0 / 24

Model 36 of 74 · Technology & Data

Automation / RPA Maturity Assessment

Assess process automation strategy, implementation, and governance.

Pillars & areas

Discover

Identify what to automate

  1. 01Automation Strategy & Prioritisation
  2. 02Process Discovery & Design

Execute

Build & run automations

  1. 03Development & Implementation
  2. 04Operations & Support

Scale

Scale & govern at enterprise

  1. 05Governance & Control
  2. 06Scaling & Intelligent Automation

Levels

  1. 1Manual & ReactiveOpportunistic & siloed
  2. 2Standardised & ManagedRepeatable & supported
  3. 3Orchestrated & IntelligentEnterprise-wide & AI-driven

01 Automation Strategy & Prioritisation

Does the organisation take an intentional, business-aligned approach to deciding what to automate and why?

0/4 answered

AS-1How does your organisation decide which processes to automate?

Think about whether there is a structured method for evaluating and ranking automation candidates, or whether choices are driven by whoever asks loudest.

AS-2How clearly is automation linked to business objectives?

Consider whether automation initiatives are justified by measurable business outcomes or simply by the fact that something can be automated.

AS-3How does your organisation fund and resource automation work?

Think about whether automation has dedicated budget and people, or whether it competes informally for spare capacity.

AS-4How does your organisation handle the workforce impact of automation?

Consider whether there is a plan for what happens to the people whose work is automated — redeployment, upskilling, or nothing.

02 Process Discovery & Design

How well does the organisation identify, document, and prepare processes before automating them?

0/4 answered

PD-1How does your organisation discover and document processes before automating them?

Think about whether processes are mapped end-to-end with clear inputs, outputs, and exceptions before any automation development begins.

PD-2How does your organisation handle process exceptions and edge cases during design?

Consider whether the automation is designed only for the happy path, or whether known exceptions are explicitly addressed.

PD-3Does your organisation simplify or re-engineer processes before automating them?

Automating a bad process just creates a faster bad process — think about whether anyone challenges the current process before replicating it in a bot.

PD-4How does your organisation assess whether a process is suitable for automation?

Consider whether there are clear criteria for automation suitability, or whether any process that someone wants automated gets built.

03 Development & Implementation

Are automations built to production standards with proper testing, version control, and release management?

0/4 answered

DI-1How are automations developed and version-controlled?

Think about whether bot code is stored in a version control system with proper branching, or whether it lives on a developer's desktop.

DI-2How are automations tested before deployment?

Consider whether there is a dedicated test environment and a structured test plan, or whether bots are tested in production.

DI-3How does your organisation manage credentials and sensitive data used by automations?

Think about whether bot accounts use shared passwords stored in scripts, or whether credentials are managed securely.

DI-4How standardised are development practices across automation projects?

Consider whether every developer builds bots differently, or whether there are shared templates, naming conventions, and coding standards.

04 Operations & Support

Are automations monitored, maintained, and supported as production systems?

0/4 answered

OS-1How does your organisation monitor automations in production?

Think about whether anyone knows when a bot fails, slows down, or produces incorrect output — and how quickly they find out.

OS-2How are production automation failures handled?

Consider whether there is a clear process for triaging and resolving bot failures, or whether it depends on who built the bot being available.

OS-3How does your organisation handle changes in the systems that automations interact with?

Think about what happens when an application updates its UI, API, or data format — does the automation break silently?

OS-4How does your organisation manage the lifecycle of automations?

Consider whether old or low-value automations are ever reviewed, updated, or retired — or whether they accumulate indefinitely.

05 Governance & Control

Is there appropriate oversight, compliance, and risk management across the automation estate?

0/4 answered

GC-1Does your organisation maintain a complete inventory of all automations?

Think about whether leadership can answer the question: 'How many bots do we have, what do they do, and who owns them?'

GC-2How does your organisation control who can build and deploy automations?

Consider whether anyone with access to an RPA tool can build and deploy a bot to production, or whether there are approval gates.

GC-3How does your organisation ensure automations comply with regulatory and audit requirements?

Think about whether automated processes produce the audit trails and evidence that regulators or internal audit would expect.

GC-4How does your organisation manage the risk of automation failures impacting business operations?

Consider whether there is a risk assessment for what happens if a critical automation stops working — and whether there is a fallback plan.

06 Scaling & Intelligent Automation

Is the organisation moving beyond basic task automation toward enterprise-scale, AI-augmented automation?

0/4 answered

SI-1How does your organisation reuse automation components across projects?

Think about whether teams rebuild common functions (e.g. login, file handling, email parsing) from scratch every time, or whether there is a shared library.

SI-2How does your organisation integrate automation across end-to-end business processes?

Consider whether automations operate as isolated task bots, or whether they are orchestrated together to handle complete business workflows.

SI-3How is your organisation incorporating AI and machine learning into automation?

Think about whether automations only follow deterministic rules, or whether they can handle unstructured data, make predictions, or learn from outcomes.

SI-4How does your organisation measure and communicate the value delivered by its automation programme?

Consider whether there are hard numbers on what automation has delivered, or whether value claims are anecdotal.

