1. Robotic Process Automation Discussion
March 2018

2. TODAY’S OBJECTIVES LEARN EXPLORE EXECUTE
Review RPA, its capabilities, and best practices based on past experience
Discuss how RPA opportunities are identified, and review some example use cases for both Epic maintenance, and Revenue Cycle operations
Understand RPA project implementation approach and considerations while automating processes on the Epic platform
What other questions or areas do you want to make sure we cover today?

3. R&CA Use Case Spotlight
Finance Shared Services Automation and Managed Services
Nurse candidate pre-verification

4. LEARN

5. THE AUTOMATION CONTINUUM
Today’s Focus
Artificial General Intelligence
“Mimics Human Intelligence”
Systems that completely replicate human interactions
Robotics (RPA)
Used for rules-based processes, such as invoice processing exceptions
“Mimics Human Actions”
Used for processes requiring judgment, such as commercial contract understanding, insights, and implications
“Mimics/Augments Quantitative Human Judgment”
Intelligent Automation
Cognitive Automation
Used for predictive decision making, such as with Amazon Echo and Alexa
“Augments Human Intelligence”
Automation is an evolving technology whose application can be extremely powerful. When coupled with the right process and the right level of human intervention, it has the power to transform organizations

6. ROBOTIC PROCESS AUTOMATION AND THE MARKET EVOLUTION
LEGEND
Industrial Revolution
Early Stage Technology
Mature Technology
Future Event
RPA has evolved quickly and is expected to be deployed in most large businesses by 2018
The global RPA market is expected to experience a 40-60% CAGR every year until 2020
RPA and Cognitive Automation will be ubiquitous in businesses by 2020
RPA Market Evolution
1700s
1st Industrial Revolution
2nd Industrial Revolution
3rd Industrial Revolution
BPM Systems
Early Stage RPA
Early Stage Cognitive
Capable RPA Solutions Deployed
Widespread Cognitive Augmentation and Automation
Dependence on Global Horizontal Category Machine Learning Platforms
Within 10 Years
Current Global IT RPA Market
$800M
Projected 2024 Global IT RPA Market
~$17B
Today
Robotic Process Automation (RPA) is software that captures and interprets existing applications to automate rules-based processing, data manipulation, and communication across multiple systems, including web-based and local applications

7. DISPELLING MYTHS ABOUT RPA
RPA IS…
Programs that significantly reduce manual effort, when performing repetitive rules-based tasks
Cross-functional and cross-application macros
Computer-coded software
RPA IS NOT…
Physically existing machines processing paper
Artificial intelligence or voice recognition and reply software
Walking, talking auto-bots
Open and attachments
Log into web/enterprise applications
Move files and folders
Copy and paste
Fill in forms
Read and write to databases
Scrape data from the web
Make calculations
Extract structured data from documents
Follow “if/then” decisions/rules
Connect to system APIs
Collect social media statistics
WHAT RPA CAN DO

8. UNDERSTANDING RPA BEST PRACTICE We have identified four key factors of “what works best” from prior RPA deliveries
Define an up-front strategy including an enterprise operating model, delivery methodology, business case development, change management strategy, and roadmap
STRATEGY
Drive toward establishing a centralized Center of Excellence (CoE), embedding RPA into existing Digitization and Automation programs and process improvement initiatives
APPROACH
View RPA as one component of the Virtual Workforce that can transform the way humans and software interact and improve efficiencies for both employees and patients
FOCUS
Select one vendor and define an enterprise architecture solution and set of standards that can be replicated and scaled across functional groups
VENDOR

9. EXPLORE

10. KEY PROCESS CHARACTERISTICS THAT MAKE STRONG CANDIDATES FOR RPA
“Around the Clock”
Mid to High Transaction Volume
Prone to Human Error
Rules Based, Repetitive Interfaces
Structured Data & Format
High Costs
Routine interaction with multiple IT systems while following explicit rule sets
High density of information (e.g., lines of data) that requires significant time and effort to manage
Highly manual, time-consuming actions often resulting in high error rates
Large number of FTEs required to support the process or use of contractors
Average (scanned PDF, PPT) →
Better (Word, typed PDF) →
Best (Excel, CSV, Text, Website)
Need for operations or support outside of normal working hours

11. RPA USE CASES FOR EPIC OPERATIONS Based on previous experience, we have plotted Epic automation candidates on value and complexity1 scales to identify “Quick Wins”
Level of Value
High
Low
STRATEGIC (High Value, High Complexity)
QUICK WIN (High Value, Low Complexity)
AVOID (Low Value, High Complexity)
DEBATABLE (Low Value, Low Complexity)
Level of Complexity
High
Low

