The quick-win trap: Why post-ERP RPA becomes a digital band-aid
After deploying ERP systems, large companies often still face manual tasks: touchpoints with legacy software, Excel files, and email approvals. Robotic Process Automation (RPA) allows organizations to quickly close these gaps at the user interface level without complex integration projects. However, robots often become permanent replacements for process reengineering rather than temporary tactical bridges.
According to the Cisco AI Readiness Index 2025, only 13% of organizations consistently derive high value from automation. For the rest, there is a risk of chaotic scaling of local scripts. If inefficient workarounds are automated, the company gets parallel processes instead of a mature digital model.
Signs of inefficient automation
Robotic automation harms business architecture if the following signs are observed:
- Parallel accounting in Excel: A robot regularly copies thousands of rows of data from the ERP into local spreadsheets with their own formulas.
- Multi-stage email approvals: RPA merely forwards emails without resolving process ownership and SLA issues.
- High volume of exceptions: The team spends time manually maintaining scripts that constantly fail.
- Shadow development: Each branch office creates its own robots, leading to decentralized access rules and support complexity.
The organizational factor and target architecture
According to the Microsoft 2026 Work Trend Index Annual Report, organizational factors and culture have twice the impact on the business outcomes of automation compared to purely technical efforts. Process reengineering is required before starting any RPA project.
A mature enterprise architecture involves a clear division of roles:
- ERP: The primary source of transactional data.
- BPM: Orchestration of end-to-end processes, routing, and SLAs (e.g., using low-code solutions).
- API: System integration between enterprise software.
- RPA: A temporary adapter for legacy systems without APIs that are scheduled for retirement.
Security and risk control
Uncontrolled RPA poses security risks due to robots using accounts with excessive privileges. A minimum control set should include separate technical accounts, the principle of least privilege, activity logging, and a clear decommissioning plan for robots. When integrating AI components, organizations should follow standards such as the NIST AI Risk Management Framework and OWASP Top 10 to prevent sensitive data leaks.
How this affects the sector
The reliance on RPA as a permanent solution rather than a tactical bridge leads to fragmented business architecture, parallel accounting, and high maintenance overhead. For the industry, this chaotic scaling of local scripts prevents organizations from achieving a mature digital model, while uncontrolled robots with excessive privileges introduce significant security vulnerabilities and data leak risks.
How to respond
To prevent RPA from becoming a digital band-aid, organizations should adopt a structured approach:
- Reengineer processes first: Redesign workflows before applying any automation tools to avoid automating inefficient workarounds.
- Define clear system roles: Use ERP for transactional data, BPM for orchestration, APIs for integration, and restrict RPA to a temporary adapter for legacy systems scheduled for retirement.
- Implement security controls: Use separate technical accounts, apply the principle of least privilege, log all activities, and establish a clear decommissioning plan for robots.
- Follow AI standards: Adhere to frameworks like the NIST AI Risk Management Framework and OWASP Top 10 when integrating AI components.
Prepared by a Software Ukraine member. Original publication.