Session Information:

An overview of Morningstar's RPA program and progress on SOX controls

Insights into how a global financial enterprise is adapting and thriving.

Session Transcript:

Welcome Marco Chmura, who is the director for quality and transformation at Morningstar serving the company for 12 plus years. He's responsible for driving transformation initiatives across the organization. specifically to help shape and implement RPA and other intelligent automation in financial services as well as enhanced deans, the impact of Morningstar research, Marco. Thank you for being here with us. We're very much looking forward to your presentation. I've had the pleasure of working with you and and and and being a presentation for a few in the past and I always find it fascinating. The level of insight that you have on the on this applications. So it will be a true gift for our audience. Thank you for that again.

No problem, thank you Josie.

Go ahead, and share here. Hello everyone.

Happy to be here, and join such a interesting and relevant conference with so many great speakers.

And, apologies that there were some technical difficulties. I'll try to move as quickly as possible.

But, if we don't have time for, for Q&A, we'll just have to stick with the presentation. But we'll see if we have time at the end. So yeah, I'm director of quality and transformation at morningstar.

Today I'm going to give a little bit of background on our RPA program.

The process we have some, some kinda current areas of focus, that are in play right now.

I'm gonna go through some process examples, just to give you a little bit of a flavor. Probably some things that aren't super surprising, but hopefully give you a sense of what we're doing here. And then I'm gonna go through some of the things we've done to implement our governance program. And most recently, late last year, achieving sox compliance, which is a pretty big deal for us, Because we are a public company and we have our internal audit and compliance regulations that we need to comply with, and it's taken us a little bit of time to set that up. So I'll talk through that as well. I'll close with some key learnings. And again, if we have time, we'll get into some questions.

So, real quick, Morningstar's, an investment research company, we build great products and software and deliver great data and research to a number of clients, both across individual investors, advisor, institutions, then institutions themselves, that use our products to help manage their portfolios.

We are a global company with over 7000 employees.

The company was founded back in the mid eighties, and, you know, grew pretty quickly and has gone through quite a few. As you can imagine, a lot of companies, quite an amount of growth that leads to ..., You know, process expansion, people transitions. We've done a number of acquisitions over the years that have, of course, kind of stacked up some processes that can become manual and complex.

Joe Mansueto, the founder, had an internal quality program identified several years ago. Back in like 2005, 2006, which is the team I'm a part of and having an internally focused. Independent quality team can be very advantageous to us, advancing continuous improvement, operational excellence, and most recently, transformation.

With continuous improvement, we are a Lean shop, So we practice Lean six Sigma, and we do a lot of training and coaching on continuous improvement projects.

A lot of times, removing waste can often bring to teams the idea of automation.

So we started our RPA journey in 20 18 as it started to grow and look like a viable solution to help us further advance those solutions and our automation efforts.

We started by piloting, just in a few teams, and evaluating a few different vendors.

But we've since actually established our center of excellence.

So we do all centralized development out of our, actually, our Asia offices.

So we have a full team of eight RPA developers plus a very dedicated and effective RPA architect that helps structure our RPA instance, our Orchestrator co-ordinates across all of the server updates and administration that's needed, but also co-ordinates amongst our Agile Scrum process for our developers.

Having a center of excellence is effective, because these are full-time, dedicated developers that make full use of our studio licenses. They also, of course, grow their skills, and become very flexible in the teams and codes that they work with.

And it makes us, not fully, 24 by seven, almost, with our, with our global development team, to be able to react to any issues that happen.

The process owner role is very important at morningstar. It's a big facet of lean actually when you're building a more successful process.

Empowering the teams and building ownership around the client experience and around the quality and timeliness is very important. So having those process owners in place really helped us connect RPA with the key folks that need to help document, identify, implement RPA with our developers. We also work very much with our various tech and product owners, as we navigate the various systems and applications that we're working with.

We work with UI path, we've been working with UI Path since the beginning, They have a very good support model. They allowed us to trial licenses and pilot. They've been with us all the way, which I'll talk about a little bit more in a bit. We're currently up to 26 bots. We've shifted more to unintended licenses, as that's a very good, effective use of the RPA software. But we do have still eight attended bots the various teams navigate to through the eyes, and we'll start processes.