12. RPA USE CASES FOR REVENUE CYCLE Based on previous experience, we have plotted revenue cycle automation candidates on value and complexity1 scales to identify “Quick Wins”
Level of Value
High
Low
STRATEGIC (High Value, High Complexity)
QUICK WIN (High Value, Low Complexity)
AVOID (Low Value, High Complexity)
DEBATABLE (Low Value, Low Complexity)
FRONT – Patient Access
LEGEND
MIDDLE – Charge Integrity & HIM
BACK – Patient Financial Services
Level of Complexity
High
Low

13. RPA IMPLEMENTATION: EPIC CASE STUDY
PROVIDER CREDENTIALING HOLD-RELEASE PROCESS
The provider credentialing hold-release process is an activity performed by the Epic billing team on a weekly basis
Automation was completed in two phases – it started by streamlining the process steps using a macro and later was further automated using RPA software
Compile provider information
Send status to Claims Team
Start provider enrollment process
New provider created in Epic
Create service request with Support Team
Download configuration file
Format file and create text file
Spot review the file
Move text file to Epic SFTP
Log into Epic application and import file to application server
Open ticket and download the attachment
Service request in SNOW queue
Log into SNOW
Create change request & assign for approvals
Log into SharePoint and update build tracker
Review and approve change request
Validate with user
Close request
Archive files to local folder
Manual
LEGEND
RPA
SUMMARY STATISTICS
Key Metrics
Manual Process
Macro Automation
Robotic Automation
Manual Effort
300 hrs / month
60 hrs / month
1 hr / month
Throughput
30 to 40 min / record
10-12 days TAT
500 records / 10 hrs
2-3 days TAT
500 records / 15 min
Same day TAT
Limitations / Considerations
Repetitiveness
Scalability
Process consistency
Formatting issues
Manual upload
Involves ongoing maintenance of automations based on infrastructure or application changes

14. EXECUTE

15. END-TO-END IMPLEMENTATION APPROACH
Evaluate feasibility of automation in processes across the organization and educate stakeholders on RPA. Develop business cases and select processes for automation
ANALYZE
DESIGN
Document current and future state RPA-enabled processes and review critical technology requirements
DEVELOP
Develop and comprehensively test bots based on as-is or future state process
DEPLOY
Detail requirements for integrating bots into the live production environment and prepare the users and technical capabilities for deployment
STABILIZE
Monitor bots during hypercare to ensure they are executing the tasks as designed
OPTIMIZE
Refine bots as needed to ensure optimal performance throughout each process

16. Auditing “Automation”

17. Risk-Controlled Robotics Environment
Considerations for ‘Bot’ Management and Control
Assessing the impact of RPA on the existing controls environment, including new risks, is imperative to the organization. The below items should be considered by Corporate Audit when evaluating the roll-out of RPA across the enterprise
1. Is there an established RPA policy and standard?
Organization should establish a policy to define parameters around where robotics can and cannot be applied within the organization e.g., avoid client-facing processes – and evolve over time
7. Govern and improve
Ownership and responsibility around running and maintaining bots should be defined; cross-functional working groups should be established to meet regularly to evaluate ‘bot’ effectiveness and to review and resolve issues
2. Leverage existing controls
Business should review the adequacy of existing controls, and, to the extent possible, leverage existing controls in the robotics environment
Risk-Controlled Robotics Environment
6. Monitor and escalate
The three lines of defense should be equipped with tools and transparency to oversee and control operational risks through bots’ production of audit-trail records
3. Detect and report
‘Bots’ should be configured to detect and report errors, and raise exceptions to ‘bot’ managers to be addressed in near-real-time
5. Manage a changing environment
Existing change management models should be extended to account for the existence of bots, and to track the impacts of internal or external changes which could affect the ‘bot’ environment
4. Educate and empower
The Organization should train and appoint ‘bot managers’ to oversee the work being conducted by ‘bots’, to be responsible for the output the bots produce, and serve as the first line of defense

18. Corporate Audit should ascertain that business units consider the risk exposure due to smart automation technologies like robots (bots*)
How can we ensure that the bots are working in adherence to defined policies?
What steps can we take to prevent bots from proliferating errors across the enterprise?
Is there an incident management framework in place when bots do not perform as expected?
How do we manage the security of access privileges assigned to bots?
How do we manage the impacts of business and technology changes to bots?
What are the responsibilities of managers that control the bots?
How do we educate stakeholders across the organization on the benefits and the implications of bots?
* The term ‘bot’ in this presentation refers to a smart automation technology that can be driven by either rule-based, cognitive, or artificial intelligence driven algorithms.

