Back to Assessments & Documents
AI and Intelligent Automation Active

Intelligent Automation Center of Excellence Maturity Assessment

A 55-question diagnostic across 9 domains that evaluates whether an organization runs automation as one governed capability across workflow and low-code, robotic process automation, intelligent document processing and AI...

Start Assessment

Overview

A 55-question diagnostic across 9 domains that evaluates whether an organization runs automation as one governed capability across workflow and low-code, robotic process automation, intelligent document processing and AI agents doing process work. Written for the head of the automation CoE and the executive sponsor who need to answer: is our automation estate a controlled, valuable capability, or a growing set of fragile bots, flows and agents that only a few people understand?

Detailed Description

Automation programs often start with quick wins and end with a fragile estate: bots that break whenever an application changes, low-code flows nobody owns, document extraction that misreads amounts without anyone noticing, AI agents given more access than their task needs, and hours saved that never become money or redeployed capacity. This assessment follows the automation lifecycle: the CoE charter, sponsor, strategy and technology selection, ownership, federated delivery and inventory; intake, discovery, scoring, simplification, AI use case hand-off and prioritization; reference patterns, code review, design documents, components and APIs, exception handling, document processing confidence design and agent task design; testing, AI accuracy testing, release, application change and rule change; identities, privileges, credentials, segregation of duties, sensitive data, audit trail, risk tiering and agent containment; monitoring, queues, incidents, service levels, fallback and AI production monitoring; health reviews, retirement, platform strategy, license use and cost; CoE roles, key-person risk, capacity, citizen developers, shadow automation and workforce impact; and verified value, cash release, the scorecard, benchmarking, management review and improvement. It is the automation deep dive of the Digital Transformation family (hub plus Intelligent Automation CoE): the hub keeps one intake, the roadmap link and budget-level decisions, and this model keeps automation practice. Identity, AI governance, change, incident, value method and workforce depth stay with their owning models; this model tests the automation program and its hand-offs to them.

Assessment Details

Audience

Head of the intelligent automation CoE, automation director and executive sponsor. Secondary: CIO, chief digital or transformation officer, process excellence leader, head of IT operations, CISO and AI governance lead.

Purpose

Shows where automation is chosen by habit rather than fit, where waste is automated, where bots and agents run under shared or excessive access, where AI output reaches systems of record unchecked, where failures are found by users, where citizen and shadow automations escape control and where reported savings are not real. Gives a prioritized path to an automation capability that scales safely and proves its value.

Effort

Initial assessment: 4 to 5 hours of facilitated sessions with the CoE lead, design authority, lead developers, control room and platform team, security and identity, two or three process owners and a citizen developer lead. Evidence gathering: charter, strategy, inventory and pipeline extracts, standards and design documents, test and release records, identity and access reconciliations, run and queue reports, risk assessments, cost and license data and benefit verifications.

Cadence

Every 12 months, and after a platform migration or consolidation, the first production AI agent, a major automation failure or control finding, or a decision to federate delivery to business units.

Framework Alignment

IEEE 2755.2-2020 IEEE 2755-2017 IEEE 2755.1-2019 COBIT 2019 ISO/IEC 42001:2023 ISO/IEC 22989:2022 NIST AI RMF 1.0 OWASP Top 10 for Agentic Applications 2026 APQC PCF ISO/IEC 27001:2022 NIST SP 800-53 Rev 5 ISO 22301:2019 ISO/IEC 25010:2023 ISO/IEC 19770-1:2017 TBM Taxonomy SFIA 9

KPIs

  • Straight-Through Processing Rate - Share of transactions received by critical automations that complete without human touch. Target: 75% or more (model target).
  • Exception Items Resolved within Aging Limit - Share of items handed to human exception queues resolved within their aging limit. Target: 90% or more (model target).
  • Verified Value against Estimate - Verified annual value of automations at 180 days divided by their estimated value at approval. Target: 80% or more (model target).
  • Automations with Negative Net Value - Share of production automations whose verified annual value is below their full annual cost. Threshold: 10% or fewer (model target).
  • Agent Actions beyond Limits not Stopped - Agent actions that exceeded their limits or skipped a required approval and were not blocked. Threshold: 0 (control).

