Robot maintenance design departments are subject to different standards of risk and control, and will not always know all the correct procedures. External and internal audits look for a solid governance structure to support each robot delivery model. Always revolving around clear standards of organizational oversight, business justification and development standards defined by a center of excellence.
There is a risk that some robotic process automation could actually decrease the control effectiveness of a process. In this case, the benefits of RPA may not outweigh the cost of investment and the proliferation of robots can lead to a more vulnerable and fragmented technology environment. There must be a structured way to assess which processes are suitable for automation. This should depend on predetermined factors such as inherent risk in the underlying process, degree of complexity of the process, degree of subjectivity and variability in decision outcomes, and stability of the IT environment. These factors must be weighed against the expected benefits, for example, the delivery of greater efficiency and reduced costs.
Robots may also not achieve the goals set. Furthermore, as they cannot naturally assess anomalies and irregularities as a human being would, they are capable of generating inappropriate results. Because of this, data quality is critical to a robot's effectiveness, and therefore data governance controls will be critical in design, even for simple robots. This will include controls over the maintenance of source data, as well as ensuring data integrity and providing security and confidentiality, which is essential for public credibility. External and internal audits must verify that the process mapping, which includes the lifecycle and data quality, is complete.
O Robot development should adhere to standard organizational principles for IT development, including appropriate testing prior to implementation. This should include a proof of concept and a transition phase of parallel runs of the automated and non-automated process to compare results. Monitoring and error handling routines should be built into the processing to ensure that problems and operational anomalies are detected early and responded to automatically whenever possible.
Another point of attention is the behavior of the robot in production, often executing with a high rate of errors. Depending on the risk, robots will require varying levels of human oversight by the process owner, based on dedicated metrics. External and internal audits should review whether the list of key risk indicators available is complete with respect to the underlying process and provide assurance on the accuracy of management metrics, identifying new insights about the operation of the process. It should also test the effectiveness of the robot's alerts and switches to stop it instantly in the event of a problem, review quarantined exceptions to ensure timely action by a human monitor, and review problem and complaint logs to assess whether issues can be attributed to the robot's performance.
External and internal audits should assess whether there is clear accountability for who should determine when robot changes are needed and who should reassess the risk. They will need to review that there is a structured change management process in place and that it includes restrictions on who can execute changes.
Finally, the widespread use of bots can create a dependency that makes businesses vulnerable if they become disabled, particularly if the business loses key process knowledge. One risk is that if the robot fails, there may not be enough staff to operate processes manually in your absence. In this case, external and internal audit should look for documentation that articulates a clear business continuity plan to capture backup procedures and data sources needed to complete the work. In addition to reviewing whether the business continuity plan defines how activities will resume, whether there are regular tests of system capacity and whether there is a process to ensure that impacted areas are notified of the robot's inability. Robots will evolve over time and periodic risk assessments will also be required to determine if the robot should be retired.
To learn more about the topic andGet in touch with TATICCA – ALLINIAL GLOBAL, which provides integrated auditing, accounting, tax, corporate finance, financial advisory, risk advisory, technology, business consulting and training. For more information, access www.taticca.com.br or e-mail taticca@taticca.com.br. Our company has professionals with extensive experience in the market and has certified methodologies for carrying out activities.