19. Role of Corporate Audit in anticipation of automation
Balance between pushing the frontiers and risk appetite
Proactively understand the RPA being applied at business units
Have a seat at the table when strategic decisions are made on RPA
Evaluate the impact of the RPA on the organization, process, resources, geography, regulatory landscape, cyber and third party oversight, etc.
Disseminate changes in the Risk Assessment Process
Consider changes to the enterprise organization structure to adapt to dynamic business needs
Risk assess new technologies
Key Risk Domains: cyber, regulatory, privacy, financial, reputational, failure to adopt
Prioritize risks based on the impact and vulnerability criteria
Assess impact on the control set to rationalize population of controls
Execute Dynamic Audit Procedures
Determine business objectives to advise on the design of control activities and/or perform pre-implementation reviews
Determine required skillsets and deploy training techniques
Evaluate tools and techniques
Robotics
Data analytics
Continuous monitoring
Consider Updates to Reporting
Identify level and structure of reporting that will be conducted:
Technology level vs business function level
Assurance driven vs consultative
Frequency and speed of audits

20. Corporate Audit Leveraging “Automation”

21. Robotics & Automation for Corporate Audit
Developing a strategic plan
Purpose......
What are the main drivers behind implementing robotics? What is the vision?
Sustainability, quality, regulatory expectations, alignment to enterprise and corporate audit goals
Has a target state been defined?
Overall vision, strategic priorities, tactical goals
3) What is the approximate timing of when you are looking to start and complete the transition?
Target Operating Model (TOM)......
Are there goals and expectations on the characteristics / principles for a sustainable target state?
Cost reduction, people and process efficiencies, use of innovative technology
What are the biggest gaps and challenges that you need to solve for?
People – capacity, skillsets, finding the right balance between onshore / offshore FTE and contractors
Processes – enhanced monitoring, existing bottlenecks, roles and responsibilities
Technology – how to integrate / streamline systems and reporting, data integration and analytics, automation
Governance & Next Steps
Define your strategy (“who you want to be”) and build your framework (“what you will do”)
Strategy includes your vision, values, mission, strategic priorities and goals
Framework includes tactical elements such as the initial design of your TOM, initiatives and workstreams
Consider the balance between achieving sustainability and satisfying current and forward looking regulatory expectations
Build your business case – socialize across BAC and with regulators as needed
Get early buy in and take them on your journey
Build your action plan (“how you will do it”)
Consider a two phased approach to 1) develop project plans, and 2) pilot solutions

22. IA Strategy Framework for data analytics & robotics
Using the four tenets to analyze current and future-state requirements
Vision & strategy
People
Process
Technology
Future-state definition
Key objectives and value drivers for IA and key stakeholders
Role of analytics and robotics within the function and across the business
Program governance
Data management strategy
Executive sponsorship
Governance council
Organization structure & Reporting:
Analytics / Robotics lead
Analytics / Robotics manager
Supporting analyst
Talent model:
Hiring/Rotation Plans
Competency model
Development
Succession planning
Retention
Performance management
Training
Data acquisition, maintenance, and handling
Audit methodology integration
Data quality management
Change control
Policy and standards enforcement
Data lifecycle management
Develop plan
Acquire data
Analyze data
Review
Report
Meta data management
Data security and privacy
Data standards
Data retention and archiving
Regulatory compliance
Data ownership
Enterprise technology landscape
Enterprise licensing
Enterprise data strategy and business intelligence capabilities
Technical architecture and infrastructure
Availability of data analytic & robotic tools
Data visualization and reporting
Scalability
Workflow and automation

23. Designing a target operating model
Moving to a sustainable operating model requires an effective interplay of people, process, technology and analytics that includes the following activities
Establish clearly defined roles and responsibilities, and a governance model that enables clear visibility into results and thematic trends
Establish team coverage models with an appropriate balance of SMEs and generalists to prevent bottlenecks in the design and execution processes
Conduct a skills assessment to align resource capabilities to the complexity of testing activities (high, medium, low, surveillance and administrative), and determine what can be moved offshore or outsourced
Enhance resource capabilities and develop targeted SMEs in high risk / high complexity areas
Use role based training and rotation programs to cross-train and enhance resource flexibility and retention
Deploy robotics process automation to improve the efficiency and effectiveness of risk assessing, testing, monitoring, sampling / data collection, workflow management and reporting
Integrate systems to facilitate management and centralization of testing and monitoring execution activities and results (e.g. enterprise-wide GRC utility)
Establish a process to potentially facilitate leverage results from other testing functions
Gather and normalize data across organizational applications
Establish an intake decisoning waterfall to evaluate automation opportunities
Build a suitability model with specific criteria to delineate between effectiveness testing or other techniques
Develop a flexible schedule that is linked to key capacity planning metrics and testing attribute data
Implement clear and ongoing process control measures to evaluate remediation and change control needs
Centralize reporting of observations, escalating as appropriate
Target State Operating Model
People
Process
Technology and Analytics

24. Planning the Journey SERVICE DELIVERY MODEL
There are various operating models an IA function can adopt when establishing a robotics function - a ‘one size fits all’ approach does not apply.
The scope and capabilities of the robotics function need to be determined, based on both the functions current and potential future needs. The size, scale and level of influence of the robotics function will evolve over time as the auditors view of robotics and thirst for insight matures.