As they're needed to start, versus on a pre-determined schedule, like, are unintended bots, do, we're also experimenting still quite a bit with Abby Flexi capture. We automate a lot of PDF processes. We have an internal chatbot. We use Google Dialogflow.

It's a very structured search model, but it's also helping us connect, kinda quick question answers with RPA. And we're currently experimenting a lot in the AI ML space. We're building models ourselves.

We're evolving some of our roles into data scientists.

And we're even looking at opportunities now to implement, eventually, AI, extensions of UI path, or any other offerings that are out there.

And finally, the counts, right? So we're, we've been able to automate almost by 500 processes. We just entered Year four.

So, you know, we've been very dedicated to this effort, and it's, it's obviously grown as we've expanded the team and the reach of RPA.

This has led us to have, you know, greater than 75,000 annualize hours saved. So, we're removing a lot of that manual work from our workflow and really helping people focus on the more value added activities. This is also brought several quality wins and speed wins. Obviously, when things happen on a pre-determined schedule, and a bot is working through the process.

that's been thoroughly tested, it becomes much more reliable, and a lot more opportunity for errors to be removed from the workflow.

Talk about that a little bit, when I go through some examples. Real quick, this is our workflow.

Not too surprising, that kinda key first part around process identification. And prioritization is where those process owners partner with us very closely. This is where we also get a lot of insight from the vendor as well as external companies and people like yourself. So a lot of learning and evaluating to figure out what we want to do.

A very important documentation process, which I will talk about in a minute as well, but, you know, we do have a template for SLPs as much as we try we can we try to be flexible with maybe videos of processes side-by-side between the developer and the process owner. But a lot of times, nothing beats having just a nice, detailed roadmap of what the process is, especially when you have to go back and adjust it, or maintain it in the future. Then there's, of course, that development, QA step and going, going live and governing our process going forward. Key steps when we get into sox compliance, which I'll talk about in a minute, here is the, the criteria we have. Which, you know, not too surprising, but what are we looking for, when we want to automate, at this point, in our RPA journey? So more stable processes, try to have minimal exceptions, which is easier said than done.

Of course, their rule base frequently repeated.

As much as possible, the data needs to be structured or semi structured. And this is a key point at the end, can't be implemented in the system of record. It's either due to resource constraints, or maybe it's just not possible, but we always want to have that tradeoff discussion. And, you know, partnering with technology and understanding, like, why are we doing RPA here versus implementing it in the system?

and being very thoughtful and diligence in the decisions that we make.

And having everyone understand that there's not questions or, you know, decisions that are made that might not be the most effective.

As I mentioned before, we became officially socs compliant at the end of Q three last year.

So, a big journey for us that I'll go into real quick, just talking a little bit more about that kind of process documentation and process.

Identification with process owners, and understanding. Like, we all kind of when we think of A process, and, and even even even after We've been through this a lot, And this applies a lot to Lean as well. But you think about it as kind of having a linear flow. And then it goes from A to B to C. But what does it really look like? It's often this kind of spiral. This award process mining can become very effective.

We don't use process mining, I don't know that our organization is at the size where we need to necessarily leverage that technology, but it is something we're still considering, we're making still quite a bit of progress just with the identification and documentation that we're doing now, But the process mining is also an effective technology that can help you here.

But this is really where a lot of company workflows just, they're much more complicated than you'd expect them to be, so having the diligence and the process that we built around RPA. And anything that we do to standardize.

And certify processes at morningstar is very important because there are just so many, you know, exceptions and loops and contact points that come into play.

So, I want to quickly run through some of our key areas of focus for last year and this year. You know? No surprise, we're trying to go deep and our finance, HR, and service teams, these are areas where we feel like we have a lot still of opportunity, but we really haven't quite. You know, reached the breadth that we would have hoped for at this point in our journey. We have, like I mentioned before, over 500 active processes, but, but we've got less than a fifth of those coming from our, our key teams here.

A piece of that actually has to do with access.

So whenever we're setting up a new process, as you know, we gotta go through a, a significant amount of discussions with the tech owners, get approval. Make sure they understand how RPA is going to be used. What kinda login the bot has, How it's going to be navigating the system. Is there an API we can set up, so that we can make it a little easier to, you know, add new processes and maintain it going forward?

And then finally, and this kinda lends itself a little bit, too, or AI, ML aspirations, but we need to move our on prem servers.

