Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 25 views

    Risks in An RPA Environment: Phases of Audit Considerations

    Uploaded by

    Vikram Thorat
    RPA brings inherent risks to the business processes it automates, including unauthorized changes to automated processes, non-compliance with software licenses due to generic bot IDs, and risks from storing credentials of multiple applications in bots with extensive access. When auditing a bot environment, considerations include understanding areas of RPA implementation, identifying new IT risks and controls, evaluating control design and exception handling processes, and assessing controls operating effectiveness through logs, audit trails, and governance reviews. A secured bot environment requires effective management and monitoring of seven risk domains including user access, change management, operations, and program development controls for relevant bots.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Risks in An RPA Environment: Phases of Audit Considerations

    Uploaded by

    Vikram Thorat
    25 views2 pages
    RPA brings inherent risks to the business processes it automates, including unauthorized changes to automated processes, non-compliance with software licenses due to generic bot IDs, and risks from storing credentials of multiple applications in bots with extensive access. When auditing a bot environment, considerations include understanding areas of RPA implementation, identifying new IT risks and controls, evaluating control design and exception handling processes, and assessing controls operating effectiveness through logs, audit trails, and governance reviews. A secured bot environment requires effective management and monitoring of seven risk domains including user access, change management, operations, and program development controls for relevant bots.

    Original Title

    RPA Assurance - Copy

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    RPA brings inherent risks to the business processes it automates, including unauthorized changes to automated processes, non-compliance with software licenses due to generic bot IDs, and risks from storing credentials of multiple applications in bots with extensive access. When auditing a bot environment, considerations include understanding areas of RPA implementation, identifying new IT risks and controls, evaluating control design and exception handling processes, and assessing controls operating effectiveness through logs, audit trails, and governance reviews. A secured bot environment requires effective management and monitoring of seven risk domains including user access, change management, operations, and program development controls for relevant bots.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    25 views2 pages

    Risks in An RPA Environment: Phases of Audit Considerations

    Uploaded by

    Vikram Thorat
    RPA brings inherent risks to the business processes it automates, including unauthorized changes to automated processes, non-compliance with software licenses due to generic bot IDs, and risks from storing credentials of multiple applications in bots with extensive access. When auditing a bot environment, considerations include understanding areas of RPA implementation, identifying new IT risks and controls, evaluating control design and exception handling processes, and assessing controls operating effectiveness through logs, audit trails, and governance reviews. A secured bot environment requires effective management and monitoring of seven risk domains including user access, change management, operations, and program development controls for relevant bots.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 2

    Risks in an RPA environment

    RPA brings its own inherent risks as well the ones that are resultant of the business environment it automates. As part of RPA
    assurance, we can address following access security risks:

    • Automation of process through RPA without embedding/aligning control design may lead to manual override or
    unauthorized changes which often goes undetected.
    • Generic BOT ID often poses risk of non compliance to software licenses due to potential indirect usage
    • BOTs stores credentials of multiple applications, which are often empowered with extensive access. Unauthorized
    access and use of BOT credentials may lead to data, security, privacy and fraud risks

    Considerations at different phases of audit when auditing a BOT environment:

    Phases of Audit Considerations


    Planning: • Audit plans and risk assessment for RPA
    • Detailed understanding of the areas • Update to control matrices for automation through RPA
    where RPA is implemented • Upfront involvement of IS Auditor/BOT Specialists
    • Audit Plans

    Walkthrough: • New IS/IT risks and scoped in systems


    • Understanding of the process & IT • Changes to automated controls, IPE/IUC , audit logs and interfaces
    • Identification of Risks and Controls • More IS Risks and therefore enhanced ITGCC controls
    Design Evaluation: • Substantial work by IS Auditor to test controls from Design
    • Evaluation of the Design of controls (Configuration controls, logs, Cyber risks)
    • Exception handling process • Testing for IPE/IUC
    • Identification of gaps

    Operating effectiveness: • Increased controls testing and minimal substantive testing


    • Controls Testing • Process governance and roles
    • Substantive Testing
    Reporting: • Logs and audit trails
    • Gaps reporting • Changes to control design, RCM, SOPs, roles etc.
    • Recommendations • Technology recommendations
    Control Areas in BOT Environment

    A secured and compliant BOT environment requires effective management and monitoring of the seven risk domains. Depending on the
    relevance, each of these domains would help strengthen security and controls in your RPA environment. The below framework presents
    a clear view about the types of risk which need to be considered when auditing a BOT-enabled organization. The auditor should try to
    use a risk based approach to identify the controls addressing each of the RPA-specific risk consideration. Every domain of general IT
    controls such as user-access management, change management, operations, and program development is important to be looked at
    for the relevant BOTs.

    You might also like