When organizations begin using software robots, or bots, their governance is not always a priority.

This lack of attention to governance can lead to a host of issues: For example, there could be no alert when a bot stops working, or notification when it completes its work, as well as potential security and compliance issues, experts told Bank Automation News.

The risks of setting a bot free with no governance are heightened when it comes to banks and financial institutions, said Karen Reichle, vice president of customer success engagement and a bot expert at robotic process automation (RPA) company Nintex. Reichle spoke with one bank that had in fact let a bot loose without any restrictions.

“They said, ‘Well, we’ll just let the bot have access to everything,’ and I said, ‘Well, what’s the governance around that?’” Reichle told BAN. “The users themselves, they can only do certain things, but once they turn it over to the bot, the bot can do anything.”

While implementing bot governance within an organization becomes more important as bot counts grow, experts told BAN that banks and financial institutions should incorporate governance from a bot’s inception and address key issues, such as bot licensing, compliance and security concerns, and bot lifecycle management.

Defining bot governance

Bot governance refers to the creation of “a center of excellence, or governing body, to help implement, monitor and assess RPA [and] low-code automation programs,” Kelly Combs, director at KPMG’s Digital Lighthouse group, told BAN. Combs’ group focuses on data and analytics.

As RPA matures, organizations are beginning to look beyond basic low-code tools to explore how to better transform business processes, she said.

All governance measures applied to a manual process before it is automated should continue to apply after implementation of the automation, Ken Mertzel, global industry leader of financial services at RPA vendor Automation Anywhere, told BAN.

“Finance and accounting is all about governance and control,” Mertzel said. “Even when you’ve automated a process, you should absolutely maintain the same level of governance and control you would … over a manual process.”

Best practice No. 1: Create an evolving center of excellence

Financial institutions should create a center of excellence (CoE) that is built progressively “along with clear governance and roles across the business units, functions and IT,” according to consultancy KPMG. Consider it business-led with IT and CoE enablement, the company added.

To this end, the $3 trillion Bank of America practices ongoing governance with its artificial intelligence (AI)-powered chatbot, Erica, said Christian Kitchell, head of Erica and AI solutions at the Charlotte, N.C.-based bank.

“We have rigorous model governance that we conduct on an ongoing basis to ensure that Erica is performing as designed across both the core platforms and every algorithm we develop,” Kitchell told BAN. “Then we also have our traditional controls, legal risk compliance regulatory, to ensure that we are effectively leading the way with this type of facility and capability in the industry.”

It’s important to actively orchestrate any change at all in automations. Therefore, governance shouldn’t be a “one and done” task, but rather incorporate change management, said Beji Varghese, partner at financial services at consultancy Guidehouse.

“Change management is absolutely critical to successful automation,” he said.

Best practice No. 2: Implement role-based leadership

Governance needs to cut across an entire organization — not just the IT department, Varghese said. However, the business should manage the controls, rather than the IT department, he advised.

Sponsorship from senior-level leadership, ingraining bot governance into the culture of the organization, is key to success, KPMG notes. Therefore, KPMG suggested that companies focusing on bot governance should have:

• An executive sponsor who provides a strategic direction and is responsible for stakeholder management and vendor selection”;
• A steering committee that determines priorities when there are conflicts and manages funding;
• IT, which manages infrastructure, application access, credential provisioning and maintenance of the architectural standards for automation. IT should also mitigate risk around bot access and process continuity;
• An RPA CoE, responsible for bot development and delivery according to business requirements; and
• Business owners, who are responsible for overall project accountability and sign off on the major stages of the automation development life cycle, which are requirements, risk and controls, and user acceptance testing. They should also ensure that automations are in compliance with regulations.

Best practice No. 3: Process mining for complex challenges

At $187 billion KeyBank, where bots do work equivalent to that of 300 full-time employees daily, process mining is a critical part of the bank’s ongoing governance, said Michael Reynolds. As the Cleveland-based bank’s business technology senior manager, Reynolds is responsible for its RPA and AI.

“We’ll spend two days on process mining, and say, ‘Hey, here’s what we think you’re saying, here’s what we think bots can do for you, here’s what we think the cost savings is and here’s the estimate of when we can do it,’” Reynolds told BAN. “At the end of that conversation, we either put it on our backlog, or we defer it.”

Process mining identifies the steps that computers and humans take to complete a process. It can help identify potential cost savings, Reynolds told BAN.

“RPA programs that have been successful usually have started with a pilot moving into a broader phased implementation that spans multiple functions or lines of business,” Combs said. “Once a level of maturity has been reached, the business looks into how to do better process mining, how to better solve more complex problems that potentially can’t be solved with RPA.”

Governance is increasingly important in the “AI [and] ML space, specifically as existing model risk management procedures do not account for allow the risks associate with AI [and] ML and the regulatory environment is still highly evolving,” Combs added.

Government regulators in the U.S. may take up bot governance in the next two to three years in response to draft European Union legislation relating to the use of AI released this year, Combs said. But for now, banks should understand and prepare for future regulatory requirements at the onset of bot creation.

“If more sensitive processes are being automated, and the program is intended to be long-term, it may make sense to implement compliance requirements at the program, process and platform level at the onset,” Combs said.