Original Research

A conceptual governance framework for managing robotic process automation implementation challenges in insurance claims handling

Lee-Ann Pietersen, Teboho D. Lefela, Christiaan Lamprecht

Received: 18 Feb. 2026; Accepted: 05 June 2026; Published: 06 Aug. 2026

Copyright: © 2026. The Authors. Licensee: AOSIS.
This work is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) license (https://creativecommons.org/licenses/by/4.0/).

Abstract

Background: Although insurers increasingly adopt Robotic Process Automation (RPA) to improve efficiency and accuracy in insurance claims handling, implementation projects may fail when information flows, data practices, technical capabilities and operational processes are poorly governed (hereinafter challenges). These challenges can create misalignment between business and information technology (IT) objectives and limit the sustained value of RPA initiatives.

Objectives: Building on prior research that identified key RPA implementation challenges, this study developed a theoretically informed governance framework to assist insurers in governing and managing RPA within the insurance claims-handling process.

Method: This study adopted a qualitative, non-empirical research design informed by a structured literature review. Governance guidelines were developed based on insights from the literature and mapped to the Control Objectives for Information and Related Technologies 2019 (COBIT 2019) governance and management objectives to ensure completeness and depth. The COBIT 2019 framework was used as a structuring mechanism to operationalise theoretical principles into actionable governance practices.

Results: The resulting conceptual framework integrates theoretical lenses from IT governance, data governance and IT capability theory to address the challenges of RPA implementation. The framework provides a structured tool for identifying and managing RPA-related challenges in insurance claims handling.

Conclusion: The study demonstrates that effective RPA implementation requires governance mechanisms that extend beyond strategic considerations to address detailed technical and operational challenges.

Contribution: This study contributes to the literature by offering a theoretically grounded governance framework for managing RPA in insurance claims handling, supporting improved alignment, accountability and control over automation initiatives in information-intensive processes.

Keywords: claims-handling process; COBIT 2019; data governance; digital process automation; information management; insurance industry; IT governance; robotic process automation.

Introduction

The global general insurance sector has experienced accelerated growth since 2020, with a market size of approximately $5.94 trillion as of 2022 (Tasdemir & Alsu 2024). In today’s insurance environment, effectively assessing and handling claims risk is crucial for maintaining financial stability and enhancing operational efficiency (Surya et al. 2024). In doing so, insurers rely heavily on the efficiency and effectiveness of the claims-handling process to manage customer satisfaction and increase their competitive advantage in the insurance industry (Yusuf, Ajemunigbohun & Alli 2017).

The claims-handling process represents an information-intensive operational environment. Enhancing the speed, accuracy and quality of this process not only reduces administrative costs but also decreases the risks to which insurers are exposed, thereby improving service excellence and strengthening customer trust (Yusuf et al. 2017). To achieve these objectives, insurers increasingly employ digital technologies to streamline and automate repetitive administrative tasks and optimise the claims-handling process. Yusuf and Ajemunigbohun (2015), however, warn that the modernisation of the claims-handling process is not as simple as it seems, owing to its high degree of integration within an insurance organisation, which increases risks and complexity. Improving the governance of robotic process automation (RPA) in claims handling is important because claims performance directly affects customer trust, financial stability and operational resilience within insurers.

One of the most promising technologies for optimising claims-handling administrative processes is RPA (Lamberton, Brigo & Hoy 2017; Madakam, Holmukhe & Jaiswal 2019). As an information-driven automation technology, RPA fundamentally reshapes how information is captured, processed, validated and acted upon across multiple systems within the claims-handling process. Robotic process automation utilises software robots to automate rule-based tasks that are typically performed by humans, interacting directly with existing systems and applications within an organisation without modifying their underlying code (Lamberton et al. 2017; Madakam et al. 2019). Within the insurance claims-handling process, RPA typically automates repetitive tasks such as data collection, claims validation and payment processing, thereby reducing the time required and improving accuracy (Smit 2009).

Despite their potential benefits, an estimated 30% – 50% of these RPA projects fail to scale or are abandoned after pilot implementation (Lamberton et al. 2017, as cited in Sigurðardóttir 2018). This high failure rate highlights the importance of robust governance processes in one of the most critical functions of an insurer: aligning automation projects with organisational objectives and risk appetite. Lessons from past crises, such as the global financial crisis, underscore the need to redesign corporate governance to manage information technology (IT)-related risks in financial services, including insurance (Hilb 2011).

