The insurance claims-handling process is central to insurers’ operations and directly influences financial performance, customer satisfaction and market competitiveness (Yusuf et al. 2017). The insurance claims-handling process consists of four distinct phases, namely logging, validation, adjudication and payment (Mannix & Sethuraman 2020), which requires coordination between multiple departments, systems and external stakeholders.

The process is initiated by the insured party lodging a claim with the insurer. Once the claim is lodged, the insurer validates it by conducting a thorough investigation to verify that the insured party has an up-to-date membership with the insurer and is eligible to claim for the specific occurrence, among other factors. After a claim is validated, the insurer’s financial responsibility is adjudicated, and a decision is made on whether to pay the insured party. The insurance claims-handling process concludes with payment to the insured party (Yusuf & Ajemunigbohun 2015). These phases show that claims handling is not a single administrative task but rather an information-dependent process in which data must move accurately and timeously across several decision points.

Historically, these processes were manual, requiring extensive human involvement in data input, claim verification and communication (Yusuf & Ajemunigbohun 2015). Manual processing, however, is labour-intensive, time-consuming and can lead to human error (Hartmann 2018). Consequently, many insurers have started using computerised systems for the claims-handling process, which digitalises certain functions such as data storage, policy retrieval and mathematical calculations (Eling, Nuessle & Staubli 2022; Hartmann 2018; Tkaczyk et al. 2018; Yusuf & Ajemunigbohun 2015). However, the literature also suggests that computerisation and automation should not be treated as equivalent. Computerised systems may improve discrete functions, whereas automation requires greater standardisation of inputs, rules, exceptions and system interactions across the end-to-end process (Eling et al. 2022; Mannix & Sethuraman 2020; Syed et al. 2020; Tkaczyk et al. 2018).

Although these systems improve process efficiency, they still rely heavily on human involvement for claim validation and decision-making. This creates challenges in automating end-to-end processes (Mannix & Sethuraman 2020), and highlights the need for effective governance.

From a governance perspective, precise control and accountability structures are required when transitioning from a manual to a computerised system, as errors or inefficiencies in the claims-handling process can lead to reputational damage, fines and penalties, and financial losses (Yusuf & Ajemunigbohun 2015). Consequently, the claims-handling literature provides the operational rationale for this study: automation may improve efficiency, but only if the underlying information flows, decision points and accountability structures are adequately governed. This position claims handling as a suitable context for examining RPA governance because the value of automation depends equally on technological capability and the governance of the information environment in which the technology operates.

While these studies collectively affirm the information-intensive nature of claims handling and the limitations of manual and partially computerised processes (Eling et al. 2022; Mannix & Sethuraman 2020; Yusuf et al. 2017), they remain largely descriptive and pay limited attention to the governance structures required to support end-to-end automation. Most notably, the literature highlights process standardisation and data accuracy as prerequisites for successful digitalisation yet rarely examines how fragmented accountability across departments exacerbates these issues in practice. This gap underscores the need for a governance lens when moving from computerisation to full RPA-enabled automation.

Robotic process automation enables software robots to execute rule-based, repetitive tasks across existing systems and applications without requiring extensive system integration or changes to the existing code (Lamberton et al. 2017; Madakam et al. 2019). In insurance claims handling, this makes RPA suitable for activities such as capturing claims information, verifying policyholder details, cross-referencing documents and initiating payments (Eling et al. 2022; Lamberton et al. 2017). However, the maturity of RPA as a technology does not eliminate implementation risk. This creates a tension in the literature: RPA is often presented as a relatively accessible automation technology, yet its implementation depends on organisational conditions that are considerably more complex than the technology itself.

