We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks. RPA is a software technology used to emulate human actions on a computer. RPA software programs, referred to as “bots,” can complete repetitive tasks quickly and consistently, freeing up employees to work on other, higher value activities. RPA has the potential to increase business process efficiency, improve the effectiveness and consistency of mission services, and lower costs. However, because RPA interacts with HUD information technology (IT) systems and can be used within important agency business processes, it can introduce new technology and operational risks for HUD programs.
We found that HUD lacked adequate controls and capacity to operate its RPA program efficiently and effectively. After more than 3 years since its inception, HUD’s program had achieved minimal progress and results. HUD lacked adequate internal controls and staffing capacity to effectively oversee and manage the program. HUD had not established a clear vision for the RPA program or set measurable metrics to define program success. HUD also did not maintain adequate oversight of bot development and operations to ensure that limited RPA program funds were used efficiently. Finally, HUD lacked important IT controls related to the security and auditability of its RPA system. As a result of these weaknesses, HUD missed opportunities to capitalize on the potential benefits of RPA and expended IT resources inefficiently on projects that provided minimal value.
This evaluation report contains four recommendations for HUD to implement new internal controls and further develop its internal capacity to manage and oversee the RPA program. Appendix A of the report includes opportunities for improvement that will not be tracked as formal recommendations but are noted as general suggestions to improve HUD’s RPA program effectiveness.
Recommendations
Chief Information Officer
- Status2021-OE-0007-01OpenClosed
Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.
- Status2021-OE-0007-02OpenClosed
Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.
- Status2021-OE-0007-03OpenClosed
Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.
- Status2021-OE-0007-04OpenClosed
Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.