isaca charlotte chapter robotic process automation (rpa) · rpa considerations for internal audit...

ISACA Charlotte Chapter

Robotic Process Automation (RPA)

www.pwc.com

March 13, 2018

PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)

Speaking with you today

2

Sachin Mandal

PwC Partner

Enterprise System Solutions Practice

[email protected]

(973)580-9950

Bob Herman

PwC Director

Enterprise System Solutions Practice

[email protected]

(704)576-1011


Agenda

3

What is RPA (facts and myths)?

Who are the main software vendors

How do you establish an RPA program?

RPA considerations for Internal Audit and Compliance Organizations

• How Internal Audit and Compliance can benefit from RPA to improve their own efficiency and effectiveness

• How to assess business initiatives around RPA

Becoming dangerous - Where to find additional information


Evolution of RPA

Workforce efficiency and effectiveness have long been a top enterprise priority. As technology continues to rapidly evolve in the space, decades of proven labor arbitrage and shared services are no longer the most constructive approach.

4

Pre

se

nce

Human workforce Use of robotics

Evolution of robotics

2015-2017

Robotics Process

Automation (RPA)

Applies technology to create “bots” to

replace humans who plug the gaps

between non STP systems – “low

value activity”

• Logic driven, software executes pre-

programmed tasks as defined by the

robot designer

• For certain activities - estimated 3

times savings over traditional off-

shoring/BPO

Location Strategy, Outsourcing

& Lean

Migration of manual tasks to off-shore

locations – effective strategy for

decades, expanding to more

sophisticated tasks

• Efficiency vs. Effectiveness

• Labor arbitrage savings 20-30%

• Lean principles drive additional 5-

15% efficiency

2005-2015

Intelligent Process

Automation (IPA)

Incorporates cognitive intelligence to

execute tasks and update rules based

on “learned” trends, requiring minimal

human oversight

• Estimated to replace 110-140M

knowledge workers by 2025

• Financial Services, Health and High

Tech are emerging industry leaders

Fast emerging

Mainstream adoption

Source: PwC Research, Institute for Robotic Process Automation “Smart Process Automation: The What, How and Who of Quantum Leap in Enterprise Productivity”, 2016, McKinsey Global Institute “Disruptive technologies that will transform life, business and the global economy”, 2014


What is Robotic Process Automation?

5

Robots are…

Computer coded software

• Non-invasive, zero change integration on target system and security

• Operate on top of other existing software

Mimic interactions of users

• Record and automate user interactions with one or more software applications

• Interact with the user interface (UI) of existing applications in the same way that an everyday

user would

Work cross-functional and cross-applications

• Are entirely technology agnostic and can be used with any application (e.g. ERP, DB, MS Suite,

ASCII file, structured PDF, thin clients such as Citrix)

• Use a central repository for easy management of automation scripts and processes

Enable the automation of repetitive, rule-based processes

• Build workflows with dynamic decision/branch points and loops for scaling (up/down)

• Ability to granulize processes into smaller components to allow reusability


More specifically, “robots” can do the following?

RPA has been being applied to processes across multiple functional areas.

6

Transactional

HR services

Finance &Accounting

Risk, Compliance& Internal Audit

Desktop consolidation

Payroll

Batch processing

Record – to - Report

Fraud detection

Data entry

Servermonitoring

Inventory & stock Mgmt.

Document formatting

Recruitment

Trend tracking

Form Data

Capture

Education & learning

Application monitoring

Fixed Assets

Customer Relationship Management

Compliance reporting

Folder synchronizing

Order –t0 - cash

Reporting (KPI, Regulatory Filings)

Problem resolution

On boarding

Installation

Collections

Compliance Testing

Documents & record

management

Time & Attendance

Management

FTP downloadupload and backup

Claims/Invoice Mgmt.

Monitoring & Surveillance

Customer Service support

Personal administration

File management

Procure –to Pay

Controls Testing

Workflow management

Benefits administration

Email related tasks

Sales orders

Quality Control

IT


Polling question #1

True or False

Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate?

7


Polling question #1 (continued)

True or False

Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate?

FALSE – Although RPA can be used to make certain activities within a process more efficient, more accurate and more cost effective, humans still need to review exceptions, monitor the “bots” and manage the overall process.

8


Polling question #2

True or False

Robotics Process Automation (RPA) is mostly a cost cutting play?

9



True or False

Robotics Process Automation (RPA) is mostly a cost cutting play?

FALSE – Although RPA can help reduce costs, there are other significant benefits that can be gained through the implementation of RPA technology.

10

PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA) 11

RPA is more than just cost cutting

Quality & complianceWith improved accuracy, process output quality

improves drastically

Exception Reduction 50-70%

Simple process accuracy – 100%

Revenue enhancementRPA can enhance customer engagement through shorter cycle time to service customers and more

accurate and timely reaction to demand.

Value focused talentThe priorities of the employee workforce will shiftto innovation, strategy, and other businessdevelopment activities

Capacity Creation - 60-80%

ScalabilityA virtual workforce can respond to growth events (e.g. organic, acquisitive) with speed, agility, and resiliency. Cost of a robot is 1/3 (one-third) of that of anoff-shore employee.

