ISACA Charlotte Chapter Robotic Process Automation (RPA) www.pwc.com March 13, 2018
ISACA Charlotte Chapter
Robotic Process Automation (RPA)
www.pwc.com
March 13, 2018
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Speaking with you today
2
Sachin Mandal
PwC Partner
Enterprise System Solutions Practice
(973)580-9950
Bob Herman
PwC Director
Enterprise System Solutions Practice
(704)576-1011
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Agenda
3
What is RPA (facts and myths)?
Who are the main software vendors
How do you establish an RPA program?
RPA considerations for Internal Audit and Compliance Organizations
• How Internal Audit and Compliance can benefit from RPA to improve their own efficiency and effectiveness
• How to assess business initiatives around RPA
Becoming dangerous - Where to find additional information
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Evolution of RPA
Workforce efficiency and effectiveness have long been a top enterprise priority. As technology continues to rapidly evolve in the space, decades of proven labor arbitrage and shared services are no longer the most constructive approach.
4
Pre
se
nce
Human workforce Use of robotics
Evolution of robotics
2015-2017
Robotics Process
Automation (RPA)
Applies technology to create “bots” to
replace humans who plug the gaps
between non STP systems – “low
value activity”
• Logic driven, software executes pre-
programmed tasks as defined by the
robot designer
• For certain activities - estimated 3
times savings over traditional off-
shoring/BPO
Location Strategy, Outsourcing
& Lean
Migration of manual tasks to off-shore
locations – effective strategy for
decades, expanding to more
sophisticated tasks
• Efficiency vs. Effectiveness
• Labor arbitrage savings 20-30%
• Lean principles drive additional 5-
15% efficiency
2005-2015
Intelligent Process
Automation (IPA)
Incorporates cognitive intelligence to
execute tasks and update rules based
on “learned” trends, requiring minimal
human oversight
• Estimated to replace 110-140M
knowledge workers by 2025
• Financial Services, Health and High
Tech are emerging industry leaders
Fast emerging
Mainstream adoption
Source: PwC Research, Institute for Robotic Process Automation “Smart Process Automation: The What, How and Who of Quantum Leap in Enterprise Productivity”, 2016, McKinsey Global Institute “Disruptive technologies that will transform life, business and the global economy”, 2014
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
What is Robotic Process Automation?
5
Robots are…
Computer coded software
• Non-invasive, zero change integration on target system and security
• Operate on top of other existing software
Mimic interactions of users
• Record and automate user interactions with one or more software applications
• Interact with the user interface (UI) of existing applications in the same way that an everyday
user would
Work cross-functional and cross-applications
• Are entirely technology agnostic and can be used with any application (e.g. ERP, DB, MS Suite,
ASCII file, structured PDF, thin clients such as Citrix)
• Use a central repository for easy management of automation scripts and processes
Enable the automation of repetitive, rule-based processes
• Build workflows with dynamic decision/branch points and loops for scaling (up/down)
• Ability to granulize processes into smaller components to allow reusability
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
More specifically, “robots” can do the following?
RPA has been being applied to processes across multiple functional areas.
6
Transactional
HR services
Finance &Accounting
Risk, Compliance& Internal Audit
Desktop consolidation
Payroll
Batch processing
Record – to - Report
Fraud detection
Data entry
Servermonitoring
Inventory & stock Mgmt.
Document formatting
Recruitment
Trend tracking
Form Data
Capture
Education & learning
Application monitoring
Fixed Assets
Customer Relationship Management
Compliance reporting
Folder synchronizing
Order –t0 - cash
Reporting (KPI, Regulatory Filings)
Problem resolution
On boarding
Installation
Collections
Compliance Testing
Documents & record
management
Time & Attendance
Management
FTP downloadupload and backup
Claims/Invoice Mgmt.
Monitoring & Surveillance
Customer Service support
Personal administration
File management
Procure –to Pay
Controls Testing
Workflow management
Benefits administration
Email related tasks
Sales orders
Quality Control
IT
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #1
True or False
Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate?
7
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #1 (continued)
True or False
Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate?
FALSE – Although RPA can be used to make certain activities within a process more efficient, more accurate and more cost effective, humans still need to review exceptions, monitor the “bots” and manage the overall process.
8
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #2
True or False
Robotics Process Automation (RPA) is mostly a cost cutting play?
9
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #2 (continued)
True or False
Robotics Process Automation (RPA) is mostly a cost cutting play?
FALSE – Although RPA can help reduce costs, there are other significant benefits that can be gained through the implementation of RPA technology.
10
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA) 11
RPA is more than just cost cutting
Quality & complianceWith improved accuracy, process output quality
improves drastically
Exception Reduction 50-70%
Simple process accuracy – 100%
Revenue enhancementRPA can enhance customer engagement through shorter cycle time to service customers and more
accurate and timely reaction to demand.
Value focused talentThe priorities of the employee workforce will shiftto innovation, strategy, and other businessdevelopment activities
Capacity Creation - 60-80%
ScalabilityA virtual workforce can respond to growth events (e.g. organic, acquisitive) with speed, agility, and resiliency. Cost of a robot is 1/3 (one-third) of that of anoff-shore employee.
