System and method for performing signal processing and dynamic analysis and forecasting of risk of third parties

• US 10,339,484 B2
• Filed: 10/21/2016
• Issued: 07/02/2019
• Est. Priority Date: 10/23/2015
• Status: Active Grant

• Current Assignee: KPMG LLP (KPMG International Cooperative)
• Original Assignee: KPMG LLP (KPMG International Cooperative)
• Inventors: Pai, Pradeep, Urban, Andrea, Raff, Lawrence, Schneider, James
• Primary Examiner(s): White, Dylan C
• Application Number:
  US15/331,243
• Publication Number:
  US 20170140312A1
• Time in Patent Office: 984 Days
• Field of Search: 705 728
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/0875 Itemisation or classification of parts, supplies or services, e.g. bill of materials

Abstract

A system and process for forecasting third party disruption that uses a complex computerized network map as part of a risk model may be used to analyze risk for third parties. A number of risk factors or nodes of the map may include a wide range of risks (e.g., corruption) that have an impact on third parties in a geographic region. A baseline risk level may be established by scoring underlying risk measures for respective geographic regions. By executing the risk model using dynamic signal processing in a near real-time manner and considering impact, velocity, likelihood, and interconnectedness of risk factors and the diffusion of risk across a network, potential third party disruption and/or vulnerability can be forecasted.

Claims

1. A computer-implemented method, comprising:

generating a computerized network map being inclusive of a plurality of nodes representative of risk factors in multiple geographic regions in which one or more third parties of a user operate, each of the nodes in the network map (i) being interconnected with at least one of the other nodes as correlated risks and (ii) including a risk factor value calculated as a function of at least one risk measure used to model the respective risk factor;

computing a baseline risk of a geographic region by;

collecting data metrics for each risk factor of the geographic region;

processing the data metrics to generate normalized data for each risk factor;

aggregating the normalized data metrics of each risk factor to generate risk factor scores; and

computing a baseline risk score for the geographic region by aggregating the risk factor scores;

dynamically performing signal processing for each risk factor in a geographic region on associated content, including news and event content, and metadata associated with the content by;

utilizing a taxonomy describing disruption events associated with each of the risk factors of the network map and a taxonomy describing a geographic region being monitored in which the one or more third parties operate;

measuring signal strength of the identified content based on the metadata associated with the content;

measuring signal strength associated with a risk factor for the geographic region for a fixed period of time based on the signal strength of the identified content associated with that risk factor, thereby forming a time series of the measured signal strengths;

performing sequential analysis on the time series of the measured signal strengths of the risk factor for the geographic region using the variance of the historical distribution of signal strength for the risk factor for step detection;

step detecting to generate a risk signal for the risk factor within the geographic region based on a value of the calculated sequential analysis exceeding a threshold value determined by the variance of an historical distribution of the signal strength of the risk factor; and

activating the risk factor for the geographic region in response to the risk signal being generated;

forecasting risk in the geographic region in which the risk factor was activated in response to the risk signal being generated, the forecasting including;

calculating diffusion of risk throughout the network map so as to measure impact on correlated risks across the network map;

computing the projection of risk impact for each risk factor within the network map;

computing the probability projection for each risk factor within the network map; and

generating a risk projection for the geographic region based on the individual risk factor projections; and

generating a dynamic graphical user interface for the forecasted risk for the risk factors and the forecasted vulnerability scores for third parties within the geographic region.

2. The method according to claim 1, further comprising:

forecasting a vulnerability score for each third party operating in an industry affected by the active risk factor, the forecasting including;

categorizing third parties by industry and mapping the industries to the risk factors by degree of sensitivity;

determining a degree to which third parties are affected by the activation of the risk factor in response to the risk factor having been activated based on the industry categorization of the third party; and

calculating a vulnerability score projection for the affected third party based on a financial risk score of the third party, the active geographic risk factors of the region in which the third party operates based in part on the sensitivity of an industry of the third party to the active geographic risk as well as the review status/times since last review of the third party.

3. The method according to claim 1, wherein each of the nodes in a network map represents a risk factor that could potentially disrupt operations of the one or more third parties, and the impact, likelihood, and probability of each risk factor are modeled.

4. The method according to claim 1, wherein computing a baseline risk score includes:

removing outlier data values of the data metrics used to calculate the risk factors of each node before calculating the standard deviation and mean, and then reintroducing those outlier values;

scaling the data metric values;

performing a regression analysis of the metric data values; and

normalizing the data metric values.

5. The method according to claim 1, further comprising using a modified CUSUM to perform the sequential analysis of the time series of the measured signal strengths.

6. The method according to claim 5, further comprising:

determining that the modified CUSUM value of the risk factor exceeds a threshold value based on the variance of the historical distribution; and

generating a new risk event and associated projection for the geographic region, thereby increasing the risk score for the geographic region.

7. The method according to claim 6, further comprising, in response to determining that the risk score crosses a threshold value, causing a change to a graphical user interface to indicate that the risk score for the geographic region crossed the threshold value.

8. The method according to claim 1, wherein model inputs include impact, velocity, likelihood, and interconnectedness that are used to form the risk network model that the network map is configured to model.

9. The method according to claim 1, wherein dynamically performing signal processing includes performing the signal processing in near real-time over multiple geographic regions in which multiple third parties operate.

10. The method according to claim 1, wherein generating the computerized network map includes generating the computerized network map with multiple nodes representing risk factors.

11. The method according to claim 1, wherein generating the computerize network map includes generating the computerized network map across multiple geographic regions or within a single geographic region.

12. The method according to claim 1, wherein measuring signal strength of the identified content based on the metadata includes in part measuring signal strength of the identified content based on relative times that content is published.

13. The method according to claim 1, wherein measuring signal strength includes:

dynamically searching the content;

determining relevance and sentiment related to the risk factors from the content;

parsing the metadata associated with the content; and

determining geodispersion, source strength, and frequency of the content from the parsed metadata.

14. The method according to claim 1, wherein computing a baseline risk includes determining risk metric values based on information collected from external sources.

15. The method according to claim 1, wherein computing the baseline risk includes computing the baseline risk on a periodic or aperiodic basis.

16. The method according to claim 1, further comprising forecasting a vulnerability score.

17. The method according to claim 1, wherein calculating diffusion of risk of the network map includes using the Leontief Input-Output Model.

18. The method according to claim 1, further comprising calculating a normalized signal strength on a fixed frequency period, thereby producing a fixed-frequency, amplitude-modulated signal strength for use in performing the step detection.

19. The method according to claim 1, further comprising:

dynamically sorting multiple third parties based on vulnerability scores and projected dates at which the respective vulnerability scores are determined to cross a vulnerability threshold value; and

wherein generating the dynamic graphical user interface includes generating the forecasted vulnerability scores for the third parties in a date dependent manner to enable a user to determine which of the suppliers has the highest vulnerability over a projected date range within the geographic region by viewing the user interface.