Dependencies

Technology Governance and Strategy (v10.9.6): Technology Policy Framework, IT Strategy, Technology Decision Rights Matrix (1.1, 1.3, 1.4, 7.3, 8.4). Digital Transformation (v7.9.6): Digital Transformation Strategy and Ambition, Transformation Roadmap, Process Redesign Register (1.3, 2.1, 2.2, 2.4, 2.6). Non-Human Identity and Secrets Management (v4.9.6): NHI Registry, NHI Lifecycle Process, NHI Entitlement Review Procedure, Secrets Vault Architecture and Operating Procedure, NHI Control Testing Plan (1.6, 5.1, 5.2, 5.3, 5.8, 7.2). AI Use Case Lifecycle Management (v4.9.6): AI Use Case Register, Use Case Intake Canvas, Agent Permission Profile, AI Impact Assessment (2.5, 3.7, 8.6). Value Realization and Investment ROI (v7.9.6): Benefit Classification and Measurement Standard, Total Cost of Ownership Model, Business Case Template, Investment Portfolio Value Map (2.6, 7.5, 8.6, 9.1, 9.2). DevOps Engineering (v1.9.6): Software Engineering Standard, Delivery Pipeline Specification (3.2, 4.3). API and Integration Lifecycle (v6.9.6): API Inventory and Ownership Register (3.4). AI Governance (v11.9.6): AI Agent Governance Standard, AI Impact Assessment Register, AI Operations and Monitoring Standard (3.7, 5.7, 5.8, 6.6). AI Pipeline and MLOps (v11.9.6): GenAI Evaluation Harness and Golden Sets (4.2). Change Management (v8.9.6): Standard Change Library, Change Record Register, Change Windows and Blackout Agreement (4.3, 4.4). IT Risk Management (v7.9.6): IT Risk Register, End-User Computing Inventory (5.7, 8.5). Monitoring and Event Management (v4.9.6): Monitoring Coverage Register (6.1). Incident Management (v9.9.6): Incident Classification and Priority Standard (6.3). Software Asset and License Management (v6.9.6): Publisher Licensing Playbooks (7.4). Technology Workforce Readiness (v6.9.6): Technology Skills Framework, Key Person Dependency Register (8.1, 8.2). Shadow AI and AI Sprawl Governance (v3.9.6): Shadow AI Tool Inventory and Registry (8.5). IT Performance Management (v6.9.6): KPI Catalog (9.3). Continual Service Improvement (v8.9.6): Continual Improvement Register (9.6).

Assessment Outline

(9 domains · 55 questions)
  1. 1

    1 Automation Mandate and Operating Model

    The CoE charter across all automation types, leadership and sponsor accountability, automation strategy and technology selection, ownership of processes, automations and platforms, the federated delivery model and the automation inventory

    • 1.1 Intelligent Automation CoE Charter (Bridge) 1 questions
    • 1.2 CoE Leadership and Sponsor Accountability 1 questions
    • 1.3 Automation Strategy and Technology Selection (Bridge) 1 questions
    • 1.4 Process, Automation and Platform Ownership (Bridge) 1 questions
    • 1.5 Federated Delivery Model and Standards Authority 1 questions
    • 1.6 Automation Inventory (Bridge) 1 questions
  2. 2

    2 Automation Pipeline and Process Selection

    Demand intake, process discovery and mining, suitability, technology fit and risk tier scoring, process simplification before automation, the hand-off of AI-based ideas to AI use case management and value-based prioritization

    • 2.1 Demand Intake (Bridge) 1 questions
    • 2.2 Process Discovery and Mining (Bridge) 1 questions
    • 2.3 Suitability, Technology Fit and Risk Tier Scoring 1 questions
    • 2.4 Process Simplification Before Automation (Bridge) 1 questions
    • 2.5 AI Use Case Hand-off (Bridge) 1 questions
    • 2.6 Value-Based Pipeline Prioritization (Bridge) 1 questions
  3. 3

    3 Design Standards and Build

    Reference patterns and development standards by automation type, version control and peer review, design documentation, reusable components and API-first connectors, exception handling and human hand-off, document processing confidence design and AI agent task design