And this is a company wide initiatives or moving all on prem servers to Amazon Web Services, and, and that's a process for RPA and, And it's actually impacted by our sox compliance needs and, and, you know, how are any of the controls that we've put in place around our RPA servers.

You're going to be impacted by this, move to cloud.

It also gives us more opportunity to leverage some of those new AI center, and AI capabilities that are out there when we're in a Cloud environment versus on prem.

I want to run through a few use cases before I dive into our governance program. A little bit. This is just a one good example I like to highlight because we really took advantage of RPA to stitch together our Salesforce processes. We acquired a company almost five years ago, that is in private equity data, very, very well with our, our public data.

And when we were doing that, we had a challenge that we were really, the way that deal was set up in the way that we are connecting with that company. They still have a very standalone nature for a lot of their processes and that includes their contracting in there.

Process for signing up new business. Because we need to sign off on our financials, there was a need to merge our Salesforce instances. And that is a heavy lift. You know, CRM migration, as many of you, I'm sure are aware, is no easy task.

So, to have a process that could maybe bring data from one system to the other and remove the need to actually, you know, integrate the two systems, was a great opportunity.

And it's actually still carried forward today right now, and that we're still using this until we do merge our CRM instances. And what it does is it brings key data from the acquired company into our Salesforce instance, and it use the bots to do all that. Once. We had it set up, we had to go through a number of processes around the master data. The opportunities, the renewals, all that kind of detail needed, all the key data points need to be brought into Salesforce, and now there's a nightly or weekly sync that brings together that data and keeps us no consistent in the way that we manage our quote to cash processes.

Here's another good one, where we, We actually, we just use quick base.

We had a lot we still do in some instances, but we were a, you know, very dedicated to quick base shop, and we wanted to retire that for a number of reasons. And when we were doing that, like, we had uploaded a ton of attachments across various projects that were set up across quick base.

And after numerous attempts and discussions around how can we get all that data out of there, and have it archived and stored in a place that we can access it, once our quick base license is diminished.

We identified RPA as a good solution, because we could not get passed as many discussions as we had. How do we couldn't get direct access to an API? Or any kind of direct export.

From Quick Base, we even talked with the support team over there. And the best thing that we could do was actually click through several of our projects and download all those into a SharePoint file.

So, once again, RPA proved a very viable solution, where you quickly able to set up an RPA process that was able to navigate all the different, quick based projects and create a great archive for us that saved literally hundreds of hours of clicking. So, a nice, successful, kinda, one-time use there. This is our investment management team. We deliver a lot of performance reports out of this team. And it contains a lot of key details placed across PDFs.

It combines data from our brokerages that we work with as well as, you know, key operational data around the companies in an investment shops.

So creation of those PDFs is very, you know, robust and contains a lot of data.

So we used to have a manual QA process that it was very time consuming and also didn't quite satisfy the need. So we actually built RPA to do all that QA process.

Um, automatically, this is where Abby came in and, and because we couldn't get at the raw data for a variety of reasons, this was a multi-year elephant in the room. We have that we can't get the raw data files from the brokerage.

We need to manually QA or PDFs, so that's why we would, you know, pick a sample before, and look at a few documents, just to make sure the logos are in the right place, and the addresses right. And comparing it to information on the internet, and all this stuff. Which often, you know, didn't capture the ones that we didn't check. And even some of the ones we ..., it was, again, a very manual effort, and wasn't super effective. So, now, RPA slash UAs All those documents, and much faster time, and we have now experienced fingers crossed zero issues since RPA went into play as far as these PDF deliveries and hearing back from any of the investment.

Uh, shops that we work with, that, they have something out of place, logos dated, or even we need to rerun the PDFs, which can be quite costly.

So these are just a few examples, but I want to talk now, a little bit about, you know, why, why establish controls, strict governance for RPA?

We really want to take advantage of a lot of the opportunity within our financial reporting processes.

With Oracle, working with that quote to cash process I mention, that was a little stitch effort, that at a separate, kinda, we comply with regulations when we're just kind of merging data in Salesforce.

But when we really wanted to get into touch points that hit our building, or hit our contracting, or invoicing what have you tax, we needed to be sure that RPA and the whole process and setup, we have the sox compliance. This also minimizes any risk of an authorizer on intended actions.

