An IS auditor is planning a review of an organization's robotic process automation (RPA) technology. Which of the following MUST be included in the audit work plan?

Question

Options

• AIntegration architecture
• BChange management
• CCost-benefit analysis
• DEmployee training content

• A
  9% (2)
• B
  82% (18)
• C
  5% (1)
• D
  5% (1)

Explanation

Change management must be included because RPA bots interact directly with production systems and business processes - any uncontrolled change to a bot, its underlying application, or the process it automates can cause failures, data errors, or compliance breaches. An IS auditor reviewing RPA must verify that changes to bots and their dependencies go through a formal, controlled process with testing and approval gates.

Integration architecture (A) is relevant context for understanding how RPA connects to systems, but it describes the design, not a control area the auditor must evaluate for risk management purposes - it supports the audit but isn't a required work plan element. Cost-benefit analysis (C) is a business justification exercise done before RPA implementation, not an IS audit control domain. Employee training content (D) may be reviewed as part of a broader change management assessment, but training content itself is not an independent audit focus area for RPA.

Memory tip: Think "RPA bots = software that changes frequently." Any time software changes without controls, things break silently - so change management is always the IS auditor's first concern with automation technology.

No community discussion yet for this question.