www.pwc.com ISACA Charlotte Chapter Robotic Process Automation (RPA) March 13, 2018
Speaking with you today Sachin Mandal PwC Partner Enterprise System Solutions Practice sachin.k.mandal@pwc.com (973)580-9950 Bob Herman PwC Director Enterprise System Solutions Practice robert.j.herman@pwc.com (704)576-1011 2
Agenda What is RPA (facts and myths)? Who are the main software vendors How do you establish an RPA program? RPA considerations for Internal Audit and Compliance Organizations How Internal Audit and Compliance can benefit from RPA to improve their own efficiency and effectiveness How to assess business initiatives around RPA Becoming dangerous - Where to find additional information 3
Presence Evolution of RPA Workforce efficiency and effectiveness have long been a top enterprise priority. As technology continues to rapidly evolve in the space, decades of proven labor arbitrage and shared services are no longer the most constructive approach. Evolution of robotics Human workforce Use of robotics 2005-2015 Location Strategy, Outsourcing & Lean Migration of manual tasks to off-shore locations effective strategy for decades, expanding to more sophisticated tasks Efficiency vs. Effectiveness Labor arbitrage savings 20-30% Lean principles drive additional 5-15% efficiency 2015-2017 Mainstream adoption Robotics Process Automation (RPA) Applies technology to create bots to replace humans who plug the gaps between non STP systems low value activity Logic driven, software executes preprogrammed tasks as defined by the robot designer For certain activities - estimated 3 times savings over traditional offshoring/bpo Fast emerging Intelligent Process Automation (IPA) Incorporates cognitive intelligence to execute tasks and update rules based on learned trends, requiring minimal human oversight Estimated to replace 110-140M knowledge workers by 2025 Financial Services, Health and High Tech are emerging industry leaders Source: PwC Research, Institute for Robotic Process Automation Smart Process Automation: The What, How and Who of Quantum Leap in Enterprise Productivity, 2016, McKinsey Global Institute Disruptive technologies that will transform life, business and the global economy, 2014 4
What is Robotic Process Automation? Robots are Computer coded software Non-invasive, zero change integration on target system and security Operate on top of other existing software Mimic interactions of users Record and automate user interactions with one or more software applications Interact with the user interface (UI) of existing applications in the same way that an everyday user would Work cross-functional and cross-applications Are entirely technology agnostic and can be used with any application (e.g. ERP, DB, MS Suite, ASCII file, structured PDF, thin clients such as Citrix) Use a central repository for easy management of automation scripts and processes Enable the automation of repetitive, rule-based processes Build workflows with dynamic decision/branch points and loops for scaling (up/down) Ability to granulize processes into smaller components to allow reusability 5
More specifically, robots can do the following? RPA has been being applied to processes across multiple functional areas. Transactional Problem resolution Documents & record management Customer Service support Workflow management Customer Relationship Management Desktop consolidation Fraud detection Form Data Capture Document formatting HR services On boarding Time & Attendance Management Personal administration Benefits administration Compliance reporting Payroll Data entry Education & learning Recruitment IT Installation FTP download upload and backup File management Email related tasks Folder synchronizing Batch processing Server monitoring Application monitoring Finance & Accounting Collections Claims/Invoice Mgmt. Procure to Pay Sales orders Order t0 - cash Record to - Report Inventory & stock Mgmt. Fixed Assets Trend tracking Risk, Compliance & Internal Audit Compliance Testing Monitoring & Surveillance Controls Testing Quality Control Reporting (KPI, Regulatory Filings) 6
Polling question #1 True or False Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate? 7
Polling question #1 (continued) True or False Robotics Process Automation (RPA) can be used to replace 100% of all human interaction related to the process that it is used to automate? FALSE Although RPA can be used to make certain activities within a process more efficient, more accurate and more cost effective, humans still need to review exceptions, monitor the bots and manage the overall process. 8
Polling question #2 True or False Robotics Process Automation (RPA) is mostly a cost cutting play? 9
Polling question #2 (continued) True or False Robotics Process Automation (RPA) is mostly a cost cutting play? FALSE Although RPA can help reduce costs, there are other significant benefits that can be gained through the implementation of RPA technology. 10