Although the literature consistently highlights RPA’s potential to deliver efficiency, accuracy and cost reductions in claims handling (Eling et al. 2022; Guo et al. 2025; Lamberton et al. 2017; Madakam et al. 2019), a more critical reading reveals important tensions. Early studies tend to be optimistic and technology-centric, emphasising RPA’s non-invasive nature and ease of implementation. In contrast, more recent empirical and case-based research (Eulerich et al. 2024; Flechsig, Anslinger & Lasch 2022; Osmundsen et al. 2019; Syed et al. 2020) paints a more cautious picture, demonstrating that the high failure and abandonment rates (30% – 50%; Sigurðardóttir 2018) stem primarily from organisational and governance deficiencies rather than from technological shortcomings. These studies converge on several recurring challenges, namely process standardisation, data quality, system integration, change management and accountability, yet they differ meaningfully in emphasis and depth. For instance, Osmundsen et al. (2019) stress the need to balance centralised control with local process ownership, while Syed et al. (2020) offer a broader taxonomy of implementation barriers, including organisational readiness and skills gaps. Eulerich et al. (2024) contribute a valuable risk-management perspective, highlighting operational and control risks that earlier work largely overlooked.

A common limitation across this body of research is its predominantly general or cross-industry focus; few studies provide deep insurance-specific or claims-handling insights (notable exceptions being Lamberton et al. 2017 and Mannix & Sethuraman 2020). Moreover, most stop at identifying barriers without proposing integrated governance responses tailored to information-intensive processes. This gap is particularly relevant in insurance claims handling, where automated processes depend on policy data, claims documentation, validation rules, legacy systems and exception handling (Eling et al. 2022; Lamberton et al. 2017; Yusuf & Ajemunigbohun 2015). These studies, considered together, indicate that the central issue is no longer the definition of RPA, but the governance of its integration into complex, information-intensive business processes. They therefore informed the conceptual framework developed in this study by highlighting the need for governance mechanisms addressing process architecture, data quality, access control, capability development, change management and monitoring.

Considered collectively, the literature reveals that RPA implementation failures in insurance claims handling stem less from the technology itself than from insufficient governance of the information-intensive environment in which it operates. Addressing these challenges requires a deeper understanding of the underlying theoretical foundations that can guide effective governance. The next section, therefore, examines three complementary theoretical perspectives, namely IT governance, data governance and IT capability theory, that together provide the conceptual lenses through which a structured governance response can be developed.

Good governance practices are essential to ensure that digital transformation initiatives align with both strategic and operational objectives and deliver sustainable value (Delagrammatikas, Stelios & Tzavaras 2025; Weill & Ross 2004). The governance mechanisms required to align RPA projects in the insurance industry are rooted in IT governance, data governance and IT capability theories.

Information technology governance theory provides the foundational structures and processes that help define decision rights and accountability between the business and IT (De Haes & Van Grembergen 2009; Weill & Ross 2004). Effective IT governance promotes strategic alignment, performance measurement and risk management, ensuring that investments in technological advancements contribute directly to organisational goals (Weill & Ross 2004). In the context of RPA, IT governance theory is therefore useful because it explains how decision rights, accountability structures and alignment mechanisms shape whether automation initiatives remain connected to organisational objectives.

Data governance theory extends this focus by addressing the rules, responsibilities and processes that ensure data availability, quality and integrity (Khatri & Brown 2010; Volz et al. 2025). In RPA implementation, data governance determines how data are captured, validated and secured – a critical concern in automated environments where low-quality data can have a detrimental impact on the project’s outcome (Dogan et al. 2024; Guo et al. 2025). Proper data governance mechanisms, therefore, ensure compliance, traceability and reliability, all of which are essential to the success of RPA projects. This perspective is particularly important in claims handling because RPA does not create value from automation alone but rather when the underlying data are sufficiently accurate, accessible, controlled and traceable to support automated processing.

Finally, IT capability theory extends these perspectives by seeing governance mechanisms as dynamic organisational capabilities that enable organisations to identify opportunities for technological innovation, learn from experience, and reconfigure IT and process resources to respond to changes within the organisation or its environment (Pavlou & El Sawy 2010; Weritz et al. 2025). From this perspective, effective RPA governance reflects the insurer’s ability to implement mechanisms that coordinate people, processes and technologies to create value from automation.

The three theories are complementary to one another. Information technology governance theory explains who should make and monitor automation-related decisions; data governance theory explains how the information used by the automated processes should be controlled; and IT capability theory explains how insurers develop the organisational capacity to implement, maintain and adapt RPA over time (Khatri & Brown 2010; Pavlou & El Sawy 2010; Weill & Ross 2004). This distinction is important because RPA implementation failures can occur even when a single dimension is addressed. For example, a project may be strategically aligned but still fail because data quality is poor, or it may have adequate data controls but lack the skills and routines needed to maintain bots after implementation (Dogan et al. 2024; Osmundsen et al. 2019; Syed et al. 2020).

