Audit departments are in the early stages of understanding how robotics can help automate internal processes. In fact, only 10% of audit teams are planning to use robotic process automation (RPA) this year, with 2% currently conducting pilots, according to CEB data. And 80% have no plans to use RPA at all.
In other words, internal audit managers are about where their counterparts in shared services were just a couple of years ago. They are interested in the concept, but tend to lack the expertise and proof of concept required to put any real effort or investment behind implementation just yet.
Shared services teams have moved swiftly. In April 2015, 70% of shared services centers had not done any work on robotics but, by the start of 2017, that number had fallen to just 17%. As of this year, 34% of shared services functions have implemented or are in the process of implementing robotics.
As an aside, this means that it’s important for internal audit teams to understand how RPA works when auditing shared services centers that use it. But they can also draw lessons from that function’s experience that will help them adopt robotic software in their own department.
It is a natural extension of Audit’s increased investment in analytic capabilities to efficiently test controls, identify anomalies, and find hidden risks. The theory at least is then that this will give audit teams a chance to focus on more valuable activities like providing clear guidance to business partners, following up on audit recommendations, and identifying emerging risks.
Answers to three questions will help audit teams understand RPA.
What is robotics software?: Essentially, what separates robotics software from other forms of automation is that it isn’t designed for any one process or activity. It is flexible, and can be taught nearly any standard rules-based process or activity. It also mimics human interaction with IT systems, but can execute rules-based steps in a fraction of the time a person can.
RPA is what most audit departments think of when they think about robotics. This software can record and capture a series of steps across multiple systems.
However, it is important to note that RPA is at the low end on a spectrum of intelligent automation solutions. For example, advanced cognitive computing tools can use machine learning to interpret unstructured data, identifying patterns and solutions. The ultimate end of this continuum is true artificial intelligence — which has yet to be developed, but refers to machines that exhibit behaviors indistinguishable from that of a human.
How is robotics software used now?: In theory, robotics can be used for any process or activity that is well-defined by rules and that traditionally has involved human interaction with an IT system.
One notable use of RPA in shared services is customer payment processing. At one company, a “bot” (the robotics software) was able to mimic the manual process of one person copying and pasting data from one source to another. Implementation reduced processing time from 24 hours to 1 hour, and improved accuracy from 97% to 100%. Over 2,500 payments are now processed this way daily.
Other functions outside of shared services have taken advantage of robotics as well. For example, one firm gathered sales lead generation data from numerous sources across varying formats to create a regular report for those who needed it. This was a labor-intensive process that required employees to access 50 different information sources. Automating the retrieval of 29 out of the 50 information sources through RPA reduced the required time by 300 hours per month, which resulted in nearly $150,000 in savings.
To determine a good candidate for robotics, ask the following questions.
Can the human activity be mapped as a repetitive process (i.e., therefore could be programmed into a robot)?
If the activity requires human judgment, can the rules on how to judge be defined to cover all possibilities?
Does the activity pull data from and put it into the same place every time (i.e., the same field name, same location of the field on a particular screen of an IT system)?
What do audit teams already know about robotics?: Most audit executives who have tested RPA are starting with manual tasks that have to be conducted across multiple systems. One bank, for example, uses the software to make sure employees who take part in transferring funds are executing the proper steps with the proper authority.
Another firm is at the proof of concept stage to use cognitive automation to mimic what an auditor does to analyze data. The main challenge has been to find the right training data in the right volume to effectively tune the robot; practitioners say that this is one of the most common problems. It is critical to have historical data the machine can learn from.
General recommendations based on early RPA pilots in audit include:
Begin with time-consuming, repetitive, lower value processes.
Consider how new processes fit into larger audit workflows.
Determine the type of data that will be necessary to train the robot.