Blogs Daniel Pokidaylo, CIA, CISA Mar 09, 2022
Two use-cases showing how internal audit can use RPA technology to save time and automate controls.
Dan Pokidaylo
Internal audit departments consistently look for new ways to demonstrate their value. If we want our company executives to see us as an advocate for our organizations instead of a roadblock, we need to evolve how we perform our usual practices. One value-added area that audit departments have been talking about for the past few years is robotic process automation (RPA). However, while many audit departments may have started to use data analytics to perform one-off tests, most audit departments are still struggling to find ways to actively use RPA to continuously improve upon our audit processes. It's time for audit departments to think outside the box when it comes to training and hiring to make RPA a reality.
I want to discuss two use-cases for how internal audit teams can start using RPA technology to bring audit teams to the next level. I won't get into all the specifics on how to actually create the bots, but there are many vendors who have developed the RPA technology that can help you bring your vision to fruition.
The first use-case is to automate audit metrics and key risk indicators on a continuous basis. I don't know about you, but we have over 25 metrics and charts that we develop — such as the number of open issues, criticality of the issues, root causes, and the list goes on. Prior to using RPA, it took us days, if not weeks sometimes, to generate these metrics for our governance committees. With RPA, these are now completely automated in real-time. The second use-case is to leverage the technological capabilities of an industry-leading RPA tool to automatically retrieve and analyze data instead of constantly sending requests to management.
In the first use-case, internal audit teams can use an RPA tool that automatically imports all your audit data on a scheduled basis. Many audit software tools today have this capability already built in, so anything that you document in the tool, such as your controls, issues, due dates, root cause categories, etc., can be reported on. However, while building reports based on this data is helpful, it still requires a manual effort to run the reports and filter them on various data points to create metrics. This is where RPA comes in. By using RPA, you can automate all your metrics in real time and automatically display or send the data wherever you choose. No more manual intervention!
Let's look at one example. You know the audit committee and board are interested in the percentage of high-rated issues by business service. You can create an RPA-bot that automatically calculates these numbers and percentages and displays it in a report, or in a visualization tool in the form of a pie chart. You can further leverage the bot to automatically email reports on a periodic basis. This way, if a question ever comes up in a meeting, you can easily look at your chart or pull up the information with the real-time data.
The second use-case deals with data access. Auditors are constantly asking management for data set populations so that we can sample. By leveraging RPA, we can use all the technological advancements of today's tools to automatically import the data when we need it, instead of asking management. We can also leverage RPA to either automatically select our sample from our population, or we can use it to evaluate the entire population. As companies start to leverage newer tools for processes such as accounts payable or IT service management, the RPA tools can automatically connect to the new applications to import the data in real time. This allows us to save time and effort from requesting the data every time we need it. It's a win-win for both us and our stakeholders!
Furthermore, we can create RPA bots to not only obtain the data, but also to perform our controls testing on the data automatically. For example, we can create a bot to automatically import all the invoices from the accounts payable system on the first day of the audit and then create another bot that reviews the entire population to ensure all invoices were appropriately approved prior to being paid. By creating this bot, we not only save management's time, but we also automate our controls testing and provide assurance for all the invoices in the population instead of just for a sample of 25 or 40. This also allows us to spend more time performing deeper dives on other processes.
In the two use-cases, management would immediately see the benefits of the audit department using RPA and the value it brings to the organization and to the governance committees. You now have all the real-time audit data at your fingertips, you're saving management time from sending you audit deliverables, and you're providing greater assurance on your audits. It takes a full team effort and potentially hiring people without the typical auditor background to kickstart an RPA program, but the value it can bring to the audit department and organization will be a great return on investment. There are tons of great RPA tools out there and very helpful vendors that can get you started on your journey!