25. Embedding Robotics
Each phase of the audit lifecycle will benefit from robotics

26. Other internal audit use cases
Representative use cases {thought starters} 1 2 3 4
Internal Audit Compliance Risk Assessment
Enhance Internal Audit delivery methodologies by leveraging data extraction, normalization and visualization techniques
Prediction of future risks associated with Internal Audit operations
Analyze vast amount of structured and unstructured data to develop a predictive risk model with real-time analysis capabilities
Real-time reporting of frauds arising in financial systems
Proactively monitor payment systems (transactional data) to flag exceptions and generate reports in real-time
Automated generation of text-based audit reports
Create automated text-based reports based on analysis of structured and unstructured data including physical invoices and transactional data
Automation of internal audit tasks
Help internal auditors digest massive quantities of unstructured standards information, accounting guidance, and client financial data to generate descriptive narration-based textual internal audit reports
Automation of text-heavy documents
Use Natural Language Processing techniques to read large unstructured text documents (e.g., contracts, agreements and invoices) and extract relevant information
Data aggregation
Aggregate large sets of structured, semi-structured and unstructured data to help with dispersed enterprise-wide data, which can then be loaded for population testing and processing
Population testing
Perform multi-dimensional data analysis to understand key relationships between risk elements, and define indicators or drivers for organizations
Intelligence and detection of suspicious logs associated with IT systems
Gather audit evidence and indicators on business processes, information technology (IT) systems, transactions, and controls to help provide continuous assurance, thereby enabling quicker corrective action
Data modelling and batched reporting
Model and simulate data against several conditions, and use in development of risk model and prioritization of risks allowing real-time handling of exceptions 5 6 7 8 9 10

27. Considerations for pre-implementation of automation
Process Documentation
Recertification Process
Testing
Exception Handling and Monitoring
Corporate Audit should encourage the business units to create and maintain pre-implementation documentation that can be easily audited. Examples of process documentation include:
Automation process documentation: Detailed procedures, from sampling to reporting, to aid in completing coding for automation process
Automation process flow: A visual representation of the overall robotic process
RPA coding for automation: Detailed coding scripts covering end to end robotics process automation for each test
Testing workpapers: including sample population, exception reporting, testing results, and final testing results/summary
Design an annual recertification process and incorporate into the RPA governance model to support automation. Supporting activities include:
Identify tests to be recertified
Create templates for types: missing elements, test plan/script recertification, population recertification, surveillance recertification, etc.
Validate consistency and accuracy related to recertification responses from Test Owners and Manager
Produce and manage aging reports
Oversee and manage proposed updates to testing materials to ensure completeness
As a part of pre-implementation activities, business units should perform testing and retain documentation of testing procedures and results related to:
Integration testing: Confirm cohesion between test data and required systems and applications needed to execute testing processes
Performance/regression testing: Evaluate system(s) and application(s) performance under a maximum load of volume, including simultaneous execution of automated tests
User acceptance testing: Test the bots ability to execute tests and produce automated testing results
A framework and process should be designed to monitor the bots in production, triage issues and work with Technology and other relevant stakeholders to resolve as needed. Elements of the framework should include:
Bots development life cycle (“BDLC”)
Issue identification and resolution
Bot monitoring
Bot compliance
Third party risk management
Business continuity
Workforce management

28. NEXT STEPS 1 2 3 4 Identify Process Candidates for RPA
Immediate Next Step
Review existing process maps and heatmaps
Run workshop with executive and department leaders to socialize RPA and identify high potential RPA candidates
Rate processes on value and complexity scales
Identify Process
Candidates for RPA 1
Conduct follow-up sessions with department leadership
Further define chosen processes by documenting them at a high level
Collect relevant process and financial data
Identify process complexities and potential remediation
Define exception handling principles
Conduct Process Assessment 2
Estimate decreased human workloads, fee reductions, and/or cost avoidance associated with defined future state
Integrate software licensing and subscription costs
Determine ongoing robot management assumptions
Develop Business Cases
to Validate Opportunity 3
Identify business unit and IT leadership to champion RPA initiatives; conduct meetings to socialize requirements
Select RPA software vendor
Develop RPA IT infrastructure
Document chosen processes at the keystroke level
Build, test, and deploy automations using an agile approach to speed delivery
Monitor bot performance
Document, Build, Test, and Launch Automations 4

29. APPENDIX