System and apparatus for managing risk

• US 20080015889A1
• Filed: 07/10/2007
• Published: 01/17/2008
• Est. Priority Date: 07/17/2006
• Status: Abandoned Application

• Current Assignee: Compushare, Inc. (Finastra Global Ltd.)
• Original Assignee: Compushare, Inc. (Finastra Global Ltd.)
• Inventors: Fenster, Brad
• Application Number:
  US11/825,908
• Publication Number:
  US 20080015889A1
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G06Q 40/12 Accounting

Abstract

A system for managing risk is disclosed. The system provides a consistent approach for risk management and protection of non-public information, as well as providing for regulatory compliance and facilitating regulatory examinations.

Claims

1. A computer software system for managing risk, comprising:

an executive dashboard menu, for providing a top-level mechanism for identifying and quantifying risk factors;

a console menu, for directing a user to specific software tabs suitable for inputting and managing risk data;

a reports menu, for directing a user to specific software tabs suitable for formatting and reviewing the inputted data; and

a maintenance menu, for entering information portions of static risk data.

2. The system of claim 1, further comprising:

client access to the system is provided by a manager.

3. The system of claim 2, further comprising:

the manager is an entity that has been authorized to add clients.

4. The system of claim 3, further comprising:

the manager can access all client information, and also has access to default lists used to populate the various tables used by the client.

5. The system of claim 1, wherein the executive dashboard further comprises a risk profile chart, audit findings chart, control gap chart, and vendor review table.

6. The system of claim 1, further comprising:

an audit findings chart for displaying reportable items that require corrective action.

7. The system of claim 6, wherein the audit findings chart summarizes data into various severities and the percent of corrective action completed.

8. The system of claim 1, further comprising:

a control gap chart for representing planned mitigation strategies that were identified during the risk assessment process but have not yet been implemented.

9. The system of claim 1, further comprising:

a vendor table for displaying all of a Client'"'"'s vendors and providing a reference relating to the Client'"'"'s oversight of critical service providers, comprising at least the last time a vendor was formally reviewed, whether that review was successful or unsuccessful, and timeframe for the next review.

10. The system of claim 1, further comprising:

a business continuity tab for business continuity planning a plurality of business processes.

11. The system of claim 1, further comprising:

a plurality of business continuity edit screens for identifying a Client'"'"'s recovery point objectives and maximum tolerable downtimes.

12. The system of claim 1, further comprising:

a business recovery tab for allowing an end-user to document specific recovery strategies along with recovery procedures, including high-level managerial plans for business continuity.

13. The system of claim 1, further comprising:

a backup requirements tab for identifying computer files that need to be backed up, the frequency of the backups, who is to perform the backups, and user comments.

14. The system of claim 1, further comprising:

an offsite requirements tab for identifying items a Client needs to store offsite for business continuity purposes and location of the offsite storage.

15. The system of claim 1, further comprising:

a risk assessment tab for documenting specific risks and associated mitigation strategies.

16. The system of claim 15, wherein all risks with a residual risk level that exceeds the approved risk tolerance level are included in an unmitigated risk report.

17. The system of claim 1, further comprising:

an audit findings tab for documenting audit findings which may include findings from one or more sources selected from;

internal staff, external audit firms, external consulting firms, and regulatory agencies.

18. The system of claim 1, further comprising:

a vendor review tab for allowing a Client to document their oversight of critical vendors.

19. The system of claim 1, further comprising:

a characterization report tab for detailing an association between specific business processes and specific information assets including one or more of hardware, software, personnel, and vendors.

20. The system of claim 1, further comprising:

a business continuity tab for providing access to a plurality of business continuity related reports.

21. The system of claim 1, further comprising:

a business impact assessment report for identifying recovery strategies, backup requirements, offsite storage requirements, and the supporting hardware, software, personnel, and vendors for each business process utilized by a client.

22. The system of claim 20, further comprising:

a recover procedures report tab for detailing the recovery procedures that were entered into the business continuity tab.

23. The system of claim 20, further comprising:

a backup requirements report tab for detailing computer files identified in the business continuity tab required to restore a business process in the event of a disruption.

24. The system of claim 1, further comprising:

an offsite storage requirements report tab detailing pertinent items, including one or more of computer files, documents, supplies, required to restore a business process in the event of a disruption.

25. The system of claim 1, further comprising:

a personnel listing report tab arranged in alphabetical order and containing a listing of client personnel comprising contact information for each person identified.

26. The system of claim 1, further comprising:

an audit/test plan tab for providing a listing of the audit objectives of a review and identifying the responsible party for performing the review along with the frequency of the review.

27. The system of claim 1, further comprising:

an audit/test objectives report for detailing one or more mitigation strategies to consider during an audit.

28. The system of claim 1, further comprising:

an audit findings report for detailing the findings from various reviews which documents the priority level of the finding, the responsible party for implementing corrective action, the due date for corrective action to be completed, and the percent of corrective action completed.

29. The system of claim 1, further comprising:

a risk management report tab for documenting the risks that exceed an approved risk tolerance level, comprising information relating to a specific risk that was added during a risk assessment

30. The system of claim 1, further comprising:

a security requirements checklist report for displaying all mitigation strategies in a governing document that will formally implement a specific mitigation strategy.

31. The system of claim 1, further comprising:

a control gap report for detailing mitigation strategies that are not currently implemented and assisting a client in monitoring the status of the mitigation strategy implementation.

32. The system of claim 1, further comprising:

a maintenance menu for identifying Client operating locations and information assets associated with a business process.

33. The system of claim 32, further comprising:

a characterization tab for providing an interface to associate the information assets to a specific business process.

34. A method comprising performing a machine-executed operation involving instructions, wherein the machine-executed operation as at least one of:

a) storing the instructions onto a machine-readable storage medium; and

b) executing the instructions;

wherein the instructions are instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of;

providing a top-level mechanism for identifying and quantifying risk factors;

directing a user to specific software tabs suitable for inputting and managing risk data;

directing a user to specific software tabs suitable for formatting and reviewing the inputted data; and

entering information portions of static risk data.