Employee & customer satisfactionShorter cycle times and increased quality lead automatically to improved customer experience

24/7One robot can do the work of two to five FTEs, 24/7

Speed to valueRobots are expected to have 3 times human productivity.

Sooner– 2-4 weeksFrequently – 2 week deployment cycles

Cost reduction Cost reduction applies across the human capital supply chain.

Labor cost reduction – 25-50%3rd party price down – 45%

Cost reduction

Quality& compliance

Revenue enhancement

24/7

Speed to value

Employee & customer

satisfaction

Scalability

Value focused talent

RPA Value

Drivers


RPA software providersForrester wave ranking, 2017

12

Challengers Contenders

Strong

Performers Leaders

Strong

Week

StrongWeek

Market presence

Softomotive

Contextor

EdgeVerve

Systems

NICE

Kryon

Systems

Automation

Anywhere

Blue

Prism

UIPath

WorkFusion

Pegasystems

Redwood Software

Kofax.

. .

..

.

.

...

.

.

. . . . .

Current

Offering

Strategy


How do you select the right activities to automate?

13

High volume/Low

complexity (RPA)

Low Volume/High Complexity

tasks would be more suited

to IPA

Swivel chair processes

Supported by multiple software

applications that are

not integrated

Large teams

More than 10-FTE performing

the same role or activity

Quality is key

High level of quality is

mandatory, and/or regulated

High levels of

standardization

Lean or process re-design

can help stabilize processes

prior to implementation

Highly rules-based

processes

RPA can help solve processes

with ambiguous rules

Stable environment

Technology systems,

organization and/or process

does not expect to change in

the mid-long term

Limited exception handling

Complex exception handling

should be handled by a human

Lesson learned: The opportunities for automation are usually

found at the activity level (e.g. an opportunity was identified for

data extraction and manipulation as part of the automated

process for monthly standard reporting )

Business case

Assessment framework

Process & activity scoring

Process prioritization

Process characteristics Tools examples


Robotics deployment approach

14

Immediate mobilization focus

Enterprise Mobilization & Deployment

Automation strategy

Pilot Program

(2 – 3 months)

“First 5” -- Prove

the Value

Business as

Usual “Next 500”

– RPA becomes

part of the culture

Automation Program (6 - 9 months)

“Next 50” – Develop an intake strategy,

create demand and a roadmap, build

and deploy Robots

• Case for change

• Opportunity assessment and benefits quantification

• Automation driven functional/technical architecture strategy

• Link to overall corporate strategy (e.g., customer satisfaction)

Build Execution

• Governance and operating model design

• Risk and control assessment and implementation

• Future state BAU operating model

• Detailed architecture design

Program Standup

• Future user operating model

• Technology support model at scale

Long Term Operating Model

Strategy

Understanding the value

and solution exploration

• Proof of concept buildout

• Preliminary vendor

exploration and assessment

• Innovation strategy

• Knowledge share around

automation strategy best

practices

• Initial Robotics strategy

planning

Phase 1: Set the strategy Phase 2: Mobilize the program Phase 3: Execute the planPhase 0: Investigate

• Delivery management and oversight

• Business analysis (process design and user testing)

• Robot script development and tool configuration


Internal audit and compliance RPA considerations

15


How will internal audit and compliance interact with the center of excellence (CoE)?

16

Key Considerations:

• Skill hire/ train/co-source IA/Compliance – Define future internal auditor

• Automation of internal audit and compliance processes such as risk assessment / reporting

• Organizational structure –identify; design; develop; test; support – RACI matrix –Central vs. federated

• Evidence management / standardization

• Designing controls of the future Automate first line vs. Automate testing

PwC


RPA use case – compliance/IA testing of control operating effectiveness

https://www.youtube.com/watch?v=oreDg8BqZbo

19

https://www.youtube.com/watch?v=oreDg8BqZbo


RPA use case – Compliance/IA testing of control operating effectiveness

18

An AP Manager performs a manual control to review vendor master additions and changes in SAP on a weekly basis. Periodically, Internal Audit

pulls a sample of changes to ensure control was operating effectively. Due to the nature of the control, it is a candidate for Robotics Automation

for IA testing of manual control.

SAP

Changes to

Vendors

Report

Changes to

Vendors

Report TeamMate Sharepoint Sharepoint Excel Excel Emaill

Associate repeats these steps for each

sample selected

Manual steps - 10

Average Time - 8-10 hours for a sample of 20

Current state

Associate

enters a

data range

and runs

standard

report to

extract data

Associate

references

testing

guide and

selects a

sample size

Associate

selects a

sample of

changes

from

standard

report

Associate

accesses

document

repository

Associate

searches

document

repository

for change

request

form

Associate

accesses

workpaper

Associate

documents,

if any, the

number of

exceptions

noted while

testing the

control

For samples

with

exceptions,

associate

follows up

with control

owners

Associate

reviews

testing &

artifacts to

conclude on

operating

effectiveness

of control

Associate

logs into

SAP

Bot enters a

data range

and runs

standard

report to

extract data

Bot

references

testing

guide and

selects a

sample size

Bot selects

a sample of

changes

from

standard

report

Bot

accesses

document

repository

Bot

searches

document

repository

for change

request

form

Bot

accesses

workpaper

Bot

documents,

if any, the

number of

exceptions

noted while

testing the

control

For samples

with

exceptions,

Bot follows

up with

control

owners

Associate

reviews

testing &

artifacts to

conclude on

operating

effectiveness

of control

Bot logs

into SAP

Manual Steps - 1

Average Time - 1 hour to review and conclude

Future state


RPA use case – Compliance/IA reporting

19

The reporting process, be it reporting weekly for balanced scorecard or annually for audit committee meetings, has significant manual steps to ensure that data