Whether we're socks compliant or not, we don't want anything, you know, finding its way into our RPA process that shouldn't be there, including unauthorized no employee access, but also we don't want the bots to be doing things that they're not supposed to do. So this implemented some very kind of strict sign off processes, which I will talk about now. So, really three big areas with IT controls, and, and this was a learning process for our team, of being a Quality Team. That's, for the most part, been metric, dashboard focused.

Prior to setting up RPA, We've set up servers before and we've gone through a lot of the technical details with having a business intelligence platform.

And, and what some other areas of our team. But for the most part, a lot of this was new to us. So we unfortunately kinda got our, our process and systems set up before we got into socks controls.

So we had to do some, uh, back review and understanding as a group to get things started.

And we also, as our team, so as much as we had to educate our compliance team and our technical info security teams on what RPA is and how we're using it, they also needed to educate us on what the Sox controls are. And how is that going to impact what we've built RPA program to be.

A lot of that's around security administration, so administrators and, um, users actually having proper access to the bots. So, I think that first line, like an administrator, access to the servers and minaret administrator, access to any of the databases that are use, needs to be very vetted and reviewed regularly.

Same, what are users touching? How are users being approved by their managers that have access to the bots? And, of course, on the developer who has access to our studio licenses?

There's, of course, a big change management component, which has to do with, How are we testing properly in a non production environment?

How are we managing sign off after testing?

Are we making sure that what the bots been instructed to do is what the bots doing before we let it run loose?

And then finally, what, what, what availability of data is there?

So, a lot of discussion with our DR teams with our database experts and setting up backups as well as validation processes there.

Oops. So this is a kinda good overview of the process.

Just to give you a little bit of a flavor of, you know, where we've applied RPA but also going to our socks comes into play a little bit how our controls come into play.

So this is just a straightforward client, contract, billing, entry, process. This is actually something that, again, we have line of sight. I don't know when it will be in line of sight. Can always be carried forward, as we know.

But we have a line of sight to eventually being able to automate a lot of this manual data entry directly within Oracle and syncing with Salesforce data. We still don't have it available. So, the fact that we've been able to go live with this process has already saved us a ton of work on our Global Shared Finance Teams. And we actually just found out earlier this week, that a new business we acquired is also going to be leveraging this for completing their client contract billing entry. And there are three global analysts that are responsible for doing all this manual input, an upload and review.

So we'll be able to save those folks to be able to do better activities on the finance side than just billing entry.

So what happens here is, as you can see, logging into Salesforce, there's a process to open up the billing form. And you gotta login to Oracle and transfer that information into Oracle via user submission. You're putting some information back and Salesforce.

And then there's a validator that has to review this is where our control is because this is a sox process.

That validator review and validator approval is very important to make sure that we're complying.

So when you look at where our finance came in, I don't have A a branded name here. I do like, the idea of putting names are on our bot, so that's something we may, We named our chatbot, but not an RPA bots yet, but they come in and they do those first five steps in sync very quickly.

Now, This was a long tail process to setup, but now that it's fully functional, it's, it's been super effective for our finance team.

And what you'll notice here is we actually didn't automate these last two steps, because we couldn't quite figure out, you know, how to make sure that there was that independent audit or review it. When the finance team came to us, they originally had this in their automation. But through our socks committee, and our discussions with the compliance and InfoSec teams, it was still necessary to keep this as a manual step and make sure that the bots weren't doing the same approval of the work that they were doing. So that we had appropriate segregation of duties, is the language that you'll hear there a lot.

Let's take a look at this process and how it actually was impacted by those socks controls even more, though.

So, when we connected the process owner with that RPA developer, they went through a series of things that kind of made this more compliance versus that security admin I talked about, that the access for the bot, the access for, for the user is actually all you access. for the developer. I'm sorry. So the developer. The bot, that user, and it all now been reviewed. So we know that they have proper access to the right people to be set up. And it's done on a quarterly basis. Now, as well. All the passwords that are being used for this process in any process now comply with standards.

So we have corporate standards for passwords and and as you know, not all systems are set up to comply with those standards. So whenever we're using RPA we have to make sure that that's in place.

So, making sure that it has the correct, correct number of characters and, and setup, as well as that, it's refreshed on the required frequency.

