The best way to determine where RPA can deliver maximum return on investment (ROI) is to take a structured approach to identify, evaluate, categorize and prioritize automation candidates.

For example, suitable tasks for automation are those that are routine, manually intensive, prone to human error and rules-driven (i.e., not overly subjective) and for which supporting data is readily available and easily readable.

Control-testing automation or use of automation to expand coverage (e.g., through testing larger sample sizes or full populations) are obvious areas to explore, but also consider routine internal audit activities, such as document request management, artifact gathering, interactions with GRC platforms, process and control owner follow-ups and reminders, issue validation and even initial report generation. These more administrative-type tasks are often collectively the most time-consuming while also delivering little value compared to the effort required. Asking the audit group to hold an automation-opportunity brainstorming session usually yields a medium-to-long RPA candidate list fairly quickly.

Next, evaluate this list to determine which candidates are likely to offer the best ROI by looking at the automation potential of each, both in terms of technical feasibility and the expected value that automation can deliver through increased efficiency and coverage/effectiveness.

In evaluating the ROI of potential RPA scenarios, look beyond traditional measures, such as employee reduction or cost savings, to less tangible metrics, like increased visibility and credibility for the internal audit organization; increased insight, breadth and depth of coverage; ability to provide more real-time monitoring; and ability to focus on more value-add activities. These metrics are important because they impact the quality of internal audit’s interactions with its key stakeholders.

A good outcome might also include expanded audit capabilities. In the case of control testing, for example, RPA allows internal audit teams to move beyond traditional detective or preventative methodologies of periodic artifact requests to continuous auditing, making almost instantaneous an audit cycle that may have previously taken several weeks. Auditees also benefit because they can spend more time on their business-as-usual activities and, in the event of a control deficiency, they get closer to real-time results and have longer runways for remediation.

Automated artifact gathering can also position internal audit to be more autonomous: for example, IA functions can partner with the business to understand the process followed to generate audit artifacts (including the systems involved) and subsequently work to automate these processes.

Generated artifacts can be stored in a centralized repository on a routine schedule (e.g., monthly) or RPA bots can be designed to generate the information at will. Additional bots can be designed to tick-mark evidence to aid the internal audit testing process. The measuring of the ROI of automated artifact gathering and testing should consider the time and effort saved on both the audit and business sides.

A word of caution: Often an existing process may require some tweaks to make it a better candidate for automation. Streamlining processes should always be done prior to automating them.

Once the candidates have been identified and prioritized, it is relatively simple to group them by commonalities and then develop a prioritized roadmap outlining which controls/activities will be automated and in what order.

Take the First Steps Now

An old Chinese proverb says every journey begins with a single step. RPA is among the hottest technologies in the market, and there is no reason for internal audit to fall behind in its evaluation and adoption. Taking the first steps often involves tasking an IA team member with a strong aptitude in technology and interest for innovation to take a lead role in developing the automation capability for the broader IA team. Generally,