PROCESS RISK PRIORITIZATION APPLICATION

• US 20120005115A1
• Filed: 06/30/2010
• Published: 01/05/2012
• Est. Priority Date: 06/30/2010
• Status: Abandoned Application

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Hofberg, Mark G., Bohen, Daniel
• Application Number:
  US12/827,193
• Publication Number:
  US 20120005115A1
• Time in Patent Office: Days
• US Class Current: 705/348
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling

Abstract

Embodiments of the invention relate to systems, methods, and computer program products for prioritizing processes in terms of risk. Specifically, present embodiments provide assessment of process applicability to risk factors and an independent assessment of the relative importance of the risk factors. The two independent assessments, conducted by separate corporate entities, such as line-of-business and risk owners, are subsequently used to determine a process risk score that allows for the processes to be prioritized. The independent nature of the assessments provides for a highly objective, fact-based means of prioritizing processes based on risk.

Claims

1. An apparatus for prioritizing processes based on risk, the apparatus comprising:

a computing device including a memory and at least one processor; and

a process risk prioritization application stored in the memory, executable by the processor, configured to determine risk priority for a plurality of processes and including;

a risk weighting routine configured to receive, from one or more second level entities, an importance indicator for each of a plurality of a risk prioritization factors in comparison to each of the other risk prioritization factors and determine a risk weighting for each of the risk prioritization factors based on the importance indicators;

a risk score routine configured to receive, from one or more first level entities, an applicability score for each of a plurality of predefined processes in relation to each of the predetermined risk prioritization factors and determine a risk score for each of the processes based on the applicability score and the risk weighting; and

a risk priority routine configured to determine a risk priority for each of the processes based on the risk scores.

2. The apparatus of claim 1, wherein the risk score routine is further configured to receive, from one or more line-of-business participants, the applicability score for each of the plurality of processes in relation to each of the predetermined risk prioritization factors.

3. The apparatus of claim 1, wherein the risk weighting routine is further configured to receive, from one or more risk owner participants, the importance indicator for each of the risk prioritization factors in comparison to each of the other risk prioritization factors.

4. The apparatus of claim 2, wherein the process risk prioritization application further comprises a process-to-risk applicability input mechanism configured to receive, from the line-of-business entity, the applicability score for each of the plurality of processes in relation to each of the predetermined risk prioritization factors.

5. The apparatus of claim 3, further wherein the process risk prioritization application further comprises a risk-factor importance input mechanism configured to, receive, from one or more risk owner participants, the importance indicator for each of the risk prioritization factors in comparison to each of the other risk prioritization factors.

6. The apparatus of claim 1, wherein the risk weighting routine is further configured to implement Analytical Hierarchy Process (AHP) to determine the risk weightings.

7. The apparatus of claim 1, wherein the risk weighting routine is further configured to receive the importance indicator, wherein the importance indicator is one of (1) much more important, (2) more important, (3) equally important, (4) less important or (5) much less important.

8. The apparatus of claim 1, wherein the risk score routine is further configured to receive the applicability weighting factor for each of the plurality of processes in relation to each of the plurality of risk prioritization factors, wherein the plurality of risk prioritization factors include two or more of technology risk, financial risk, regulatory risk, external risk, operational risk, strategy risk, associate risk and customer risk.

9. The apparatus of claim 1 wherein the risk score routine is further configured to determine a plurality of products by multiplying, for each risk prioritization factor, the applicability score by the risk weighting and summing the products to result in the risk score.

10. The apparatus of claim 1, wherein the risk score routine is further configured to determine, for each of the plurality of processes, a risk rating category based on the risk score.

11. A method for prioritizing processes based on risk, the method comprising:

receiving, at a first entity level, an applicability score for each of a plurality of processes in relation to each of a plurality of predetermined risk prioritization factors;

receiving, at a second entity level, an importance indicator for each of the risk prioritization factors in comparison to each of the other risk prioritization factors;

determining, via a computing device processor, a risk weighting for each of the risk prioritization factors based on the importance indicators;

determining, via a computing device processor, a risk score for each of the processes based on the applicability score and the risk weighting; and

determining, via a computing device processor, a risk priority for the processes based on the risk scores.