Prior research identifies the alignment of IT and business objectives as a key factor in achieving technology success (Goosen & Rudman 2013). When this alignment is not achieved, challenges arise from miscommunication between business expectations and the delivery of technological services (Goosen & Rudman 2013; Smit 2009). These challenges frequently arise in RPA projects, including inadequate ownership, weak data governance, insufficient change management and a lack of accountability (Syed et al. 2020).

Although RPA is no longer a new technology, unresolved implementation bottlenecks continue to limit the value realised from RPA projects, particularly where organisations lack process standardisation, clear ownership, sufficient change management and appropriate governance structures (Eulerich et al. 2024; Osmundsen, Iden & Bygstad 2019; Syed et al. 2020). For insurers, these bottlenecks may create significant opportunity costs, including unrealised efficiency gains, continued reliance on manual processing, fragmented automation efforts, weak exception handling, inadequate audit trails and increased compliance exposure (Hong, Ly & Lin 2023; Lamberton et al. 2017; Yusuf & Ajemunigbohun 2015). The governance issue is therefore not whether RPA is technologically novel, but whether insurers have the governance mechanisms needed to integrate, monitor and sustain RPA within information-intensive claims-handling processes.

While RPA governance research has grown, existing work has largely emphasised business-level governance, including strategic alignment and operational change, with limited attention to technical, data and operational IT governance mechanisms in claims-handling contexts where many RPA project failures originate. Consequently, building on prior work that identified key technical, data and operational challenges (hereinafter challenges) using the Control Objectives for Information and Related Technologies 2019 (COBIT 2019) governance framework (Pietersen, Lefela & Lamprecht 2025), this study considers the challenges arising during the implementation of RPA in the insurance claims-handling process and develops governance framework to address them systematically.

These challenges are particularly pronounced in emerging-market insurance contexts, where legacy systems, fragmented data architectures and regulatory complexity increase the information management burden associated with automation initiatives. The governance framework developed in this study aims to assist those charged with governance – including IT managers, internal auditors and executives – in identifying, prioritising and managing the governance challenges associated with RPA in the insurance claims-handling process, while guiding them in strengthening governance of RPA projects, improving alignment between business and IT objectives and ensuring that these projects achieve their intended benefits while managing associated challenges.

The development of the governance framework in this study is theoretically grounded in the IT governance theory, which emphasises the allocation of decision rights and accountability mechanisms to align IT activities with business objectives (De Haes & Van Grembergen 2009; Weill & Ross 2004), while also drawing on data governance theory, which highlights the importance of data ownership, quality, integrity and accountability (Khatri & Brown 2010), as well as the IT capability theory, which positions governance mechanisms as dynamic organisational capabilities that enable firms to adapt to technological change (Pavlou & El Sawy 2010).

Considered from an information management perspective, these theories collectively explain how decision rights, data accountability and organisational capabilities shape the effective management of information-intensive automated processes. Furthermore, these theoretical perspectives collectively inform the structure of the proposed governance framework, which integrates them using COBIT 2019 as the organising mechanism – a structured approach that incorporates core IT governance principles for aligning, planning, implementing and monitoring governance activities across the IT lifecycle (De Haes et al. 2020). By applying COBIT 2019 to RPA implementation in the insurance claims-handling process, this study illustrates how governance mechanisms can be designed to manage challenges specific to automation in the insurance industry, resulting in a framework that not only serves as a conceptual governance tool for insurers but also a theoretically informed model that integrates the IT governance, data governance and IT capability theories within the RPA context.

The preceding discussion has highlighted both the strategic importance of RPA in insurance claims handling and the persistent governance gaps that limit its value. To develop a robust conceptual governance framework, it is first necessary to systematically examine the existing body of knowledge. The following literature review, therefore, synthesises current understanding of the insurance claims-handling process, the application and challenges of RPA in insurance, the relevant theoretical foundations (IT governance, data governance and IT capability theory) and the COBIT 2019 framework that will serve as the organising mechanism for the proposed governance model.

Literature review

The insurance claims-handling process

The insurance claims-handling process is central to insurers’ operations and directly influences financial performance, customer satisfaction and market competitiveness (Yusuf et al. 2017). The insurance claims-handling process consists of four distinct phases, namely logging, validation, adjudication and payment (Mannix & Sethuraman 2020), which requires coordination between multiple departments, systems and external stakeholders.

The process is initiated by the insured party lodging a claim with the insurer. Once the claim is lodged, the insurer validates it by conducting a thorough investigation to verify that the insured party has an up-to-date membership with the insurer and is eligible to claim for the specific occurrence, among other factors. After a claim is validated, the insurer’s financial responsibility is adjudicated, and a decision is made on whether to pay the insured party. The insurance claims-handling process concludes with payment to the insured party (Yusuf & Ajemunigbohun 2015). These phases show that claims handling is not a single administrative task but rather an information-dependent process in which data must move accurately and timeously across several decision points.

