Robotics Process Automation, or RPA, has been one of 2018’s biggest buzzwords in the financial and tech industries: PwC dubbed Robotics one of the “eight essential emerging technologies” for auditors to know in this year’s State of the Industry report. Yet, Internal Audit tends to hold back and is more reluctant than other industries in embracing progressive technology such as RPA. Is there room for innovative robotics to help internal auditors - and if so, where will its biggest areas of impact be? We recently discussed the topic with Joseph Morgenstern,  Senior Manager in IT and Internal Audit Advisory services at Ernst & Young. Read below for our takeaways.

Definition and Benefits of Robotics Process Automation

Robotics Process Automation entails a bot or software application that can be programmed to perform basic human tasks that are typically rote or manual in nature. The main benefit of embedding bots in any work environment is that a bot can take care of repetitive manual tasks, freeing up time for employees to perform more value-add activities.

Main benefits include:
  • Bots work 24/7, and can work when everyone else goes home
  • Bots don’t make mistakes - leading to improved overall process efficiency and quality versus humans
  • Bots can perform the same tasks humans do - at somewhere in the ballpark of 25 to 35 percent the cost of a human performing the same task

Biggest Opportunities for Robotics Process Automation to Assist Internal Audit

Internal Audit can play a role in helping organizations identify opportunities to embed audit automation control activities within business processes and functions. Below are the areas where RPA can make the biggest impact.

  • Data gathering and cleansing for analytics. An RPA Center of Expertise (CoE) can generate and standardize data to run custom analytics, doing the work of pulling the data to be used by internal and external auditors, including automation checks for completeness of fields, duplicates and validation, etc. This frees Internal Audit from time spent coordinating and gathering this data.
  • Risk assessment. Bots can help automate the initial data gathering and classification for the annual risk assessment process. They do this by soliciting feedback from participants up front and identifying core trends. This allows for the in-person meetings to be focused on trend analysis and deep dives into the risks of the organization.
  • Population gathering. During the sampling and initial evidence gathering for standard evidence for controls, bots can help process data populations and do so more efficiently and accurately than humans can. This is especially valuable when it comes to large populations requiring heavy resources to process, such as analyzing thousands of statement documents.  
  • Automation of controls. Bots can run controls testing - especially for control areas that are standardized, such as where tickets and fields are consistently used. This frees Internal Audit from performing those standard required checkmarks.
  • Internal Audit Project Management Office (PMO) areas. Several areas where RPA can assist include:
    • Identifying open items, sending follow-up emails and documenting status, etc
    • Tracking progress against the project plan or annual audit plan (can use RPA to monitor KPIs in process)
    • Automating reporting - including report templates, audit committee decks, etc

RPA’s Impact in Driving Value in Internal Audit

Robotics Process Automation can lead to efficiencies in monitoring controls, better visibility, and time and cost savings. 

  • Greater coverage. Having a bot manage and drive the full analytics allows Internal Audit professionals to get greater coverage across the organization (more data, transactions, etc.) while not increasing the time or FTE needed to analyze large data populations. This also removes audit luck from the equation and helps auditors get closer to absolute assurance. RPA allows teams to find the anomalies in data/transactions and focus on those outliers.
  • Time and cost savings that can be dedicated to more value add engagements. Internal audit teams who frequently interact and coordinate with the business and external auditors benefit highly from RPA. Audit automation allows Internal Audit to pivot from supporting external audit activities, such as evidence pulling and sample gathering, toward focusing on operational reviews with the business.
  • On-demand visibility into department performance. Using automation in reporting and project tracking allows for on-demand visibility into department performance – both against the plan and within specific KPIs.

One example was a client that identified multiple bottlenecks in their Internal Audit processes - audit notification, wrap-up, reporting and follow-up tracking. Once they implemented automated KPI tracking and reporting to the Audit Committee - the timeline shortened, and they were able to show the benefit on a standardized report without having to spend time manually tracking and reporting. 

Robotics Process Automation Adoption and Outlook

Possibly the greatest challenge to RPA adoption in Internal Audit is lack of awareness of the benefits it can provide. But for internal auditors who have adopted, innovative robotics has helped accounting and finance automate elements of financial reporting standards, such as SOC 1 and 2, ISO, and HIPAA.

One example was a client that used automation to support their SOC 1 and SOC 2 processes for their service auditor. The client successfully automated their risk assessment and control certification ahead of the annual inspection. Additionally, the client is using RPA to track outstanding evidence, follow-up requests and management responses.

The Internal Audit group at this client also sought to roll out automated testing for their SOX compliance programs across their global companies. The group is now estimating a 25% hours savings by implementing this consistency in testing approach, evidence gathering and reporting to management across the program.

In conclusion, there are plenty of opportunities to leverage intelligent automation for monitoring controls, regulatory compliance, policies and reporting activities. It is up to Internal Audit to decide if this is a process worth undertaking - then seek to identify risks associated with intelligent audit automation initiatives and work to build and roll out an RPA plan to ensure proper governance, controls and monitoring are in place.  Want to learn more about audit automation? Contact us below today.