A business unit has implemented robotic process automation (RPA) for its repetitive back-office tasks. Which of the following should be the risk practitioner's GREATEST concern?

If the security team is unaware of an RPA implementation, it signifies a 'shadow IT' scenario where new systems, processes, and potential access methods (the robots) are operating outside of established security governance, potentially creating unassessed vulnerabilities or control gaps. This lack of visibility prevents proper security reviews, monitoring, and integration into the overall security posture.

While loss of institutional knowledge is a potential operational risk with automation, it is typically a lower-priority security concern than direct unmanaged system access.

Robots failing to work effectively is an operational risk that impacts efficiency, but not necessarily a direct security risk compared to unauthorized implementations.

The use of virtual clients for RPA is a common and often secure deployment method, not inherently a concern on its own; the security of those clients would be the concern.