And, of course, like, source code is now reviewed and restricted to the appropriate developer. So, there's only Fire Call access So that, there's no, there's no access given to developers that they shouldn't have.

On the change management side, we know detected monitoring in place that ensures that there's owner, sign off before production. And how we did that is we set up everything in jira.

Will use jira Lot were Atlassian consumer and our jira project really contains all the details around a process for when it's first identified to win.

It makes its way into production. And there's obviously a lot of fields in there that help indicate what the process is, how it's going to be used with the owner is what some of the key dates are. But there's also a big sub task process that we built. And sub task is important, for many reasons.

But when there's a QA sub task, it's very important, because signed off.

And QA has to be in place. So that we know that QA has been done on a process before the developer moves it to production, and QA cannot be done by the developer, of course.

So there has to be evidence that that testing took place, that the process owner approved the sign off and sent it into production. We were doing this loosely before Sox controls, but that's all very well co-ordinated.

And finally, the availability of data.

So as I mentioned before, everything that's done for this process now has backups in place, and those backups are tested annually. We've made sure that if there's any kind of PII or sensitive data in there, that it's properly encrypted or contained. And finally, that there is now a restore process that we periodically test. So for that one process, you can see where these controls, you don't have a big impact.

one other thing I wanted to talk about is just how we're using RPA to aid in the execution of these controls.

And I've listed a few processes here, but it's really great to see that as we have to build these controls in, and our RPA team is thinking, oh, we have to do all this, to check access Center, you know, make sure that we're understanding password updates. And monitoring changes in positions was also something we talked about. So, when someone changes positions, what kinda Blag is there to know that?

No, that is not the user that should have access to their bot anymore. You know. We need to quickly work with that team, let the team know that hey. You need to give someone else access to the bot, because that person is no longer on your team and shouldn't have access.

We also automated, looking at inactive employees.

That's kind of a duplicate check, because when you're inactivated, you don't have access to the network, but still making sure that their access to RPA has been shut off, just to be sure.

And even when we have to do our quarterly access review comparisons, there's a lot of exporting out of Orchestrator in jira and comparing, and showing to not only our internal compliance team, but even KPMG and the auditors that we have done. A quarterly review of all users and made sure that everyone that has access and is using the Orchestrator was approved by their manager through our approval process.

It's a lot of RPA helping us and getting this done.

And of course, that kind of image, you see it making sure that passwords are reset.

We don't always have the technology available to do that quickly and effectively and making sure that it's, the alerts are going off to remind you a password, needs to change.

I wanted to close by sharing some key learnings both at the program level, but then the next slide on our.

Compliance and governance process.

So I've put a few notes here around. You know, I have a thorough vendor selection process, if you're just getting started with RPA. This is most applicable, but we're actually building a vendor selection framework for a lot of the tools we're looking at.

Right now, we're evaluating, if we can get a new project management tool to help us navigate some of our various projects, We're doing a lot of shared 365 spreadsheets and and we navigate through Confluence, wiki, setup, and jira.

But we're looking for something that can kind of sit above those applications and allow us to better share project plans, checklists, dependencies, risks, dashboards, vendor selection process for things like that. And other, any other tool we're trying to adopt. You know, we've just kinda got a three step process. Well, first long listing or your top vendors.

We use Gardner a lot to do that, and we definitely leveraged Gardner kept era when we're looking at the UI or a RPA vendor, but then doing a proof of concept. We actually did a proof of concept with two RPA vendors before we selected UI path, and then moving onto that final selection, and then working through onboarding, support, licensing.

I'm always big on, start small, build excitement. This is true, I think, for Lean to, right?

You start a Lean project and you see some success, you get some, some buzz around it, You show some results, and then you start to build bridges among teams. You know, we're a big facilitation team globally across all teams. We have our directors, like myself that are connecting with all the key leaders and their team members, to make sure they understand that these tools exist, and, and how they should be used. And how other teams and people have been successful with them.

Partner with technology, I can't emphasize this a month. Emphasize this enough because as soon as you start going, it becomes fun to say, Let's RPA this, let's RPA that.

But you kinda maybe, depending on who's managing all of this, you may be leaving technology out of the discussion.

Or, not always, but in some areas, you have to make sure you are all about managing. Those tradeoffs. I talked about earlier.