Combining these three theories provides a multidimensional foundation for understanding and developing a governance framework for implementing RPA in the insurance industry, ensuring sustainable value creation through effective risk management. Notably, few prior studies have synthesised these three perspectives in the context of RPA, particularly within highly regulated, information-intensive sectors such as insurance. The theoretical contribution of this study, therefore, lies in integrating these perspectives into a single governance logic: alignment and accountability from IT governance, information integrity and control from data governance and adaptive implementation capability from IT capability theory. Figure 1 illustrates the conceptual model.

Figure 1 illustrates this integrated conceptual model. While the three theories offer a strong conceptual foundation for understanding why governance is needed, they do not prescribe how these principles should be operationalised in practice. The following section, therefore, bridges theory and practice by introducing COBIT 2019 as the structuring mechanism that translates the theoretical constructs of alignment, accountability, data integrity and organisational capability into concrete governance and management objectives suitable for RPA implementation in insurance claims handling.

While the governance theories discussed above offer conceptual insights into how organisations should align technology with strategic objectives, COBIT 2019 provides a practical structure for operationalising these principles. Control Objectives for Information and Related Technologies 2019, the latest governance framework published by Information Systems Audit and Control Association (ISACA), provides a holistic approach to IT governance (Thabit, Ishhadat & Abdulrahman 2020).

The framework is organised into domains and governance objectives that support alignment between business and IT, value delivery, and effective risk management (ISACA 2018). The framework is known to be flexible, allowing organisations to tailor governance practices to emerging technologies, making it suitable for addressing the risks and governance challenges that arise from RPA implementation. In this study, COBIT 2019 is used as a guiding framework to synthesise the governance challenges identified in the literature and to develop appropriate governance mechanisms to address them.

The COBIT 2019 framework, therefore, serves as a bridge between theory and practice by addressing the principles of IT governance (alignment and accountability), incorporating elements of data governance (information integrity and control) and advancing IT capability theory (the development of adaptable governance routines). Applying COBIT 2019 to the insurance claims-handling process enables the integration of these theoretical perspectives into a single, structured model to address the challenges posed by RPA implementation. In this way, COBIT 2019 provides the organising logic for the framework, while the literature and theoretical perspectives determine why particular governance mechanisms are relevant to RPA implementation in insurance claims handling.

In summary, the literature review has established the operational context of claims handling, documented both the promises and ongoing challenges of RPA, clarified the relevant theoretical foundations and identified COBIT 2019 as a suitable organising framework. With this conceptual and theoretical foundation in place, the next section will outline the research design and methodology used to synthesise the literature and develop the governance framework presented in this study.

While RPA projects offer significant potential for improving efficiency and accuracy in the insurance claims-handling process, several challenges have been identified in the literature that hinder their successful implementation. To ensure the appropriate alignment between business and IT objectives and the success of the RPA project, these challenges must be well understood by those responsible for governance. The identified challenges are numbered C01 through C16 and categorised into four recurring, interrelated themes: process and system integration, data management, operational capability, and operational IT governance and control. Table 2 summarises these challenges.

The challenges summarised in Table 2 indicate that RPA project failures in the insurance claims-handling process are not limited to technical challenges but also encompass weaknesses in governance, alignment and operational mechanisms. Process and data challenges emphasise the need for stronger standardisation, quality controls and mechanisms to improve integration. These principles are central to the IT and data governance theories. Furthermore, operational and governance-related challenges indicate that many insurers lack the capacity and accountability structures to implement RPA successfully. Together, these identified challenges reinforce the need for a holistic governance framework to address the challenges of RPA.

A piecemeal approach to address the challenges, as summarised in Table 2, is insufficient because RPA project failures arise from weaknesses across process integration, data management, operational capability and IT governance. The following section draws on the theoretical foundations and COBIT 2019 governance and management objectives to translate these challenges into a coherent set of actionable governance guidelines, thereby closing the gap between identified problems and practical governance responses.