RPA is more than just cost cutting Cost reduction Cost reduction applies across the human capital supply chain. Labor cost reduction 25-50% 3 rd party price down 45% Cost reduction Quality & compliance Quality & compliance With improved accuracy, process output quality improves drastically Exception Reduction 50-70% Simple process accuracy 100% Value focused talent The priorities of the employee workforce will shift to innovation, strategy, and other business development activities Capacity Creation - 60-80% Scalability A virtual workforce can respond to growth events (e.g. organic, acquisitive) with speed, agility, and resiliency. Cost of a robot is 1/3 (one-third) of that of an off-shore employee. Value focused talent Scalability RPA Value Drivers Revenue enhancement 24/7 Revenue enhancement RPA can enhance customer engagement through shorter cycle time to service customers and more accurate and timely reaction to demand. 24/7 One robot can do the work of two to five FTEs, 24/7 Employee & customer satisfaction Shorter cycle times and increased quality lead automatically to improved customer experience Employee & customer satisfaction Speed to value Speed to value Robots are expected to have 3 times human productivity. Sooner 2-4 weeks Frequently 2 week deployment cycles 11
RPA software providers Forrester wave ranking, 2017 Challengers Contenders Strong Performers Leaders Strong Current Offering EdgeVerve Systems Contextor Softomotive NICE....... Kryon Systems Kofax.. UIPath WorkFusion Pegasystems Redwood Software Automation Anywhere... Blue Prism Week Market presence..... Week Strategy Strong 12
How do you select the right activities to automate? Process characteristics High volume/low complexity (RPA) Low Volume/High Complexity tasks would be more suited to IPA Large teams More than 10-FTE performing the same role or activity High levels of standardization Lean or process re-design can help stabilize processes prior to implementation Stable environment Technology systems, organization and/or process does not expect to change in the mid-long term Swivel chair processes Supported by multiple software applications that are not integrated Quality is key High level of quality is mandatory, and/or regulated Highly rules-based processes RPA can help solve processes with ambiguous rules Limited exception handling Complex exception handling should be handled by a human Lesson learned: The opportunities for automation are usually found at the activity level (e.g. an opportunity was identified for data extraction and manipulation as part of the automated process for monthly standard reporting ) Tools examples Assessment framework Process & activity scoring Process prioritization Business case 13
Robotics deployment approach Phase 0: Investigate Phase 1: Set the strategy Phase 2: Mobilize the program Phase 3: Execute the plan Understanding the value and solution exploration Proof of concept buildout Preliminary vendor exploration and assessment Innovation strategy Knowledge share around automation strategy best practices Initial Robotics strategy planning Automation strategy Case for change Opportunity assessment and benefits quantification Automation driven functional/technical architecture strategy Link to overall corporate strategy (e.g., customer satisfaction) Enterprise Mobilization & Deployment Program Standup Governance and operating model design Risk and control assessment and implementation Future state BAU operating model Detailed architecture design Build Execution Long Term Operating Model Strategy Future user operating model Technology support model at scale Pilot Program (2 3 months) First 5 -- Prove the Value Delivery management and oversight Automation Program (6-9 months) Next 50 Develop an intake strategy, create demand and a roadmap, build and deploy Robots Business analysis (process design and user testing) Robot script development and tool configuration Business as Usual Next 500 RPA becomes part of the culture Immediate mobilization focus 14
Internal audit and compliance RPA considerations 15
How will internal audit and compliance interact with the center of excellence (CoE)? Key Considerations: Skill hire/ train/co-source IA/Compliance Define future internal auditor Automation of internal audit and compliance processes such as risk assessment / reporting Organizational structure identify; design; develop; test; support RACI matrix Central vs. federated Evidence management / standardization Designing controls of the future Automate first line vs. Automate testing 16
RPA use case compliance/ia testing of control operating effectiveness https://www.youtube.com/watch?v=oredg8bqzbo 19
RPA use case Compliance/IA testing of control operating effectiveness An AP Manager performs a manual control to review vendor master additions and changes in SAP on a weekly basis. Periodically, Internal Audit pulls a sample of changes to ensure control was operating effectively. Due to the nature of the control, it is a candidate for Robotics Automation for IA testing of manual control. logs into SAP enters a data range and runs standard report to extract data references testing guide and selects a sample size selects a sample of changes from standard report accesses document repository searches document repository for change request form accesses workpaper documents, if any, the number of exceptions noted while testing the control For samples with exceptions, associate follows up with control owners reviews testing & artifacts to conclude on operating effectiveness of control SAP Changes to Vendors Report repeats these steps for each sample selected Changes to TeamMate Vendors Report Sharepoint Sharepoint Excel Excel Emaill Bot logs into SAP Bot enters a data range and runs standard report to extract data Bot references testing guide and selects a sample size Bot selects a sample of changes from standard report Bot accesses document repository Bot searches document repository for change request form Bot accesses workpaper Bot documents, if any, the number of exceptions noted while testing the control For samples with exceptions, Bot follows up with control owners reviews testing & artifacts to conclude on operating effectiveness of control Current state Manual steps - 10 Average Time - 8-10 hours for a sample of 20 Future state Manual Steps - 1 Average Time - 1 hour to review and conclude 18
