What Is Robotic Process Automation? Can It Assist Internal Audit?
With Robotic Process Automation, people create a program that acts as a robotic worker called a bot. The bot has the ability to perform repetitious, predictable, rule-based actions. The bots are built with the ability to mirror the actions that a human would perform. In audit, we sometimes perform testing, like data analytics, that is rule-based. We should consider if and where Robotic Process Automation tasks could be used to add efficiency and accuracy to our work.
What Is RPA (Robotic Process Automation)?
RPA (Robotics Process Automation) entails a bot or software application that can be programmed to perform basic human tasks that are typically rote or manual in nature. Robotics Process Automation has been one of the biggest buzzwords in the financial and tech industries: Yet, internal audit tends to hold back and is more reluctant than other industries in embracing progressive technology such as RPA. Is there room for innovative robotics to help internal auditors — and if so, where will its biggest areas of impact be?
How Does Robotic Process Automation Work?
Robotic Process Automation is the creation of bots that can interact with data just like a human would, but bots have an advantage. Since bots are software, these can operate continuously without making mistakes like people. If you are considering automation with RPA, there is an eight step process:
1. Requirements Gathering
Automation with RPA starts with understanding the process you would like to automate. As a best practice, the process should be mapped in its current state so the bot designers know where data is coming from, what systems are involved, and how the desired outcome will look.
2. Readiness Assessment
In the readiness phase, the goal is to assess whether or not your organization is ready for automation and if there is the required skill set for building Robotic Process Automation tasks internally. If the skills do not exist, the decision will be made for outsourcing the project or keeping the process in the current state.
3. Project Planning
If there is a decision to move the project forward, the project plan should be designed between the group that is requesting automation with RPA and the bot developer. The team should consider how this project fits into the broader topic of Robotic Process Automation. Most organizations are pushing for more automation with RPA, so your project is not likely to be the first of the last of its kind. Planning should also include roles and responsibilities, the eventual monitoring plan, and update schedule.
4. Proof of Concept
Now it’s time to let the developers work out the proof of concept (POC). They will take the information you have provided up to this point and test the theory. Usually this is done with a very small amount of data. The goal is to see if the Robotic Process Automation tasks are feasible and if the learning logic allows the bot to produce truer results over time.
5. Pilot Testing
If the POC shows that the automation with RPA is viable, the next stage is to try the RPA in the real world. During the pilot test, the automation is run in a monitored development environment. The objective of the test is to mimic the real world usage as closely as possible. Typically, the RPA is run in parallel with the current process to compare the outcome. Several key factors are measured in this phase: accuracy, completeness, reliability, and speed. If there are any issues with the results, the bot is sent back to the developers with as much detail as possible. The team may need to repeat the pilot several times.
6. Production Implementation
Once the pilot testing results match the desired outcome, the bot is ready for deployment into a production environment. The testing completed in the POC and pilot should have prepared the team for the real-world implementation.
7. Monitoring
The point of the Robotic Process Automation is to have a bot perform repetitive tasks so that your team can be more productive, but that does not mean ignoring the bots. The outputs should be monitored regularly for anomalies. Some bots are designed to simply post the output files to a shared location, while others are built to notify individuals if there is a problem detected. Monitors should also include watching for blank results. If a system update takes place for any system in the automated process, the bot can break and will need to be updated by the developers.
8. Updating
The process for updating is essentially the same as the first development effort. The bot will be coded by developers, a pilot test in a development environment is completed, and the Robotic Process Automation is then redeployed into production.
What Are the Benefits of RPA?
The main benefit of embedding bots in any work environment is that a bot can take care of repetitive manual tasks, freeing up time for employees to perform more value-add activities.
Main Benefits of RPA Include:
- Bots work 24/7 and can work when everyone else goes home
- Bots don’t make mistakes — leading to improved overall process efficiency and quality versus humans
- Bots can perform the same tasks humans do — at somewhere in the ballpark of 25 to 35 percent the cost of a human performing the same task
What Processes Are Relevant to RPA?
Broadly speaking, any process that is highly repetitive is a candidate for automation with RPA. Examples include mundane tasks like data entry and data validation, but the bots could be used for report creation and distribution, emailing customers, sending invoices, running payroll, appointment scheduling, and much more.
Specifically in internal audit there are many tasks we can consider for Robotic Process Automation. Thinking through the full audit plan life cycle, Robotic Process Automation tasks can be designed to gather data, feed information to a risk assessment tool that scores the audit universe, and the output could be a suggested audit plan. Since this can run all the time, the outcome is continuous risk assessment and audit planning. The output could be programmed to suggest an audit calendar based on rules including priority scheduling and assignments based on skills and credentials.
