CRISC · Question #194
An organization is implementing robotic process automation (RPA) to streamline business processes. Given that implementation of this technology is expected to impact existing controls, which of the…
The correct answer is A. Reassess whether mitigating controls address the known risk in the processes. When RPA implementation is expected to impact existing controls, the risk practitioner's best course of action is to reassess whether current mitigating controls effectively address the known risks in the altered processes.
Question
An organization is implementing robotic process automation (RPA) to streamline business processes. Given that implementation of this technology is expected to impact existing controls, which of the following is the risk practitioner's BEST course of action?
Options
- AReassess whether mitigating controls address the known risk in the processes.
- BUpdate processes to address the new technology.
- CUpdate the data governance policy to address the new technology.
- DPerform a gap analysis of the impacted processes.
How the community answered
(53 responses)- A74% (39)
- B8% (4)
- C4% (2)
- D15% (8)
Why each option
When RPA implementation is expected to impact existing controls, the risk practitioner's best course of action is to reassess whether current mitigating controls effectively address the known risks in the altered processes.
The introduction of RPA inherently changes business processes, which can alter the effectiveness or applicability of existing mitigating controls. Reassessing these controls is crucial for the risk practitioner to ensure that the organization's risk exposure remains within acceptable limits post-implementation.
Updating processes is an operational task typically handled by process owners, while the risk practitioner's role focuses on the risk impact and control effectiveness.
Updating data governance policy might be necessary for broader compliance, but it is less direct and specific to addressing the immediate impact on *controls* due to process changes.
Performing a gap analysis is a valid assessment, but reassessing mitigating controls (A) is a more targeted and immediate action to ensure continuous risk coverage, which implicitly addresses any control gaps related to risk mitigation.
Concept tested: RPA impact on controls
Topics
Community Discussion
No community discussion yet for this question.