Historically, these processes were manual, requiring extensive human involvement in data input, claim verification and communication (Yusuf & Ajemunigbohun 2015). Manual processing, however, is labour-intensive, time-consuming and can lead to human error (Hartmann 2018). Consequently, many insurers have started using computerised systems for the claims-handling process, which digitalises certain functions such as data storage, policy retrieval and mathematical calculations (Eling, Nuessle & Staubli 2022; Hartmann 2018; Tkaczyk et al. 2018; Yusuf & Ajemunigbohun 2015). However, the literature also suggests that computerisation and automation should not be treated as equivalent. Computerised systems may improve discrete functions, whereas automation requires greater standardisation of inputs, rules, exceptions and system interactions across the end-to-end process (Eling et al. 2022; Mannix & Sethuraman 2020; Syed et al. 2020; Tkaczyk et al. 2018).

Although these systems improve process efficiency, they still rely heavily on human involvement for claim validation and decision-making. This creates challenges in automating end-to-end processes (Mannix & Sethuraman 2020), and highlights the need for effective governance.

From a governance perspective, precise control and accountability structures are required when transitioning from a manual to a computerised system, as errors or inefficiencies in the claims-handling process can lead to reputational damage, fines and penalties, and financial losses (Yusuf & Ajemunigbohun 2015). Consequently, the claims-handling literature provides the operational rationale for this study: automation may improve efficiency, but only if the underlying information flows, decision points and accountability structures are adequately governed. This position claims handling as a suitable context for examining RPA governance because the value of automation depends equally on technological capability and the governance of the information environment in which the technology operates.

While these studies collectively affirm the information-intensive nature of claims handling and the limitations of manual and partially computerised processes (Eling et al. 2022; Mannix & Sethuraman 2020; Yusuf et al. 2017), they remain largely descriptive and pay limited attention to the governance structures required to support end-to-end automation. Most notably, the literature highlights process standardisation and data accuracy as prerequisites for successful digitalisation yet rarely examines how fragmented accountability across departments exacerbates these issues in practice. This gap underscores the need for a governance lens when moving from computerisation to full RPA-enabled automation.

Robotic process automation in the insurance industry

Robotic process automation enables software robots to execute rule-based, repetitive tasks across existing systems and applications without requiring extensive system integration or changes to the existing code (Lamberton et al. 2017; Madakam et al. 2019). In insurance claims handling, this makes RPA suitable for activities such as capturing claims information, verifying policyholder details, cross-referencing documents and initiating payments (Eling et al. 2022; Lamberton et al. 2017). However, the maturity of RPA as a technology does not eliminate implementation risk. This creates a tension in the literature: RPA is often presented as a relatively accessible automation technology, yet its implementation depends on organisational conditions that are considerably more complex than the technology itself.

Although the literature consistently highlights RPA’s potential to deliver efficiency, accuracy and cost reductions in claims handling (Eling et al. 2022; Guo et al. 2025; Lamberton et al. 2017; Madakam et al. 2019), a more critical reading reveals important tensions. Early studies tend to be optimistic and technology-centric, emphasising RPA’s non-invasive nature and ease of implementation. In contrast, more recent empirical and case-based research (Eulerich et al. 2024; Flechsig, Anslinger & Lasch 2022; Osmundsen et al. 2019; Syed et al. 2020) paints a more cautious picture, demonstrating that the high failure and abandonment rates (30% – 50%; Sigurðardóttir 2018) stem primarily from organisational and governance deficiencies rather than from technological shortcomings. These studies converge on several recurring challenges, namely process standardisation, data quality, system integration, change management and accountability, yet they differ meaningfully in emphasis and depth. For instance, Osmundsen et al. (2019) stress the need to balance centralised control with local process ownership, while Syed et al. (2020) offer a broader taxonomy of implementation barriers, including organisational readiness and skills gaps. Eulerich et al. (2024) contribute a valuable risk-management perspective, highlighting operational and control risks that earlier work largely overlooked.