is collected, complete, and correct, which are based on a series of rules. Due to the nature of the process, reporting data sourcing and data quality steps may be

candidate for Robotics Automation

Command

Center

Status of

audits

Remediation

status Sharepoint Workivia Email

Manual steps - 9 per report attribute

Average Time - 9-10.5 hours Estimate 90 minutes per report attribute with an average of 6-7 attributes per report

Current state

Associate

logs into

source

system

Associate

runs query/

report to

extract data

Associate

performs

analysis on

data for

completene

ss and

accuracy

Associate researched status

that have remained

unchanged month over

month by emailing owner

update required?

If yes, restart.

Associate

populates

report

templates

Associate

includes

response in

commentary

Associate

distributes

completed

report via

email for

commentary

Management

reviews and

provides

commentary

IA associate

gathers

data from

source

systems

Bot logs

into source

system

Bot runs

query/

report to

extract data

Bot

performs

analysis on

data for

completeness

and accuracy

Bot researched status

that have remained

unchanged month over

month by emailing owner

update required?

If yes, restart

Bot

populates

report

templates

Bot includes

response of

unchanged in

commentary

Bot

distributes

completed

report via

email for

commentary

Management

reviews and

provides

commentary

Bot gathers

data from

source

systems

Manual Steps - 1

Average Time - 30 minutes

Future state

Teammate

Controls

tested

Open

issues

e.g., Month over month compare

Powerpoint

document

GRC Tool


RPA use case – Compliance/IA documentation and test script preparation

20

Compliance or Internal Audit team creates a risks and controls matrix (RACM) that is used to create testing scripts and is used to populate a GRC tool to perform

testing at a later date. Due to the nature of the process, it is a candidate for Robotics Automation for both the development of testing workbooks and automated

upload and conversion into a GRC Tool.

Manual steps - 6

Average Time - 40 hours for test scripts

Current state

Associate

populates RACM

with risks and

controls data

Associate opens

IT dependent test

script template

Associate

populates IT

dependent test

script template

with data from the

RACM

Associate

manually saves IT

dependent test

script in Excel

format

Associate

manually uploads

test script

template to GRC

tool

Associate creates

Risks and

Controls Matrix

(RACM) using

standard template

Associate

populates

RACM with

risks and

controls

data

Bot selects

and opens

Risks and

Controls

Matrix

Bot selects

specific data

elements

required to

create IT

dependent

test script

Bot opens IT

dependent test

script template

Bot

populates

template

with data

and saves

individual

test scripts

Bot repeats

the process

for all controls

specified in

RACM and

creates test

templates

Bot uploads

IT

dependent

test scripts

into GRC

Tool

Associate

reviews test

scripts for

data

accuracy,

completeness

, and validity

Associate

creates Risks

and Controls

Matrix (RACM)

using standard

template

Manual Steps - 3

Average Time - 2 hours to review and conclude

Future state

Excel

Associate repeats these steps for each IT dependent control

Excel Excel Excel Excel Excel


Polling question #3

True or False

In order to implement RPA within your internal audit or compliance department you need to have trained – highly technical staff?

21



True or False

In order to implement RPA within your internal audit or compliance department you need to have trained – highly technical staff?

FALSE – It is a good idea to be knowledgeable of RPA, but like most transformational efforts don’t get too booged down on the technology.

22


RPA risk considerations – Project monitoring

23


Polling question #4

True or False

The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each “bot”?

24



True or False

The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each “bot”?

FALSE – Similar to any other transformational project, internal audit and compliance should be involved early to assess Management’s overall governance process as well as the development lifecycle of “bots” that are considered higher in risk. For example, what if your company was planning to implement a “bot” to perform control processes that are subject to external audit (ICFR)?

25


Where to find additional information

PwC: www.pwc.com/us/intelligentautomation

UiPath Training: https://www.uipath.com/rpa-academy

Automation Anywhere Training: https://www.automationanywhereuniversity.com/

BluePrism Resources: https://www.blueprism.com/resources

Virtual Operations Methodology: http://virtual-operations-volt.com/00_process-automation-

methodology/

26

http://www.pwc.com/us/intelligentautomation

https://www.uipath.com/rpa-academy

https://www.automationanywhereuniversity.com/

https://www.blueprism.com/resources

http://virtual-operations-volt.com/00_process-automation-methodology/

© 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its

subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm

is a separate legal entity. Please see www.pwc.com/structure for further details.

Thank you for you time today!