Where General IT Governance Standards Fall Short for Robotic Process Automation: A Multi-Phase Validation of a Standards-Integrated Framework in Telecommunications

Robotic process automation (RPA) is quick to deploy but difficult to govern: software robots hold privileged credentials and act unattended across production systems, yet the standards organisations rely on—COBIT 2019, ITIL 4, ISO/IEC 38500 and TOGAF—predate RPA and treat automation as an output of IT processes. This study builds and tests a standards-integrated RPA governance framework for the telecommunications sector of the United Arab Emirates. A four-phase deductive–confirmatory design combined standards analysis with a systematic review (34 of 543 records), content validation by five experts, a modified Delphi study (three rounds, 13 experts), and a goal–question–metric evaluation by nine practitioners in three operators. All 60 preliminary items were retained (S-CVI/Ave = 0.97; modified kappa ≥ 0.76). At full Delphi consensus (median 5, IQR 0) the framework grew to 18 factors and 80 items, up from 14 and 46. Practitioners judged it Accepted (composite 4.39 of 5; cross-case range 0.03). Three of the four expert-added factors matched coverage gaps recorded before the Delphi began, and all three concern the robot’s runtime behaviour. General IT standards therefore need supplementing at three identifiable points, and the framework provides an auditable baseline onto which AI-specific controls can later be layered.