A common limitation across this body of research is its predominantly general or cross-industry focus; few studies provide deep insurance-specific or claims-handling insights (notable exceptions being Lamberton et al. 2017 and Mannix & Sethuraman 2020). Moreover, most stop at identifying barriers without proposing integrated governance responses tailored to information-intensive processes. This gap is particularly relevant in insurance claims handling, where automated processes depend on policy data, claims documentation, validation rules, legacy systems and exception handling (Eling et al. 2022; Lamberton et al. 2017; Yusuf & Ajemunigbohun 2015). These studies, considered together, indicate that the central issue is no longer the definition of RPA, but the governance of its integration into complex, information-intensive business processes. They therefore informed the conceptual framework developed in this study by highlighting the need for governance mechanisms addressing process architecture, data quality, access control, capability development, change management and monitoring.

Considered collectively, the literature reveals that RPA implementation failures in insurance claims handling stem less from the technology itself than from insufficient governance of the information-intensive environment in which it operates. Addressing these challenges requires a deeper understanding of the underlying theoretical foundations that can guide effective governance. The next section, therefore, examines three complementary theoretical perspectives, namely IT governance, data governance and IT capability theory, that together provide the conceptual lenses through which a structured governance response can be developed.

Theoretical perspectives: Information technology governance, data governance and information technology capability

Good governance practices are essential to ensure that digital transformation initiatives align with both strategic and operational objectives and deliver sustainable value (Delagrammatikas, Stelios & Tzavaras 2025; Weill & Ross 2004). The governance mechanisms required to align RPA projects in the insurance industry are rooted in IT governance, data governance and IT capability theories.

Information technology governance theory provides the foundational structures and processes that help define decision rights and accountability between the business and IT (De Haes & Van Grembergen 2009; Weill & Ross 2004). Effective IT governance promotes strategic alignment, performance measurement and risk management, ensuring that investments in technological advancements contribute directly to organisational goals (Weill & Ross 2004). In the context of RPA, IT governance theory is therefore useful because it explains how decision rights, accountability structures and alignment mechanisms shape whether automation initiatives remain connected to organisational objectives.

Data governance theory extends this focus by addressing the rules, responsibilities and processes that ensure data availability, quality and integrity (Khatri & Brown 2010; Volz et al. 2025). In RPA implementation, data governance determines how data are captured, validated and secured – a critical concern in automated environments where low-quality data can have a detrimental impact on the project’s outcome (Dogan et al. 2024; Guo et al. 2025). Proper data governance mechanisms, therefore, ensure compliance, traceability and reliability, all of which are essential to the success of RPA projects. This perspective is particularly important in claims handling because RPA does not create value from automation alone but rather when the underlying data are sufficiently accurate, accessible, controlled and traceable to support automated processing.

Finally, IT capability theory extends these perspectives by seeing governance mechanisms as dynamic organisational capabilities that enable organisations to identify opportunities for technological innovation, learn from experience, and reconfigure IT and process resources to respond to changes within the organisation or its environment (Pavlou & El Sawy 2010; Weritz et al. 2025). From this perspective, effective RPA governance reflects the insurer’s ability to implement mechanisms that coordinate people, processes and technologies to create value from automation.

The three theories are complementary to one another. Information technology governance theory explains who should make and monitor automation-related decisions; data governance theory explains how the information used by the automated processes should be controlled; and IT capability theory explains how insurers develop the organisational capacity to implement, maintain and adapt RPA over time (Khatri & Brown 2010; Pavlou & El Sawy 2010; Weill & Ross 2004). This distinction is important because RPA implementation failures can occur even when a single dimension is addressed. For example, a project may be strategically aligned but still fail because data quality is poor, or it may have adequate data controls but lack the skills and routines needed to maintain bots after implementation (Dogan et al. 2024; Osmundsen et al. 2019; Syed et al. 2020).

Combining these three theories provides a multidimensional foundation for understanding and developing a governance framework for implementing RPA in the insurance industry, ensuring sustainable value creation through effective risk management. Notably, few prior studies have synthesised these three perspectives in the context of RPA, particularly within highly regulated, information-intensive sectors such as insurance. The theoretical contribution of this study, therefore, lies in integrating these perspectives into a single governance logic: alignment and accountability from IT governance, information integrity and control from data governance and adaptive implementation capability from IT capability theory. Figure 1 illustrates the conceptual model.

FIGURE 1: Conceptual model.

Figure 1 illustrates this integrated conceptual model. While the three theories offer a strong conceptual foundation for understanding why governance is needed, they do not prescribe how these principles should be operationalised in practice. The following section, therefore, bridges theory and practice by introducing COBIT 2019 as the structuring mechanism that translates the theoretical constructs of alignment, accountability, data integrity and organisational capability into concrete governance and management objectives suitable for RPA implementation in insurance claims handling.