Data analytics was mentioned earlier, but the broader topic is automated testing. For the most basic tests, the exceptions can be sent to the control owners. Ultimately, the goal is removing audit from the equation. The Robotic Process Automation tasks can be owned by the business. Audit would then test the bots as the control test.
Reporting can also be coded for automation and automatic delivery, as can reminders for corrective action updates. Of course, audit management software is also designed with several of these tasks already.
How Does RPA Differ from Traditional Automation Solutions?
Robotic Process Automation differs from traditional automation in the capability to learn. The learning algorithm built into the bot reduces the number of false positives and provides truer results over time. The real value in Robotic Process Automation is the increasing level of efficiency gained as the automation becomes more accurate.
The 5 Biggest Opportunities for Robotic Process Automation to Assist Internal Audit
Internal Audit can play a role in helping organizations identify opportunities to embed audit automation control activities within business processes and functions. Below are the areas where RPA can make the biggest impact.
1. Data gathering and cleansing for analytics
An RPA Center of Expertise (CoE) can generate and standardize data to run custom analytics, doing the work of pulling the data to be used by internal and external auditors, including automation checks for completeness of fields, duplicates, and validation, etc. This frees internal audit from time spent coordinating and gathering this data.
2. Risk assessment
Bots can help automate the initial data gathering and classification for the annual risk assessment process. They do this by soliciting feedback from participants upfront and identifying core trends. This allows for the in-person meetings to be focused on trend analysis and deep dives into the risks of the organization.
3. Population gathering
During the sampling and initial evidence gathering for standard evidence for controls, bots can help process data populations and do so more efficiently and accurately than humans can. This is especially valuable when it comes to large populations requiring heavy resources to process, such as analyzing thousands of statement documents.
4. Automation of controls
Bots can run controls testing — especially for control areas that are standardized, such as where tickets and fields are consistently used. This frees internal audit from performing those standard required checkmarks.
5. Internal Audit Project Management Office (PMO) areas.
Several areas where RPA can assist include:
- Identifying open items, sending follow-up emails and documenting status, etc
- Tracking progress against the project plan or annual audit plan (can use RPA to monitor KPIs in the process)
- Automating reporting — including report templates, audit committee decks, etc
RPA’s Impact in Driving Value in Internal Audit
Robotics Process Automation can lead to efficiencies in monitoring controls, better visibility, and time and cost savings.
Greater coverage
Having a bot manage and drive the full analytics allows internal audit professionals to get greater coverage across the organization (more data, transactions, etc.) while not increasing the time or FTE needed to analyze large data populations. This also removes audit luck from the equation and helps auditors get closer to absolute assurance. RPA allows teams to find the anomalies in data/transactions and focus on those outliers.
Time and cost savings that can be dedicated to more value add engagements
Internal audit teams who frequently interact and coordinate with the business and external auditors benefit highly from RPA. Audit automation allows internal audit to pivot from supporting external audit activities, such as evidence pulling and sample gathering, toward focusing on operational reviews with the business.
On-demand visibility into department performance
Using automation in reporting and project tracking allows for on-demand visibility into department performance – both against the plan and within specific KPIs.
Example of RPA in Internal Audit
One internal audit team identified multiple bottlenecks in their internal audit processes: audit notification, wrap-up, reporting, and follow-up tracking. Once they implemented automated KPI tracking and reporting to the Audit Committee, the timeline shortened and they were able to show the benefit of a standardized report without having to spend time manually tracking and reporting.
What’s the Biggest Challenge of Robotics Process Automation Adoption in Internal Audit?
Possibly the greatest challenge to RPA adoption in internal audit is lack of awareness of the benefits it can provide. But for internal auditors who have adopted, innovative robotics has helped accounting and finance automate elements of financial reporting standards, such as SOC 1 and 2, ISO, and HIPAA.
One example is an internal audit team who used automation to support their SOC 1 and SOC 2 processes for their service auditor. They successfully automated their risk assessment and control certification ahead of the annual inspection. Additionally, they are using RPA to track outstanding evidence, follow-up requests, and management responses.
This internal audit group also sought to roll-out automated testing for their SOX compliance programs across their global companies. The group is now estimating a 25% hours savings by implementing this consistency in testing approach, evidence gathering, and reporting to management across the program.
Ready to Expand Your Automation with RPA?
In conclusion, there are plenty of opportunities to leverage Robotic Process Automation (RPA) for monitoring controls, regulatory compliance, policies, and reporting activities. It is up to internal audit to decide if this is a process worth undertaking — then seek to identify risks associated with intelligent audit automation initiatives and work to build and roll out an RPA plan to ensure proper governance, controls, and monitoring are in place. Want to learn more about audit automation? Contact us below today.