Do we do it in the system of record, or, or do we do it elsewhere, keep track of technology, decisions, any future dev that will impact RPA and we do that in jira. So, you know, it's like like that Oracle process. We're going to eventually. They will automate it.

So we have a record of that so that we can make sure that we're thinking that through and when that time comes, You know, eventually sunsetting the RPA project, which I think will be later rather than sooner. But, but we'll see.

And then, finally, engage leadership while working through Teams. You encourage automation, tied to performance, goal of the Thai lean to performance goals too, which is all a little easier said than done. But it can be very effective. And having teams obviously focus their efforts here.

Share successes.

I have one final note here, look outside for out like these conferences are great. You're all here, you're learning.

I learned to, and I love to hear from others about other, doing their RPA program, both live and virtual conferences and partner with your vendor. I put a few snippets here about ways that actually prior to the pandemic we at UI Path come in and do an awareness session in the evening. We even got a section of key leaders to come in, and even though we don't do development in the US. We had some key leaders in our central headquarters. Come in and do some practice development. And we even encourage going on your personal computer, not your Morningstar computer, if you want to download UI path and or any RPA software. But we work with UI path, and play around with their remodel.

Some UI path has some great, like, code that you can just implement, like remind you about birthdays and some fun, personal stuff you can play around with. But we did that together in a design session.

And then, finally, you see, we had a RPA fair championships, so this is just one example.

We'd love to share successes on our Yammer groups and posts on our internal website, talk about the teams that are implementing RPO, even at a fair compact, the little kind of competition in our cafeteria. Where we shared RPA processes and even had laptops available for people to see the bots work.

Finally, governance controls, some things to think about when you're implementing governance and applying controls, think early, you know, we got wheat started a little late.

We're gonna run it with RPA before we really got into the socks controls, if you have centralized development and we'll make it a little easier, you know, use service accounts so that you can have the bots clearly identified and and have access to, you know, multiple different applications for a team.

Talk governance from the outset in your program, We loosely talk that would've went back and said, Guys, we need to set up some stuff here. Early, but it's a learning for us. Leverage experienced knowledge from other teams and we have a corporate systems team that has socs around.

Salesforce and Eloqua are Oracle and and some of the key financial applications.

So, so learn from them. See what can be achieved internally. A lot of teams or companies might go outside for help and kind of establishing a governance program. You might be surprised at what you know internally.

So always make sure you're, um, betting your internal resources as best as possible and then, Empower Anarchy architect. I think that really helped us that we have one dedicated role responsible for governance. that was really kind of putting the pieces together and making sure that we have things effectively documented. That was a key role in us getting to where we needed to be in.

In the time we were able to do it. And, and have the Teams own prioritization reviews, sign off, it's their processes, it's their work, it's their teams, build committees help facilitate that, proper ownership and accountability. And partnership with our team.

And you'll be a lot more in sync and able to make sure that issues and gaps are resolved quickly.

So, I think that's it, I went a little fast, because I know we had some, some technical issues.

I don't believe we have time for Questions now, but, but hopefully, that gave you a little bit of flavor of what we're doing and where we're at right now, and maybe some ideas how to apply it in your area as well.

Marco, always an incredible journey for RPA implementation done as a best in class approach, a process based approach upfront with clear governance, with clear accountability and ownership. And then building the technology platform on top of it to really allow technology to increase value for, for customers, force, for stakeholders within the organization. Always, when you present you this, you do such a great job in sharing those insights. So thank you so much again for sharing that expertise with us today and we're grateful to have you with us.

My pleasure, good luck everyone. Thank you for having me.

Take care.

Daycare. Ladies and gentlemen, that was Margaret Chmura, Morningstar, Financials, world-class implementation of RPA.

Look at the presentation replay when you get the link next week. It's best in class on how technology is applied in a system that where processes are clearly understood, where ownership is clearly identified there, is governance in place for the technology, then to give you the best possible results. Wonderful presentation, and we're going to have another great one is starting just a few minutes, at the top of the hour, we're going to have the leader for digital of going digital in the government sector. We're going to have the Director of Department of Consumer and Regulatory Affairs talking to us about going digital to enhance the customer experience. So he started with real estate, We move into financial services, and we're gonna go now into government and regulatory. So, I'll see you back soon, at the top of the hour.