From theory to practice: The Control Objectives for Information and Related Technologies 2019 governance framework

While the governance theories discussed above offer conceptual insights into how organisations should align technology with strategic objectives, COBIT 2019 provides a practical structure for operationalising these principles. Control Objectives for Information and Related Technologies 2019, the latest governance framework published by Information Systems Audit and Control Association (ISACA), provides a holistic approach to IT governance (Thabit, Ishhadat & Abdulrahman 2020).

The framework is organised into domains and governance objectives that support alignment between business and IT, value delivery, and effective risk management (ISACA 2018). The framework is known to be flexible, allowing organisations to tailor governance practices to emerging technologies, making it suitable for addressing the risks and governance challenges that arise from RPA implementation. In this study, COBIT 2019 is used as a guiding framework to synthesise the governance challenges identified in the literature and to develop appropriate governance mechanisms to address them.

The COBIT 2019 framework, therefore, serves as a bridge between theory and practice by addressing the principles of IT governance (alignment and accountability), incorporating elements of data governance (information integrity and control) and advancing IT capability theory (the development of adaptable governance routines). Applying COBIT 2019 to the insurance claims-handling process enables the integration of these theoretical perspectives into a single, structured model to address the challenges posed by RPA implementation. In this way, COBIT 2019 provides the organising logic for the framework, while the literature and theoretical perspectives determine why particular governance mechanisms are relevant to RPA implementation in insurance claims handling.

In summary, the literature review has established the operational context of claims handling, documented both the promises and ongoing challenges of RPA, clarified the relevant theoretical foundations and identified COBIT 2019 as a suitable organising framework. With this conceptual and theoretical foundation in place, the next section will outline the research design and methodology used to synthesise the literature and develop the governance framework presented in this study.

Research design and methodology

This study follows a qualitative, non-empirical research design informed by a structured literature review. A structured literature review was chosen because it allows for the systematic identification, evaluation and synthesis of existing knowledge (Ivančić, Suša Vugec & Bosilj Vukšić 2019), while minimising selection bias and ensuring replicability – critical for developing a governance framework in emerging fields like RPA (Okoli & Schabram 2010). Rigorous and transparent synthesis of existing literature plays a critical role in information and knowledge management research, particularly in emerging and interdisciplinary domains characterised by rapid growth and fragmentation. Such approaches support the identification of prevailing themes and research gaps while reducing selection bias and enhancing methodological integrity (Rensleigh 2025).

Building on the structured literature review approach in prior work that identified RPA challenges in insurance claims-handling (Pietersen et al. 2025), this study’s literature review provides an understanding of the existing research on the insurance claims-handling process, RPA technology and IT governance, extending the scope to include governance mechanisms and theoretical integration to help with the development of the governance framework.

The three steps as recommended by Ivančić et al. (2019) were followed to conduct a rigorous and structured literature review, starting with: (1) a definition of the review protocol, searching and collection of relevant publications, followed by (2) a quality evaluation of the publications to narrow them down to relevant publications to be used, and (3) qualitative analysis and synthesis of the publications that made it through the selection process. To improve transparency and replicability, the search and selection process was documented using a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA)-informed flow process (Page et al. 2021), although the review was not designed as a full systematic review or meta-analysis. The literature search and selection process is summarised in Table 1.

As per Ivančić et al. (2019), step 1 involved identifying relevant literature using academic databases, including Scopus, ScienceDirect, Emerald Insight and Google Scholar. The primary search string was ‘robotic process automation’, supported by targeted combinations of the primary search string with the terms ‘governance’, ‘insurance’, ‘claims’, ‘implementation challenges’, and ‘COBIT’. The initial search yielded 149 results. Furthermore, to ensure rigour, a review protocol was established, defining inclusion criteria (e.g. have ‘robotic process automation’ explicitly in the title, be published between 2009 and 2025, be scholarly journals, articles or conference papers, and be written in English with full access available) and exclusion criteria (e.g. duplicates, articles published before 2009, non-English publications, book chapters and professional papers, and articles where ‘robotic process automation’ was cited in a different context were removed).

A review log was maintained during the identification and screening process. The log recorded the title, author(s), year, abstract, publication type, database or source, screening decision, and, where applicable, the reason for exclusion. This log was used to remove duplicates, assess relevance and support traceability between the reviewed literature and the challenges and governance mechanisms identified in the study. Following the deduplication process, 76 publications passed the initial screening process.

