Where General IT Governance Standards Fall Short for Robotic Process Automation: Content Validation and Practitioner Appraisal of an Integrated Governance Framework in UAE Telecommunications

Robotic process automation (RPA) is quick to deploy but difficult to govern: software robots hold privileged credentials and process customer data unattended, yet COBIT 2019, ITIL 4, ISO/IEC 38500, and TOGAF predate RPA and treat automation as an output of IT processes rather than as an actor to govern. This study derives an RPA governance framework from those four standards for UAE telecommunications and reports the evidence obtained so far. A four-phase design combined standards analysis and a systematic review (34 out of 543 records) with content validation by five experts, a modified Delphi study with thirteen experts, and a goal–question–metric appraisal by nine practitioners in three operators. All 60 items were retained (S-CVI/Ave = 0.97; modified kappa ≥ 0.76); at full Delphi consensus (median 5, IQR 0) the framework grew from 14 factors and 46 items to 18 and 80. Practitioners rated it Accepted (composite 4.39 of 5; cross-case range 0.03). Three of the four factors the experts added match coverage gaps recorded before the Delphi began; all three concern the robot’s runtime behaviour, including identity and credential controls. The framework is content-validated and favourably appraised, not yet shown to improve outcomes; it is an auditable, security- and privacy-aware baseline for AI-specific controls.