Robot maintenance creation departments are subject to different risk and control standards, and will not always know all the correct procedures. The external and internal audit seeks a solid governance structure to support each robot delivery model. Always revolving around clear standards of organizational oversight, business justification and development standards defined by a center of excellence.
There is a risk that some robotic process automation could actually decrease the effectiveness of controlling a process. In this case, the benefits of RPA may not outweigh the cost of the investment, and the proliferation of robots may lead to a more vulnerable and fragmented technology environment. Management must have a structured way of assessing which processes are suitable for automation. This should depend on predetermined factors such as risk inherent to the underlying process, degree of process complexity, degree of subjectivity and variability in decision outcomes and stability of the IT environment. These factors must be weighed against the expected benefits, for example, the delivery of greater efficiencies and cost savings.
Robots may also not achieve the goals set. Furthermore, as they cannot naturally assess anomalies and irregularities as a human being would, they are capable of generating inappropriate results. Because of this, data quality is critical to a robot's effectiveness, and therefore data governance controls will be critical in design, even for simple robots. This will include controls over the maintenance of source data, as well as ensuring data integrity and providing security and confidentiality, which is essential for public credibility. The external and internal audit must verify that the process mapping, which includes the life cycle and data quality, is complete.
O Robot development must adhere to standard organizational principles for IT development, including proper testing before implementation. This should include a proof of concept and a transition phase of parallel runs of the automated and non-automated process to compare results. Monitoring and error handling routines should be built into processing to ensure that problems and operational anomalies are detected early and automatically responded to whenever possible.
Another point of attention is the behavior of the robot in production, often executing a high error rate. Depending on the risk, robots will require varying levels of human oversight by the process owner, based on dedicated metrics. The external and internal audit should review that the list of available key risk indicators is complete with respect to the underlying process and provide assurance on the accuracy of management metrics, identifying new insights on the operation of the process. It should also test the effectiveness of the robot's alerts and switches to instantly stop it in the event of a problem, review quarantined exceptions to ensure timely action by a human monitor, and review problem and complaint logs to assess whether issues can be addressed. be attributed to the robot's performance.
The external and internal audit should assess whether there is a clear responsibility for who should determine when changes to the robot are needed and who should reassess risk. They will need to review whether there is a structured change management process in place and whether it includes restrictions on who can execute changes.
Finally, the widespread use of robots can create a dependency that makes the business vulnerable if they become disabled, particularly if the business loses key process knowledge. One risk is that if the robot fails, there may not be enough staff to manually operate processes in its absence. In this case, the external and internal audit should look for documentation that articulates a clear business continuity plan to capture backup procedures and data sources needed to complete the work. In addition to reviewing whether the business continuity plan defines how activities will resume, whether there are regular tests of the system's capability and whether there is a process in place to ensure that impacted areas are notified of the robot's disability. Robots will evolve over time and periodic risk assessments will also be required to determine whether the robot should be retired.
To learn more about the topic andGet in touch with TATICCA – ALLINIAL GLOBAL, which provides integrated auditing, accounting, tax, corporate finance, financial advisory, risk advisory, technology, business consulting and training. For more information, access www.taticca.com.br or e-mail taticca@taticca.com.br. Our company has professionals with extensive experience in the market and has certified methodologies for carrying out activities.