The identified challenges can be managed through governance mechanisms that strengthen IT and data governance, as well as operational control environments, for RPA projects in the insurance claims-handling process. To develop the framework, this study identified governance guidelines from the literature and mapped them to the relevant COBIT 2019 governance and management objectives.

This mapping ensured that the guidelines were structured and consistent with recognised governance practices. Control Objectives for Information and Related Technologies 2019 was not merely used as a general reference framework, but as an organising mechanism to translate the identified RPA implementation challenges into governance responses. Each guideline was therefore linked to one or more COBIT 2019 governance or management objectives to make the governance logic explicit. For example, enterprise architecture guidance was linked to the COBIT objective managed enterprise architecture, while process standardisation and automation suitability guidance was linked to managed requirements definition and managed solution identification and build. Guidelines on data architecture, privacy, logging and access control were linked to COBIT objectives related to managed data, managed security services, managed controls and managed security. Guidelines relating to change, configuration, capacity and availability were linked to COBIT objectives concerned with managed changes, managed configuration, managed availability and capacity, and managed operations.

In addition to the COBIT 2019 mapping, each guideline was linked to the theoretical perspective that informed its inclusion in the framework. Information technology governance theory informed guidelines concerned with decision rights, accountability, business-IT alignment, oversight and control. Data governance theory informed guidelines concerned with data ownership, data quality, privacy, access, integrity, traceability and monitoring. Information technology capability theory informed guidelines concerned with skills, organisational learning, technology enablement, knowledge transfer, adaptability and the development of repeatable automation capabilities. This dual mapping ensured that the framework was not only practice-oriented but also theoretically anchored in the governance and capability mechanisms required to manage RPA implementation challenges.

Following the initial mapping, a completeness check was performed, in which the COBIT 2019 objectives most relevant to RPA in the insurance industry were reviewed to identify any control areas not covered by the guidelines identified in the literature. Where gaps were identified, additional guidelines were formulated to align with the COBIT 2019 framework. The governance framework in Table 3 was therefore developed through an iterative process that combined literature-derived challenges, theoretical grounding and COBIT 2019 mechanisms to provide structured, literature-based guidelines for a governance response.

For clarity and traceability, Table 3 numbers the governance guidelines from G01 to G18 and identifies the origin of each guideline, indicating whether it was derived from the literature or through the COBIT 2019 completeness check. Table 3 also identifies the relevant COBIT 2019 governance and management objective(s) and the theoretical grounding for each guideline, thereby making the framework development logic more transparent.

To improve ease of use, the guidelines are grouped into five recurring governance themes that reflect how insurers would typically organise operational IT governance: (1) process and technology architecture, (2) data and information governance, (3) technology enablement and integration, (4) people and capability management, and (5) operational IT governance.

To illustrate the alignment between the identified challenges and the governance framework developed in Table 3, the guidelines were mapped to the specific challenges they address in Table 4. This mapping demonstrates comprehensive literature-based coverage of the governance framework, confirming that each identified challenge is mitigated by one or more COBIT 2019-aligned governance mechanisms. Table 4 also highlights how the controls are interconnected, as several controls mitigate multiple risks.

Table 4 illustrates the thorough scope of the conceptual governance framework, demonstrating that each identified challenge is effectively addressed by one or more governance mechanisms aligned with COBIT 2019. Furthermore, the table emphasises the interconnectivity of the controls, showing that several mechanisms contribute to managing multiple challenges, thereby reinforcing the framework’s robustness and efficiency. In line with the methodology, the synthesis of reviewed publications into key challenges and their subsequent mapping to recommended governance guidelines are illustrated in Figure 2.

As depicted in Figure 2, the structured synthesis process transforms insights from the existing literature into a comprehensive set of challenges and tailored conceptual guidelines, providing a rigorous foundation for RPA governance in insurance claims handling. This approach highlights the interconnections between identified issues and proposed solutions, facilitating better alignment.

The governance framework presented above provides a structured, theoretically grounded response to the RPA implementation challenges identified in the literature. Before concluding, it is important to delineate the boundaries of the study and acknowledge its limitations. The following section, therefore, clarifies the scope of the framework and identifies avenues for future empirical validation.