During step 2, the evaluation phase, the 76 publications were screened and selected for relevance to RPA implementation and governance, with an emphasis on peer-reviewed journal articles, conference papers and professional reports published between 2009 and 2025. Screening involved an initial title and abstract review for topical fit, followed by a full-text assessment of quality (e.g. methodological soundness, empirical evidence and alignment with RPA), culminating in synthesis (Okoli & Schabram 2010), as described in step 3 below. After the evaluation phase, 42 sources remained, forming the final list that informed the research question.

Finally, in step 3, the remaining 42 sources were synthesised to identify challenges, recurring themes and governance considerations related to the technical, data and operational dimensions of RPA governance in the insurance industry. The synthesis employed thematic analysis, grouping concepts into categories (e.g. process integration, data management) and cross-referencing with COBIT 2019 objectives to highlight gaps and inform framework development (Webster & Watson 2002).

To ensure structure and rigour in the development of the RPA governance framework, this study integrates the conceptual model in Figure 1, where RPA governance is positioned at the centre, supported by these three theoretical pillars, and leveraging the COBIT 2019 framework – with its emphasis on governance and management objectives – as a guiding mechanism to systematically identify, categorise and interpret the associated challenges, thereby informing targeted guidelines. A completeness check was performed by mapping synthesised findings back to COBIT 2019 domains to supplement any gaps with targeted searches.

The structured literature review and thematic synthesis described above, guided by COBIT 2019 domains, yielded a comprehensive set of RPA implementation challenges specific to the insurance claims-handling context. These challenges are presented and categorised in the following section. Articulating them explicitly is a necessary precursor to the subsequent development of targeted governance mechanisms, ensuring that the framework directly addresses the most salient risks identified in the literature.

Results

Governance challenges in robotic process automation implementation

While RPA projects offer significant potential for improving efficiency and accuracy in the insurance claims-handling process, several challenges have been identified in the literature that hinder their successful implementation. To ensure the appropriate alignment between business and IT objectives and the success of the RPA project, these challenges must be well understood by those responsible for governance. The identified challenges are numbered C01 through C16 and categorised into four recurring, interrelated themes: process and system integration, data management, operational capability, and operational IT governance and control. Table 2 summarises these challenges.

The challenges summarised in Table 2 indicate that RPA project failures in the insurance claims-handling process are not limited to technical challenges but also encompass weaknesses in governance, alignment and operational mechanisms. Process and data challenges emphasise the need for stronger standardisation, quality controls and mechanisms to improve integration. These principles are central to the IT and data governance theories. Furthermore, operational and governance-related challenges indicate that many insurers lack the capacity and accountability structures to implement RPA successfully. Together, these identified challenges reinforce the need for a holistic governance framework to address the challenges of RPA.

A piecemeal approach to address the challenges, as summarised in Table 2, is insufficient because RPA project failures arise from weaknesses across process integration, data management, operational capability and IT governance. The following section draws on the theoretical foundations and COBIT 2019 governance and management objectives to translate these challenges into a coherent set of actionable governance guidelines, thereby closing the gap between identified problems and practical governance responses.

Developing a governance framework to manage challenges

The identified challenges can be managed through governance mechanisms that strengthen IT and data governance, as well as operational control environments, for RPA projects in the insurance claims-handling process. To develop the framework, this study identified governance guidelines from the literature and mapped them to the relevant COBIT 2019 governance and management objectives.

This mapping ensured that the guidelines were structured and consistent with recognised governance practices. Control Objectives for Information and Related Technologies 2019 was not merely used as a general reference framework, but as an organising mechanism to translate the identified RPA implementation challenges into governance responses. Each guideline was therefore linked to one or more COBIT 2019 governance or management objectives to make the governance logic explicit. For example, enterprise architecture guidance was linked to the COBIT objective managed enterprise architecture, while process standardisation and automation suitability guidance was linked to managed requirements definition and managed solution identification and build. Guidelines on data architecture, privacy, logging and access control were linked to COBIT objectives related to managed data, managed security services, managed controls and managed security. Guidelines relating to change, configuration, capacity and availability were linked to COBIT objectives concerned with managed changes, managed configuration, managed availability and capacity, and managed operations.

In addition to the COBIT 2019 mapping, each guideline was linked to the theoretical perspective that informed its inclusion in the framework. Information technology governance theory informed guidelines concerned with decision rights, accountability, business-IT alignment, oversight and control. Data governance theory informed guidelines concerned with data ownership, data quality, privacy, access, integrity, traceability and monitoring. Information technology capability theory informed guidelines concerned with skills, organisational learning, technology enablement, knowledge transfer, adaptability and the development of repeatable automation capabilities. This dual mapping ensured that the framework was not only practice-oriented but also theoretically anchored in the governance and capability mechanisms required to manage RPA implementation challenges.