    • 3.1 Reference Architecture and Development Standards 1 questions
    • 3.2 Version Control and Peer Review (Bridge) 1 questions
    • 3.3 Design Documentation 1 questions
    • 3.4 Reusable Components and Connectors (Bridge) 1 questions
    • 3.5 Exception Handling and Human Hand-off 1 questions
    • 3.6 Document Processing Confidence and Validation Design 1 questions
    • 3.7 AI Agent Task Design and Autonomy Tier (Bridge) 1 questions
  4. 4

    4 Testing, Release and Change

    Test strategy and business acceptance, AI component accuracy testing, release and rollback through change management, coordination with target application changes and maintenance, and business rule and regulatory change

    • 4.1 Automation Test Strategy and Acceptance 1 questions
    • 4.2 AI Component Accuracy Testing (Bridge) 1 questions
    • 4.3 Release and Rollback through Change Management (Bridge) 1 questions
    • 4.4 Target Application Change and Maintenance (Bridge) 1 questions
    • 4.5 Business Rule and Regulatory Change 1 questions
  5. 5

    5 Identity, Controls and Risk

    Bot and agent identities, least privilege and recertification, credential vaulting, segregation of duties in build, run and transactions, sensitive data, the transaction audit trail, automation risk tiering and AI agent action limits and containment

    • 5.1 Bot and Agent Identity Lifecycle (Bridge) 1 questions
    • 5.2 Least Privilege and Access Recertification (Bridge) 1 questions
    • 5.3 Credential Vaulting and Rotation (Bridge) 1 questions
    • 5.4 Segregation of Duties in Build, Run and Transactions 1 questions
    • 5.5 Sensitive Data Handling 1 questions
    • 5.6 Transaction Audit Trail 1 questions
    • 5.7 Automation Risk Tiering and Risk Register (Bridge) 1 questions
    • 5.8 AI Agent Action Limits and Containment (Bridge) 1 questions
  6. 6

    6 Operations and Run Health

    Control room monitoring and alerting, work and exception queues, automation incidents, service levels and straight-through processing, manual fallback and AI and document processing production monitoring

    • 6.1 Control Room Monitoring and Alerting (Bridge) 1 questions
    • 6.2 Work Queue and Exception Queue Management 1 questions
    • 6.3 Automation Incident Handling (Bridge) 1 questions
    • 6.4 Service Levels and Straight-Through Processing 1 questions
    • 6.5 Manual Fallback and Continuity 1 questions
    • 6.6 AI and Document Processing Production Monitoring (Bridge) 1 questions
  7. 7

    7 Lifecycle, Platform and Cost

    Periodic health and technical debt review, retirement, platform and vendor strategy, license and runtime utilization and the full cost of each automation

    • 7.1 Periodic Health and Technical Debt Review 1 questions
    • 7.2 Automation Retirement (Bridge) 1 questions
    • 7.3 Platform and Vendor Strategy (Bridge) 1 questions
    • 7.4 License and Runtime Utilization (Bridge) 1 questions
    • 7.5 Total Cost per Automation (Bridge) 1 questions
  8. 8

    8 People, Citizen Development and Workforce Impact

    CoE roles and skills, key-person risk on critical automations, CoE capacity, the citizen developer program, promotion of citizen builds and discovery of shadow automation, and the impact of automation on business roles

    • 8.1 CoE Roles and Skills (Bridge) 1 questions
    • 8.2 Key-Person Risk on Critical Automations (Bridge) 1 questions
    • 8.3 CoE Capacity Planning 1 questions
    • 8.4 Citizen Developer Program (Bridge) 1 questions
    • 8.5 Citizen Build Promotion and Shadow Automation (Bridge) 1 questions
    • 8.6 Workforce Impact and Role Redesign (Bridge) 1 questions
  9. 9

    9 Value, Performance and Improvement

    Verified benefits per automation, freed capacity and cash release, the program scorecard, benchmarking and underperformer decisions, the CoE management review and program improvement

    • 9.1 Verified Benefits per Automation (Bridge) 1 questions
    • 9.2 Freed Capacity and Cash Release (Bridge) 1 questions
    • 9.3 Program Scorecard and Value Reporting (Bridge) 1 questions
    • 9.4 Benchmarking and Underperformer Decisions 1 questions
    • 9.5 CoE Management Review 1 questions
    • 9.6 Automation Program Improvement (Bridge) 1 questions

At a Glance

Category AI and Intelligent Automation
Type Free
Roles 6
Domains 9
Questions 55
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance