1. ROBOTIC PROCESS AUTOMATION (RPA) - The Impact on Internal Audit

2. Agenda Introduce RGP and Presenters Objectives of the Session
Understand Robotic Process Automation (RPA)
Summarize the Opportunity Areas & Value Drivers of RPA
Identify Current RPA Solution Providers
Understand the Criteria for Scoping & Prioritization of RPA Opportunities
Provide an Example of RPA Utilization
Understand How RPA Applies to Internal Control
Understand the Risks of RPA
Understand the Impact of RPA to Internal Audit

3. Our Company Founded in 1996 as part of Deloitte
Management buy-out (1999) and initial public offering (2000). NASDAQ: RECN
Program Management ▪ Project Management ▪ Change Management
Finance & Accounting
Governance,
Risk & Compliance
Information Management
Human Capital
Procurement
& Supply Chain
Legal & Regulatory
3,000+
Consultants Globally
87 of the Fortune 100
Have Been Clients
70+ locations worldwide 48
NAM 12
EUR 12
APAC

4. What is RPA ?
RPA is not a physical “robot” but a configurable software, that sits on top of a company’s existing IT infrastructure, pulling data, performing algorithms, and creating reports.
The “robot” is configured to complete the same process steps, follow the business rules, and use the same systems that a human does today.
RPA makes the most significant impact on manual work processes, that are repetitive and recurring, and often have high human error rates.
A single “robot” can be configured to performed a variety of processes enabling multi-use robots, and variability as your business needs change.
The initial implementation of RPA can happen in weeks and typically delivers an ROI of greater than 5:1, often recouping the investment in the first year.

5. RPA Insights 1. Current State 2. Predictions (2018 – 2020)
The automation journey is prevalent across all industries and functions
A classic candidate for RPA would be one where three characteristics are present:
The tasks or actions are consistent, with the same steps being performed repeatedly
The process is template driven, with data being entered into specific fields in a repetitive manner
The process is rules-based, to allow decision flows to alter dynamically
By 2019, process automation will have limited impact on top-line growth for 50% of organizations that will erroneously focus on labor reduction, not on improving business outcomes
By 2020, automation and artificial intelligence will reduce employee requirements in business shared-service centers by 65%
During the next three years, more than 50% of service automation projects will be abandoned or will fail to deliver anticipated benefits
million FTEs could be replaced by automation tools and software by 2020
Kaush
There are basic tenets for RPA to be achievable. It is somewhat nascent area, but is rapidly evolving. What we want to walk you through today is not only the basic framework of RPA i.e., the what, how and why, but also to provide you some tips or CSFs that are essential regardless of whether you are embarking on the journey, have begun the process of automation, or completed your automation process.
Sources: Gartner, IRPAAI, RGP Research

6. What are the Key RPA Value Drivers?
“Reduce operating costs and processing costs while increasing security”
“Deliver value by increasing margins, reducing costs and operating more competitively”
CXOs: “We Need to…”
COO
CFO
CHRO
CIO
CEO
Michael
“Increase productivity / deliver better services faster”
“Provision a compliant, scalable, resilient and flexible digital workforce to the operation”
“Hire, train and deploy workforce that is agile and flexes to business needs”

7. IT Resourced & Delivered
What Do We Automate?
IT Resourced & Delivered
Business Resourced
Enterprise IT
Operational Ownership
Easiest to automate repetitive, high-volume, operational processes
Back Office Examples:
New hire simplification
Account Management
Off cycle pay
ACA validation
Garnishment processing
Tax processing
Pre and post payroll activities
Leave / vacation management
Training automation & reminders
Digital Workforce
Powered by
Software Robots
Volume of work
Michael
Different class of business problem
Sits alongside the problems IT are solving
CIO provides a platform
COO builds the apps
3rd sourcing option for….
Procedural Automation
Previously Uneconomic Projects
Short Term Regulatory Requirements
Competitive or Rapid Response
Business Processes