Following the initial mapping, a completeness check was performed, in which the COBIT 2019 objectives most relevant to RPA in the insurance industry were reviewed to identify any control areas not covered by the guidelines identified in the literature. Where gaps were identified, additional guidelines were formulated to align with the COBIT 2019 framework. The governance framework in Table 3 was therefore developed through an iterative process that combined literature-derived challenges, theoretical grounding and COBIT 2019 mechanisms to provide structured, literature-based guidelines for a governance response.

For clarity and traceability, Table 3 numbers the governance guidelines from G01 to G18 and identifies the origin of each guideline, indicating whether it was derived from the literature or through the COBIT 2019 completeness check. Table 3 also identifies the relevant COBIT 2019 governance and management objective(s) and the theoretical grounding for each guideline, thereby making the framework development logic more transparent.

To improve ease of use, the guidelines are grouped into five recurring governance themes that reflect how insurers would typically organise operational IT governance: (1) process and technology architecture, (2) data and information governance, (3) technology enablement and integration, (4) people and capability management, and (5) operational IT governance.

To illustrate the alignment between the identified challenges and the governance framework developed in Table 3, the guidelines were mapped to the specific challenges they address in Table 4. This mapping demonstrates comprehensive literature-based coverage of the governance framework, confirming that each identified challenge is mitigated by one or more COBIT 2019-aligned governance mechanisms. Table 4 also highlights how the controls are interconnected, as several controls mitigate multiple risks.

Table 4 illustrates the thorough scope of the conceptual governance framework, demonstrating that each identified challenge is effectively addressed by one or more governance mechanisms aligned with COBIT 2019. Furthermore, the table emphasises the interconnectivity of the controls, showing that several mechanisms contribute to managing multiple challenges, thereby reinforcing the framework’s robustness and efficiency. In line with the methodology, the synthesis of reviewed publications into key challenges and their subsequent mapping to recommended governance guidelines are illustrated in Figure 2.

FIGURE 2: Synthesised themes and related guidelines.

As depicted in Figure 2, the structured synthesis process transforms insights from the existing literature into a comprehensive set of challenges and tailored conceptual guidelines, providing a rigorous foundation for RPA governance in insurance claims handling. This approach highlights the interconnections between identified issues and proposed solutions, facilitating better alignment.

The governance framework presented above provides a structured, theoretically grounded response to the RPA implementation challenges identified in the literature. Before concluding, it is important to delineate the boundaries of the study and acknowledge its limitations. The following section, therefore, clarifies the scope of the framework and identifies avenues for future empirical validation.

Discussion

The study employs a structured literature review and uses the COBIT 2019 governance and management objectives to guide the integration of IT governance, data governance and IT capability theories. This study does not consider supporting technologies such as artificial intelligence (AI) and machine learning. Instead, the research focuses on RPA as a process automation tool and investigates how governance processes can be applied to manage the challenges introduced by implementing RPA in insurance claims handling.

The scope of this research is limited to the risks, controls and governance considerations associated with implementing RPA in the insurance industry, specifically focusing on the insurance claims-handling process. Consequently, it is not intended as a governance framework for managing risks associated with other digital technologies or the implementation of RPA in other industries.

As the framework was developed through a structured review and COBIT-informed synthesis rather than empirical testing, it should be interpreted as a conceptual and literature-based framework. Its practical effectiveness, completeness and applicability across different insurance organisations, RPA maturity levels and claims-handling environments require empirical validation in future research.

Conclusion

For insurance organisations, initiation of the claims-handling process has been identified as the critical moment in the relationship between an insurer and the insured party, when the insured party demands that the insurer fulfil the obligations set out in the contract. A well-crafted insurance claims-handling process provides insurers with a competitive advantage, as customers highly value it. It is therefore essential to ensure that the process is efficient, reliable and transparent. However, the process remains predominantly manual because it involves handling data from various systems in different formats. Some of this data has been identified as manual and unstructured, with inconsistencies that lead to longer processing cycles, higher operational costs and a greater likelihood of fraud. As a result, insurers have adopted technologies such as RPA to improve efficiency, accuracy and consistency in their claims-handling processes.

