Northbridge Insurance: RPA business case, bot controls and an unrealistic deadline
Northbridge Insurance writes commercial policies through 26 broker and carrier accounts. A team of 14 reconciles premium, commission and claims cash, spending about 22,000 hours a year. Last year reconciliation errors produced £410k of write-offs, and the month-end cycle takes six days. One analyst holds most of the undocumented logic for the largest broker account. A vendor has proposed robotic process automation for 11 rules-based activities: £260k of licence and £180k of implementation, with an expected 60% reduction in effort. One of the 11 processes, broker commission reconciliation, is being renegotiated with the three largest brokers and may be replaced by a net settlement arrangement. IT has a seven-month backlog before bot infrastructure and a controlled environment can be provided. Internal audit has asked how bot changes would be authorised and evidenced. The operations director has told the CFO she wants 'the 14 roles gone by December'.
1. Evaluate the RPA proposal on its merits. Should the CFO approve it as presented?
Read the worked answer
What the numbers actually say
- 22,000 hours × 60% = 13,200 hours released. At roughly 1,500 productive hours per FTE, that is about 8.8 FTE of capacity - not 14 roles.
- Investment is £440k before run costs. If the £260k licence is annual, payback depends on loaded staff cost and on how much of the released time is actually removed rather than absorbed.
- The £410k of write-offs is the stronger part of the case, but errors are usually concentrated in exception handling, which is exactly where a bot helps least.
Reasons not to approve as presented
- Scope is overstated. Automating 11 activities assumes all 11 survive. Commission reconciliation should be carved out until the net settlement negotiation concludes - automating a process that may disappear is pure waste.
- Timing is not credible. A seven-month IT backlog plus build and testing means little production before month nine. 'Gone by December' cannot be delivered.
- Re-engineering has not been attempted. Standardising the 26 account formats and removing duplicate steps may cut more effort than the bot, at lower cost and risk.
Recommendation
Approve a phased pilot: three stable, high-volume activities in a controlled environment, with a gate review at month five against cycle time, exception rate and hours released. Approve capital only for the pilot; release the rest on evidence.
2. Internal audit has asked how bot changes would be authorised and evidenced. Set out the control framework Northbridge should put around the bots.
Read the worked answer
Identity and access
- Each bot has its own named account and credentials - never a shared human login - with least-privilege access to only the systems and fields it needs.
- Bot credentials are held in a vault, rotated, and disabled when a bot is retired.
Segregation of duties
- The developer who builds a bot cannot also approve its release or run it in production. Business process owner, developer and approver are three different roles.
- Bots that can raise or release payments are subject to the same dual-authorisation rule as humans.
Change control and evidence
- Every change is versioned, tested in a non-production environment, signed off by the process owner, and logged with date, author, reason and test evidence.
- Bots write an immutable log of every action taken, with input values and outcome, retained to audit-committee standard.
Exception handling
- Bots stop and queue exceptions for human review rather than forcing a match. Define the exception tolerance and who clears the queue.
- A daily control total reconciles bot output back to source systems; unresolved breaks escalate within 24 hours.
Ongoing assurance
- Business owner accountable for each bot; KPIs for success rate, exceptions, cycle time and downtime.
- A documented manual fallback if a bot fails, and an annual independent review of bot access and change logs.
3. How should the CFO handle the operations director's demand that all 14 roles disappear by December?
Read the worked answer
Separate the goal from the date
The goal - lower cost and fewer errors - is sound. The date and the headcount figure are not supported by the evidence: the effort saving is roughly 60% of activity, the infrastructure is seven months away, and one process is under renegotiation. Accepting both the date and the number commits the CFO to something the organisation cannot deliver, and the failure will be attributed to finance.
What to do instead
- Reframe in activity terms. Agree a target such as 'reconciliation effort down 45% and write-offs down 70% within 18 months', with the headcount consequence worked out as capacity is actually released.
- Use natural attrition. The team will lose people anyway; a hiring freeze plus redeployment avoids compulsory redundancy and protects the undocumented broker knowledge.
- Extract the key-person risk now. Have the senior analyst document the largest broker's logic, formally, before any automation. It is needed for the bot specification and for the net settlement negotiation.
- Give the team a destination. Redeploy several analysts into exception handling, broker data quality and the settlement project. Automation that is seen as a redundancy programme invites passive resistance and concealed workarounds.
- Publish the gate review honestly. If the pilot releases fewer hours than forecast, say so early. An overstated benefit discovered late damages finance's credibility with the board more than a revised forecast does.