arithmetic may be flawless. Its interpretation is not.
Call it a zombie task. A record that keeps accumulating time after the work it was meant to represent has stopped.
First, establish what the clock measures
A ticket opened on Friday and closed on Monday may correctly have an elapsed duration of 64 hours and five minutes. That interval can include waiting, a weekend, work by several people and activity recorded elsewhere. It is useful information about the process.
A personal timer intended to record active work has a different meaning. The same timestamps could be wrong for that purpose.
Before calling a duration excessive, ask what its start and end represent. An open ticket is not an open laptop. An open laptop is not proof of attention. A timestamp pair cannot settle those distinctions on its own.
The academic literature treats event-log quality as a substantive problem. Suriadi and colleagues documented eleven recurring imperfection patterns and evaluated their approach through a case study and researcher and practitioner feedback. Their work supports systematic investigation of the records before analysis, rather than assuming every row means what its column heading suggests.[1]
An outlier is a question
A task takes much longer than comparable tasks. Something deserves attention. But what?
It might be a forgotten timer. It might be a difficult repair, a genuine delay, a different activity incorrectly grouped with routine work, or a timestamp with the wrong time zone. Those explanations require different responses.
Calling the observation an outlier identifies its relationship to the comparison group. It does not identify its cause.
Fischer and colleagues developed fifteen timestamp-quality metrics within a user-guided approach to detecting and quantifying imperfections. The human and domain context matter: a suspicious pattern is a starting point for investigation, not an automatic reconstruction of reality.[2]
An arbitrary four-hour ceiling cannot tell you that a recorded six-hour task really lasted four hours. It can only tell you what your chosen ceiling permits the report to show.
Your detector can miss the obvious
Consider seven recorded durations, in minutes: 45, 60, 55, 30, 90, 45 and 3,840.
Their mean is 595 minutes. A rule that flags values above the mean plus three population standard deviations produces a threshold of approximately 4,570 minutes. The 3,840-minute record passes. The extreme observation helped stretch the threshold that was supposed to detect it.
Leys and colleagues explain this weakness of mean-and-standard-deviation screening and describe median absolute deviation as a more resistant alternative.[3] That does not make every robust threshold universally correct. Hubert and Vandervieren show why skewed distributions also matter: conventional boxplot rules can flag observations merely because the underlying distribution is asymmetric.[4]
Choose the comparison group and method deliberately. Then check whether the flags help people find actual defects. A method that rejects the difficult work along with the broken timers has failed in a different direction.
Preserve the evidence
Keep the original record. Mark the suspected problem and the reason for the flag. If the source owner corrects it, preserve the correction and its basis. If the duration cannot be established, say so.
An analysis may exclude certain records under a declared rule. That is a decision about the analysis, and readers should be able to see its consequences. It is not permission to replace an inconvenient observation with a convenient number and call the result accurate.
To claim that a detector finds forgotten timers, test it against confirmed errors and confirmed legitimate long tasks. Count both what it catches and what it wrongly accuses. Keep unresolved records unresolved.
The aim is not a prettier average. It is an account of work that survives questions about its evidence.
A clock can keep working after you stop. Your analysis should know the difference between measuring the clock and claiming to measure you.
References
- Suriadi, S., Andrews, R., ter Hofstede, A. H. M. and Wynn, M. T. (2017). Event log imperfection patterns for process mining: Towards a systematic approach to cleaning event logs. Information Systems, 64, 132–150. DOI: 10.1016/j.is.2016.07.011.
- Fischer, D. A. et al. (2022). Towards interactive event log forensics: Detecting and quantifying timestamp imperfections. Information Systems, 109, 102039. DOI: 10.1016/j.is.2022.102039.
- Leys, C., Ley, C., Klein, O., Bernard, P. and Licata, L. (2013). Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median. Journal of Experimental Social Psychology, 49(4), 764–766. DOI: 10.1016/j.jesp.2013.03.013.
- Hubert, M. and Vandervieren, E. (2008). An adjusted boxplot for skewed distributions. Computational Statistics & Data Analysis, 52(12), 5186–5201. DOI: 10.1016/j.csda.2007.11.008.