8. Potential Applications of RPA
Sales/Services Order to Cash, Account Setup. 24/7 Customer Service Support, Customer Complaint Tracking
Procurement
Vendor Setup, Requisition to Purchase Order, Invoice Processing
Finance & Audit
Accounts Payable, Accounts Receivable, General Ledger, Payments Processing
Kaush
Tax
Sales and Use Reconciliation, Tax Master Data, Monitor / Renewal Processing HR
On-boarding / Off-boarding, Payroll, Resume Screening / Matching IT
Account Setup and Maintenance, Internet Checks & Processing, Database Checks & Clean-up

9. RPA Hard and Soft Potential Benefits
Reduced Costs
Improved Quality
Increased Security
Improved Compliance & Reporting
Upgraded Analytics
Increased Employee Satisfaction
Improved Operational Control

10. Sales & Use Tax Reconciliation
RPA Video Demo
Sales & Use Tax Reconciliation

11. Leading RPA Software Providers
Michael
Meet the candidates for your RPA solution. When you’re hiring a digital workforce, it’s important that you understand who the candidates are so you can make an informed decision and hire right. To help you understand the three general types of candidates in the marketplace, we’ve given them each a persona.
First, there’s the Intern. Interns are eager to get going quickly, but need to have someone supervise their activities. As such, they’ll be sitting right along side you, helping you to do your work. You can hand off small bits of work to them and they’ll spring into action to get it done. They’re inexpensive to hire, and you’ll be able to get some value out of their work.
Next, there’s the Expert. This worker is seasoned, and you’ll pay for that experience. They work on their own schedule, so you may not get what you need when you want it, but when you do get it, you can be sure that the work is done right. They are deeply skilled in one area, which doesn’t make them a great fit for all situations.
Finally, there’s the Associate. This worker can learn things quickly, and can learn many different tasks along the way. They work well on their own, so you don’t have to keep checking in on them. They also work well as a team, both with humans as well as other Associates. They keep meticulous records of what they’ve done so that the audit teams can check everything if they need to.
So let’s reveal what these candidate look like from an RPA software perspective…
First, our Intern is like the Desktop Recorded Automation software that gives quick wins but doesn’t scale very well.
Desktop Recorded Automation
Aimed at human agent assistance
Directed by a human to do a task
Often executes on their own desktop (not always)
Messaging: Get up and running as fast as you can – tell IT later. Focus on speed of automation
[No real consideration for maintenance; reliability of execution; security of operation]
Next, our Technical Expert is like the IT Developed SDK’s that offer system integration solutions.
IT Enablement and SDKs
Aimed at helping IT teams be more efficient
Point-solution intended to be wrapped in as part of an IT project
Messaging: Don’t trust the business with automation
[Doesn’t solve the problem – the business is still reliant on IT for all changes no matter how small; this is not an IT project – this is a capability]
Finally, the Associate is like the Digital Workforce Platform that Blue Prism offers. It’s designed to be:
Secure
Enterprise Strength
Hosted in a Data Center or Cloud as a lights-out operation
Autonomous – working on it’s own processes without human intervention
* Source: The Forrester Wave Robotic Process Automation, Q1, 17

12. Opportunities Mapping by Process
Business Benefit / Value
Process #
Process #
Process #
Process #
Potential to Automate
KEY:
Green indicates those processes that have low risk associated with moving them into an automated state.
Amber indicates those processes that have some risk associated with moving them into an automated state.
Red indicates those processes that have high risk associated with moving them into an automated state.
PURPOSE OF DOCUMENT: This will be the output document following the Process Maturity and Impact Assessment. It will highlight, in a clear way, the processes most suitable for automation, as well as those with the highest risk associated. For example – A process may have high value to automate, but will cause significant impact and has high risk associated with the transition. It might be better to consider moving lower risk processes across first to win trust and demonstrate potential value.
This document is the proprietary and confidential property of RGP

13. RPA Common Capabilities
Opening and attachments
Logging into web/enterprise applications
Moving files and folders
Copying and pasting
Filling in forms
Reading and writing to databases
Scraping data from the web
Making calculations
Connecting to system API’s
Extracting structured data
Collecting social media statistics
Following “if/then” decisions/rule