Employee & customer satisfactionShorter cycle times and increased quality lead automatically to improved customer experience
24/7One robot can do the work of two to five FTEs, 24/7
Speed to valueRobots are expected to have 3 times human productivity.
Sooner– 2-4 weeksFrequently – 2 week deployment cycles
Cost reduction Cost reduction applies across the human capital supply chain.
Labor cost reduction – 25-50%3rd party price down – 45%
Cost reduction
Quality& compliance
Revenue enhancement
24/7
Speed to value
Employee & customer
satisfaction
Scalability
Value focused talent
RPA Value
Drivers
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA software providersForrester wave ranking, 2017
12
Challengers Contenders
Strong
Performers Leaders
Strong
Week
StrongWeek
Market presence
Softomotive
Contextor
EdgeVerve
Systems
NICE
Kryon
Systems
Automation
Anywhere
Blue
Prism
UIPath
WorkFusion
Pegasystems
Redwood Software
Kofax.
. .
..
.
.
...
.
.
. . . . .
Current
Offering
Strategy
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
How do you select the right activities to automate?
13
High volume/Low
complexity (RPA)
Low Volume/High Complexity
tasks would be more suited
to IPA
Swivel chair processes
Supported by multiple software
applications that are
not integrated
Large teams
More than 10-FTE performing
the same role or activity
Quality is key
High level of quality is
mandatory, and/or regulated
High levels of
standardization
Lean or process re-design
can help stabilize processes
prior to implementation
Highly rules-based
processes
RPA can help solve processes
with ambiguous rules
Stable environment
Technology systems,
organization and/or process
does not expect to change in
the mid-long term
Limited exception handling
Complex exception handling
should be handled by a human
Lesson learned: The opportunities for automation are usually
found at the activity level (e.g. an opportunity was identified for
data extraction and manipulation as part of the automated
process for monthly standard reporting )
Business case
Assessment framework
Process & activity scoring
Process prioritization
Process characteristics Tools examples
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Robotics deployment approach
14
Immediate mobilization focus
Enterprise Mobilization & Deployment
Automation strategy
Pilot Program
(2 – 3 months)
“First 5” -- Prove
the Value
Business as
Usual “Next 500”
– RPA becomes
part of the culture
Automation Program (6 - 9 months)
“Next 50” – Develop an intake strategy,
create demand and a roadmap, build
and deploy Robots
• Case for change
• Opportunity assessment and benefits quantification
• Automation driven functional/technical architecture strategy
• Link to overall corporate strategy (e.g., customer satisfaction)
Build Execution
• Governance and operating model design
• Risk and control assessment and implementation
• Future state BAU operating model
• Detailed architecture design
Program Standup
• Future user operating model
• Technology support model at scale
Long Term Operating Model
Strategy
Understanding the value
and solution exploration
• Proof of concept buildout
• Preliminary vendor
exploration and assessment
• Innovation strategy
• Knowledge share around
automation strategy best
practices
• Initial Robotics strategy
planning
Phase 1: Set the strategy Phase 2: Mobilize the program Phase 3: Execute the planPhase 0: Investigate
• Delivery management and oversight
• Business analysis (process design and user testing)
• Robot script development and tool configuration
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Internal audit and compliance RPA considerations
15
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
How will internal audit and compliance interact with the center of excellence (CoE)?
16
Key Considerations:
• Skill hire/ train/co-source IA/Compliance – Define future internal auditor
• Automation of internal audit and compliance processes such as risk assessment / reporting
• Organizational structure –identify; design; develop; test; support – RACI matrix –Central vs. federated
• Evidence management / standardization
• Designing controls of the future Automate first line vs. Automate testing
PwC
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA use case – compliance/IA testing of control operating effectiveness
https://www.youtube.com/watch?v=oreDg8BqZbo
19
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA use case – Compliance/IA testing of control operating effectiveness
18
An AP Manager performs a manual control to review vendor master additions and changes in SAP on a weekly basis. Periodically, Internal Audit
pulls a sample of changes to ensure control was operating effectively. Due to the nature of the control, it is a candidate for Robotics Automation
for IA testing of manual control.