Self-assessment report

Automation / RPA

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Automation / RPA maturity model

Automation should be treated as a strategic capability, not a tactical fix. The goal is not to build as many bots as possible, but to systematically identify the highest-value opportunities, automate them to production standards, and govern the result as a living portfolio of digital workers. Organisations that mature in this discipline move from fragile, developer-dependent scripts toward resilient, AI-augmented workflows that are orchestrated end-to-end and continuously optimised. The measure of success is not how many processes are automated, but how much sustained business value the automation programme delivers relative to its cost and risk.

This model assesses an organisation's maturity across six areas that together represent the full automation lifecycle: from deciding what to automate, through discovery, build, and operations, to governance and scaling. It is designed for organisations using robotic process automation (RPA), workflow automation, intelligent document processing, or any combination of automation technologies. The model is tool-agnostic and applies equally whether the organisation uses UiPath, Automation Anywhere, Power Automate, custom scripting, or a multi-platform approach.

Who this assessment is for

  • Automation programme leads and centres of excellence
  • IT leaders responsible for automation tooling and infrastructure
  • Business operations leaders sponsoring or consuming automation
  • Process analysts and automation developers seeking to benchmark their practices
  • Risk, compliance, and internal audit teams assessing automation governance
  • CIOs and CTOs evaluating their organisation's automation maturity as part of a broader digital strategy

The three maturity levels

  • Level 1 — Manual & Reactive: Automation is opportunistic and siloed. Individual teams build one-off scripts or bots without coordination, standards, or governance. There is no central visibility of what has been automated, no consistent quality bar, and failures are discovered by end users. Automation initiatives are driven by whoever has the technical skill and enthusiasm rather than by strategic value. The organisation cannot answer basic questions like "how many bots do we have?" or "what value has automation delivered?"
  • Level 2 — Standardised & Managed: Automation follows a repeatable methodology. There is a defined intake and prioritisation process, a dedicated team or centre of excellence, shared development standards, and production-grade monitoring and support. Each automation has a business owner, a documented process map, and measurable success criteria. The organisation can demonstrate the value of its automation programme and manages the associated risks through governance controls, credential management, and change coordination.
  • Level 3 — Orchestrated & Intelligent: Automation is an enterprise-wide capability that is continuously optimised. Individual bots are orchestrated into end-to-end workflows spanning multiple systems and technologies. AI and machine learning extend automation into unstructured and judgement-intensive domains. A shared component library and CI/CD pipeline accelerate delivery. Value is tracked rigorously and validated by finance. The automation portfolio is actively managed — underperforming automations are retired, high-value processes are continuously improved, and the workforce is proactively reskilled. The programme is self-funding through reinvested savings.

The 6 areas assessed

1. Automation Strategy & Prioritisation

Does the organisation take an intentional, business-aligned approach to deciding what to automate and why? This area examines whether automation candidates are evaluated against clear criteria, whether initiatives are linked to measurable business outcomes, whether funding and resourcing are adequate, and whether the workforce impact of automation is planned for rather than left to chance.

2. Process Discovery & Design

How well does the organisation identify, document, and prepare processes before automating them? Mature organisations combine task mining, process mining, and structured workshops to build quantitative, validated process maps. They assess suitability rigorously, eliminate unnecessary steps before automating, and design robust exception handling rather than building only for the happy path.

3. Development & Implementation

Are automations built to production standards with proper testing, version control, and release management? This area covers the software engineering discipline applied to automation: version control, code review, automated testing, credential security, development standards, and CI/CD pipelines. The goal is that automations are as well-engineered as any other production software.

4. Operations & Support

Are automations monitored, maintained, and supported as production systems? This area assesses whether failures are detected quickly and resolved reliably, whether system changes are coordinated with automation teams, whether there is a formal support model, and whether automations are actively managed through their full lifecycle rather than built and forgotten.

5. Governance & Control

Is there appropriate oversight, compliance, and risk management across the automation estate? This area examines whether the organisation maintains a complete inventory, controls who can build and deploy, ensures regulatory compliance and audit readiness, and manages the operational risk of automation failures with documented fallback plans.

6. Scaling & Intelligent Automation

Is the organisation moving beyond basic task automation toward enterprise-scale, AI-augmented automation? This area assesses component reuse, end-to-end process orchestration, the integration of AI and machine learning, and the rigour with which overall programme value is measured and communicated. Mature organisations treat automation as a platform, not a collection of individual bots.

How this model relates to other frameworks

  • IEEE 2755-2017 — Guide for Terms and Concepts in Intelligent Process Automation, providing standard vocabulary for RPA and intelligent automation.
  • COBIT 2019 — Governance framework applicable to managing automation as an IT-enabled capability.
  • ITIL 4 — Service management practices relevant to automation operations, support, and lifecycle management.
  • ISO/IEC 27001 — Information security controls applicable to bot credential management, access control, and data handling.
  • Hyperautomation — a concept popularised by Gartner for combining RPA, process mining, AI and integration to automate end-to-end processes.

Frequently asked questions

What is the Automation / RPA maturity model?

Assess process automation strategy, implementation, and governance. It is an original, simplified model with three maturity levels (Manual & Reactive, Standardised & Managed and Orchestrated & Intelligent), assessed through 24 questions across 6 areas: Automation Strategy & Prioritisation, Process Discovery & Design, Development & Implementation, Operations & Support, Governance & Control and Scaling & Intelligent Automation.

How long does the Automation / RPA assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Manual & Reactive), 2 (Standardised & Managed) or 3 (Orchestrated & Intelligent). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.