14. Example of RPA Utilization In Bank Reconciliation
Save monthly Bank Statement to G:\
START
Treasury
Searches folder for new statement
Opens previous months “Recap file”
Date the mode of receiving statement
Follow-up with treasury / online
RPA Bot
Opens and reads statement data
Yes
Check for any bank activity for previous month
Mark & date as “No Activity”
Statement received? No No
Extracts statements data online from the banks website
Any activity?
Yes
Look-up a/c# electronic statement with a/c# on recap sheet
Input region #, district# & district name on electronic statement
Mark and place statements in respective files by regions (30)
STOP
Lookup date range for the month
Reconcile statement with FIN
Does it reconcile?
Yes
Change status to ‘finalize’, date and initial “RPA”
STOP No
Call office to gather missing inputs
Determine reason for missing entry
Change status to ‘finalize’, date and initial “Person”
Entry found?
FIN Team
Zero balance transfer
Journal entry
Verify deposit
Bank activity

15. How Can RPA Be Applied to Internal Control?
RPA can be applied where there is a high volume of routine, labor intensive and mundane activities performed on a day to day basis by the 3 lines of defense:
Operate a control based on a predefined frequency, acting as a Control Operator, and evaluate a control’s operating effectiveness by performing periodic control self-evaluations, acting as a Control Owner (1st line of defense).
Evaluate a control’s operating effectiveness by performing periodic management testing of control effectiveness, acting as an Internal Control Tester (2nd line of defense).
Evaluate a control’s operating effectiveness by performing periodic independent testing of control effectiveness, acting as an Internal Audit Tester (3rd line of defense).

16. This All Sounds Good But What About the Risks?
We can’t just ask “how can we utilize RPA?”, we must also ask “how does RPA impact our risk profile?”
Data Governance and Controls Standards
Privacy and Data Protection
Regulatory Considerations
What Could Go Wrong

17. What are the Data Governance and Control Standards?
RPA needs a digitization strategy; prioritize the right processes, governance approvals, and development, testing & deployment protocols. It also needs an infrastructure to manage the new robotic workforce, and support future RPA changes.
Overarching governance framework for adoption of RPA and alignment to risk, compliance and IT/data frameworks
Have we selected the right processes?
Have we optimized processes before we automated?
Are all upstream & downstream linkages known?
Management and ongoing support and maintenance of robots
Who will oversee robot operations?
How do we manage changes?
Have we developed a recovery plan?

18. What about Privacy and Data Protection?
Privacy and Data Protection need to be considered for RPA, especially if the task involves the processing of personal information
Heightened risk of privacy breaches that occur through technology innovations
Currently, no specific guidance on RPA companies
Take reasonable steps to implement practices, procedures and systems that will ensure privacy compliance
What vendor management provisions will you establish and maintain to verify how data might be accessed?

19. What are the Regulatory Considerations?
Given that RPA is an emerging technology, there are no standards or formally agreed upon industry controls specific to RPA
RPA adoption is business driven but control functions must ensure control standards
Critical to ensure that control standards are deployed for the rollout & management of RPA
Does this automation affect financial reporting processes and Sarbanes-Oxley controls?
Understand cross border rules governed by regulatory bodies like FINRA and the SEC

20. What Could Go Wrong?
Need a post-deployment review to ensure the processing and decisions made by the robot align with expectations
Risk of missing rules
Basic RPA can only do what it’s been told to do. Often humans follow innate rules that are without conscious thought applied, decisions just make natural sense to the human operator and aren’t documented.
Processes are not mapped correctly
Automated activities may be incorrectly performed or incomplete. Automating an inefficient or poorly controlled process only amplifies the issue.
Natural human safeguards removed
Where there are many transactions and many users, errors may often not be widespread across the business process. With automation, if you get it wrong, you consistently get it wrong.

21. What Are the Impacts to Internal Audit?
Need to understand the technology
Opportunity to influence control design
Potential to increase audit efficiency
Free up capacity to focus on higher priorities
Enhance ability to add valuable insight
Need to develop new testing approaches
Consider need for changes to IA staffing model

22. THANK YOU QUESTIONS?

23. Contact Information
Lester Sussman
VP, Governance Risk & Compliance
Phone:
David Matthews
Regional VP, Advisory Services & Global RPA Lead
Phone:
Terence Hogan
Director, Advisory Services & Legal
Phone:
LES