While RPA offers clear benefits to insurers, this study shows that many projects fail to scale due to ungoverned challenges stemming from misalignment among IT, data and business operations. To address these challenges, this research developed a conceptual governance framework grounded in IT governance, data governance and IT capability theories. The governance framework guidelines were structured around the governance and management objectives of COBIT 2019 as the organising mechanism. Using a structured, trusted governance framework ensured that the challenges and guidelines were detailed and well organised. Through a structured literature review and a subsequent completeness check using COBIT 2019, governance guidelines were developed, mapped to the identified risks and organised into five domains that reflect how insurers typically manage IT governance. However, because the framework has not yet been empirically tested, the findings should be understood as a conceptual contribution rather than as evidence of practical effectiveness across all insurance contexts.

This framework shows how different categories of RPA implementation challenges may be addressed through targeted governance mechanisms. Technical and process-related challenges are addressed through guidelines on process standardisation, enterprise architecture, suitability assessment of automation, legacy system evaluation and technology integration. Data-related challenges are addressed through data architecture, privacy management, logging, monitoring and access-control mechanisms. Operational challenges are addressed through people and capability management, stakeholder engagement, change management, configuration management, capacity management and availability management. In this way, the framework provides a structured basis for considering how insurers may strengthen governance over RPA implementation in the claims-handling process.

From a practical perspective, the governance framework may assist those responsible for governance and IT management in an insurance organisation to support the identification, appropriate planning and management of implementation challenges that arise when using RPA to automate the insurance claims-handling process. Furthermore, internal and external assurance providers can utilise this framework to assess the risks and controls that should be in place for this technology. However, its practical use should be interpreted as guidance rather than as a validated implementation model. Further empirical research is required to test the framework across multiple RPA projects, insurance organisations and automated claims-handling processes, and to refine the framework based on evidence from practice.

From a theoretical perspective, this study contributes to the literature by demonstrating how COBIT 2019 can be utilised to conceptualise governance responses to automation challenges at the technical, data and operational governance levels. Furthermore, data governance theory is extended to the RPA environment to demonstrate how data integrity, privacy and accountability requirements are applied in this context. Finally, the IT capability theory is reinforced, as the developed governance framework demonstrates that appropriate governance mechanisms can help an RPA project succeed by adapting to the broader environment rather than just addressing risks within the project.

The recommendation for further research is to test the governance framework across multiple RPA projects and automated processes, and to refine it based on the additional knowledge that emerges. Similar studies are recommended, including RPA-complementary technologies such as AI and optical character recognition (OCR), to assess the framework’s validity.

Acknowledgements

This article is based on research originally conducted as part of Teboho Lefela’s master’s thesis titled ‘What are the IT gap challenges that influence the failure of RPA automation projects for the motor vehicle accident claims handling processes?’, submitted to the Faculty of Economic and Management Sciences, Stellenbosch University in 2021. The thesis was supervised by Christiaan Lamprecht. The thesis was reworked, revised and adapted into a journal article for publication. The authors confirm that the content has not been previously published or disseminated and complies with ethical standards for original publication.

This article is based on data from a larger study. A related article focusing on Technical and operational governance challenges of robotic process automation in the insurance claims handling process has been published in Southern African Journal of Accountability and Auditing Research Vol. 27, No. 1. The present article addresses a distinct research question, focusing on managing RPA implementation challenges in insurance claims-handling.

During the preparation of this work, the authors used Grammarly, V1.2.232.1818, for language editing. The content was reviewed and edited by the authors, who take full responsibility for its accuracy.

The authors, Lee-Ann Pietersen, Teboho D. Lefela and Christiaan Lamprecht, declare that they have no financial or personal relationships that may have inappropriately influenced them in writing this article.

Lee-Ann Pietersen: Investigation, Project administration, Validation, Writing – original draft, Writing – review & editing. Teboho D. Lefela: Conceptualisation, Data curation, Formal analysis, Investigation, Methodology, Project administration, Validation, Writing – original draft. Christiaan Lamprecht: Conceptualisation, Methodology, Supervision, Validation, Writing – review & editing. All authors reviewed the article, contributed to the discussion of results, approved the final version for submission and publication, and take responsibility for the integrity of its findings.

This article followed all ethical standards for research without direct contact with human or animal subjects.

The authors received no financial support for the research, authorship and/or publication of this article.

The data supporting the findings of this study consist of publicly available documents identified through a structured literature review. All sources are cited in the reference list and can be accessed via standard academic databases, institutional repositories, or publicly available online resources. No primary data were collected, and no restrictions apply to the availability of the referenced materials.

The views and opinions expressed in this article are those of the authors and are the product of professional research. They do not necessarily reflect the official policy or position of any affiliated institution, funder, agency or that of the publisher. The authors are responsible for this article’s results, findings and content.

References