12. The method of claim 11, wherein receiving the applicability score further comprises receiving, from one or more line-of-business participants, the applicability score for each of the plurality of processes in relation to each of the plurality of predetermined risk prioritization factors.

13. The method of claim 11, wherein receiving the importance indicator further comprises receiving, from a risk-owner level, the importance indicator for each of the risk prioritization factors in comparison to each of the other prioritization factors.

14. The method of claim 11, wherein determining a risk weighting further comprises determining, via the computing device processor, the risk weighting by implementing Analytical Hierarchy Process (AHP).

15. The method of claim 11, wherein receiving the importance indicator further comprises receiving the importance indicator, wherein the importance indicator is one of (1) much more important, (2) more important, (3) equally important, (4) less important and (5) much less important.

16. The method of claim 11, wherein receiving an applicability score further comprises receiving the applicability score for each of the plurality of processes in relation to each of the plurality of risk prioritization factors, wherein the plurality of risk prioritization factors include two or more of technology risk, financial risk, regulatory risk, external risk, operational risk, strategy risk, associate risk and customer risk.

17. The method of claim 11, wherein determining the risk score further comprises multiplying, via a computing device processor, for each risk prioritization factor, the applicability score by the risk weighting to result in a product and summing, via the computing device processor, the products to result in the risk score.

18. The method of claim 11, further comprising determining, via a computing device processor, for each of the plurality of processes, a risk rating category based on the risk score.

19. The method of claim 11, further comprising applying the priority for each of the plurality of processes to a design of process controls to insure that process controls are commiserate with risk.

20. A computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to receive a plurality of processes and an applicability score for each of the plurality of processes in relation to each of a plurality of predetermined risk prioritization factors;

a second set of codes for causing a computer to receive an importance indicator for each of the risk prioritization factors in comparison to each of the other risk prioritization factors;

a third set of codes for causing a computer to determine a risk weighting for each of the risk prioritization factors based on the importance indicators;

a fourth set of codes for causing a computer to determine a risk score for each of the processes based on the applicability score and the risk weighting; and

a fifth set of codes for causing a computer to determine a risk priority for the processes based on the risk scores.

21. The computer program product of claim 20, wherein the first set of codes is further configured to cause the computer to receive, from one or more line-of-business participants, a plurality of processes and an applicability score for each of the plurality of processes in relation to each of a plurality of predetermined risk prioritization factors

22. The computer program product of claim 20, wherein the second set of codes is further configured to cause the computer to receive, from one or more risk owner participants, the importance indicator for each of the risk prioritization factors in comparison to each of the other prioritization factors.

23. The computer program product of claim 20, wherein the third set of codes is further configured to cause the computer to determine the risk weighting by implementing Analytical Hierarchy Process (AHP).

24. The computer program product of claim 20, wherein the second set of codes is further configured to cause the computer to receive the importance indicator, wherein the importance indicator is one of (1) much more important, (2) more important, (3) equally important, (4) less important and (5) much less important.

25. The computer program product of claim 20, wherein the first set of codes is further configured to receive the applicability score for each of the plurality of processes in relation to each of the plurality of risk prioritization factors, wherein the plurality of risk prioritization factors include two or more of technology risk, financial risk, regulatory risk, external risk, operational risk, strategy risk, associate risk and customer risk.

26. The computer program product of claim 20, wherein the fourth set of codes is further configured to cause the computer to multiply, for each risk prioritization factor, the applicability score by the risk weighting to result in a product and sum the products to result in the risk score.

27. The computer program product of claim 20, further comprising a sixth set of codes for causing a computer to determine, for each of the plurality of processes, a risk rating category based on the risk score.