RPA use case Compliance/IA reporting The reporting process, be it reporting weekly for balanced scorecard or annually for audit committee meetings, has significant manual steps to ensure that data is collected, complete, and correct, which are based on a series of rules. Due to the nature of the process, reporting data sourcing and data quality steps may be candidate for Robotics Automation IA associate gathers data from source systems logs into source system runs query/ report to extract data performs analysis on data for completene ss and accuracy researched status that have remained unchanged month over month by emailing owner update required? If yes, restart. populates report templates includes response in commentary distributes completed report via email for commentary Management reviews and provides commentary Command Center Sharepoint GRC Tool Teammate Workivia Status of audits Controls tested Open issues Remediation status e.g., Month over month compare Powerpoint document Email Bot gathers data from source systems Bot logs into source system Bot runs query/ report to extract data Bot performs analysis on data for completeness and accuracy Bot researched status that have remained unchanged month over month by emailing owner update required? If yes, restart Bot populates report templates Bot includes response of unchanged in commentary Bot distributes completed report via email for commentary Management reviews and provides commentary Current state Manual steps - 9 per report attribute Average Time - 9-10.5 hours Estimate 90 minutes per report attribute with an average of 6-7 attributes per report Future state Manual Steps - 1 Average Time - 30 minutes 19
RPA use case Compliance/IA documentation and test script preparation Compliance or Internal Audit team creates a risks and controls matrix (RACM) that is used to create testing scripts and is used to populate a GRC tool to perform testing at a later date. Due to the nature of the process, it is a candidate for Robotics Automation for both the development of testing workbooks and automated upload and conversion into a GRC Tool. creates Risks and Controls Matrix (RACM) using standard template populates RACM with risks and controls data opens IT dependent test script template populates IT dependent test script template with data from the RACM manually saves IT dependent test script in Excel format manually uploads test script template to GRC tool repeats these steps for each IT dependent control Excel Excel Excel Excel Excel Excel creates Risks and Controls Matrix (RACM) using standard template populates RACM with risks and controls data Bot selects and opens Risks and Controls Matrix Bot selects specific data elements required to create IT dependent test script Bot opens IT dependent test script template Bot populates template with data and saves individual test scripts Bot repeats the process for all controls specified in RACM and creates test templates Bot uploads IT dependent test scripts into GRC Tool reviews test scripts for data accuracy, completeness, and validity Current state Manual steps - 6 Average Time - 40 hours for test scripts Future state Manual Steps - 3 Average Time - 2 hours to review and conclude 20
Polling question #3 True or False In order to implement RPA within your internal audit or compliance department you need to have trained highly technical staff? 21
Polling question #3 (continued) True or False In order to implement RPA within your internal audit or compliance department you need to have trained highly technical staff? FALSE It is a good idea to be knowledgeable of RPA, but like most transformational efforts don t get too booged down on the technology. 22
RPA risk considerations Project monitoring 23
Polling question #4 True or False The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each bot? 24
Polling question #4 (continued) True or False The best time for internal audit & compliance organizations to get involved with a business or IT lead RPA project is right before or after the deployment of each bot? FALSE Similar to any other transformational project, internal audit and compliance should be involved early to assess Management s overall governance process as well as the development lifecycle of bots that are considered higher in risk. For example, what if your company was planning to implement a bot to perform control processes that are subject to external audit (ICFR)? 25
Where to find additional information PwC: www.pwc.com/us/intelligentautomation UiPath Training: https://www.uipath.com/rpa-academy Automation Anywhere Training: https://www.automationanywhereuniversity.com/ BluePrism Resources: https://www.blueprism.com/resources Virtual Operations Methodology: http://virtual-operations-volt.com/00_process-automationmethodology/ 26
Thank you for you time today! 2018 PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.