SAP
Changes to
Vendors
Report
Changes to
Vendors
Report TeamMate Sharepoint Sharepoint Excel Excel Emaill
Associate repeats these steps for each
sample selected
Manual steps - 10
Average Time - 8-10 hours for a sample of 20
Current state
Associate
enters a
data range
and runs
standard
report to
extract data
Associate
references
testing
guide and
selects a
sample size
Associate
selects a
sample of
changes
from
standard
report
Associate
accesses
document
repository
Associate
searches
document
repository
for change
request
form
Associate
accesses
workpaper
Associate
documents,
if any, the
number of
exceptions
noted while
testing the
control
For samples
with
exceptions,
associate
follows up
with control
owners
Associate
reviews
testing &
artifacts to
conclude on
operating
effectiveness
of control
Associate
logs into
SAP
Bot enters a
data range
and runs
standard
report to
extract data
Bot
references
testing
guide and
selects a
sample size
Bot selects
a sample of
changes
from
standard
report
Bot
accesses
document
repository
Bot
searches
document
repository
for change
request
form
Bot
accesses
workpaper
Bot
documents,
if any, the
number of
exceptions
noted while
testing the
control
For samples
with
exceptions,
Bot follows
up with
control
owners
Associate
reviews
testing &
artifacts to
conclude on
operating
effectiveness
of control
Bot logs
into SAP
Manual Steps - 1
Average Time - 1 hour to review and conclude
Future state
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA use case – Compliance/IA reporting
19
The reporting process, be it reporting weekly for balanced scorecard or annually for audit committee meetings, has significant manual steps to ensure that data
is collected, complete, and correct, which are based on a series of rules. Due to the nature of the process, reporting data sourcing and data quality steps may be
candidate for Robotics Automation
Command
Center
Status of
audits
Remediation
status Sharepoint Workivia Email
Manual steps - 9 per report attribute
Average Time - 9-10.5 hours Estimate 90 minutes per report attribute with an average of 6-7 attributes per report
Current state
Associate
logs into
source
system
Associate
runs query/
report to
extract data
Associate
performs
analysis on
data for
completene
ss and
accuracy
Associate researched status
that have remained
unchanged month over
month by emailing owner
update required?
If yes, restart.
Associate
populates
report
templates
Associate
includes
response in
commentary
Associate
distributes
completed
report via
email for
commentary
Management
reviews and
provides
commentary
IA associate
gathers
data from
source
systems
Bot logs
into source
system
Bot runs
query/
report to
extract data
Bot
performs
analysis on
data for
completeness
and accuracy
Bot researched status
that have remained
unchanged month over
month by emailing owner
update required?
If yes, restart
Bot
populates
report
templates
Bot includes
response of
unchanged in
commentary
Bot
distributes
completed
report via
email for
commentary
Management
reviews and
provides
commentary
Bot gathers
data from
source
systems
Manual Steps - 1
Average Time - 30 minutes
Future state
Teammate
Controls
tested
Open
issues
e.g., Month over month compare
Powerpoint
document
GRC Tool
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA use case – Compliance/IA documentation and test script preparation
20
Compliance or Internal Audit team creates a risks and controls matrix (RACM) that is used to create testing scripts and is used to populate a GRC tool to perform
testing at a later date. Due to the nature of the process, it is a candidate for Robotics Automation for both the development of testing workbooks and automated
upload and conversion into a GRC Tool.
Manual steps - 6
Average Time - 40 hours for test scripts
Current state
Associate
populates RACM
with risks and
controls data
Associate opens
IT dependent test
script template
Associate
populates IT
dependent test
script template
with data from the
RACM
Associate
manually saves IT
dependent test
script in Excel
format
Associate
manually uploads
test script
template to GRC
tool
Associate creates
Risks and
Controls Matrix
(RACM) using
standard template
Associate
populates
RACM with
risks and
controls
data
Bot selects
and opens
Risks and
Controls
Matrix
Bot selects
specific data
elements
required to
create IT
dependent
test script
Bot opens IT
dependent test
script template
Bot
populates
template
with data
and saves
individual
test scripts
Bot repeats
the process
for all controls
specified in
RACM and
creates test
templates
Bot uploads
IT
dependent
test scripts
into GRC
Tool
Associate
reviews test
scripts for
data
accuracy,
completeness
, and validity
Associate
creates Risks
and Controls
Matrix (RACM)
using standard
template
Manual Steps - 3
Average Time - 2 hours to review and conclude
Future state
Excel
Associate repeats these steps for each IT dependent control
Excel Excel Excel Excel Excel
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #3
True or False
In order to implement RPA within your internal audit or compliance department you need to have trained – highly technical staff?
21
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #3 (continued)
True or False
In order to implement RPA within your internal audit or compliance department you need to have trained – highly technical staff?
FALSE – It is a good idea to be knowledgeable of RPA, but like most transformational efforts don’t get too booged down on the technology.
22
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
RPA risk considerations – Project monitoring
23
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #4
True or False
The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each “bot”?
24
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Polling question #4 (continued)
True or False
The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each “bot”?
FALSE – Similar to any other transformational project, internal audit and compliance should be involved early to assess Management’s overall governance process as well as the development lifecycle of “bots” that are considered higher in risk. For example, what if your company was planning to implement a “bot” to perform control processes that are subject to external audit (ICFR)?
25
PwC | ISACA Charlotte Chapter CPE Event – Robotic Process Automation (RPA)
Where to find additional information
PwC: www.pwc.com/us/intelligentautomation
UiPath Training: https://www.uipath.com/rpa-academy
Automation Anywhere Training: https://www.automationanywhereuniversity.com/
BluePrism Resources: https://www.blueprism.com/resources
Virtual Operations Methodology: http://virtual-operations-volt.com/00_process-automation-
methodology/
26
© 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its
subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm
is a separate legal entity. Please see www.pwc.com/structure for further details.
Thank you for you time today!