CHANGE CONVERGENCE RISK PLANNING AND AVOIDANCE

• US 20150199511A1
• Filed: 01/10/2014
• Published: 07/16/2015
• Est. Priority Date: 01/10/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Faile, James W. Jr., Micek, James J., Cummings, Roxanna L., Petersen, Jodi L.
• Granted Patent: US 9,177,138 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities

Abstract

Disclosed is a change convergence risk mitigation system. The change convergence risk mitigation system typically includes a processor, a memory, and a risk mitigation module stored in the memory. The change convergence risk mitigation system is typically configured for: receiving information associated with a plurality of events; determining an event risk score for each of the plurality of events; aggregating the event risk scores of the plurality of events and, based on the event risk scores, determining a risk level for each of the plurality of time periods; identifying a risk mitigation event; determining a risk mitigation time period from the plurality of time periods such that the risk mitigation time period would not have a predefined level if the risk mitigation event occurred during the risk mitigation time period; and providing a recommendation that the risk mitigation event occur during the risk mitigation time period.

Claims

1. A change convergence risk mitigation system, comprising:

a processor;

a memory;

a risk mitigation module stored in the memory, executable by the processor and configured for;

receiving information associated with a plurality of events occurring during a plurality of time periods, wherein the information associated with each event includes event timing information and event risk information;

determining an event risk score for each of the plurality of events;

aggregating the event risk scores of the plurality of events and, based on the event risk scores, determining a risk level for each of the plurality of time periods;

identifying a risk mitigation event;

based on an event risk score of the risk mitigation event, determining a risk mitigation time period from the plurality of time periods such that the risk mitigation time period would not have a predefined level if the risk mitigation event occurred during the risk mitigation time period; and

providing a recommendation that the risk mitigation event occur during the risk mitigation time period.

2. The change convergence risk mitigation system according to claim 1, wherein determining a risk level for each of the plurality of time periods is further based on one or more secondary convergence factors.

3. The change convergence risk mitigation system according to claim 2, wherein the secondary convergence factors comprise a plurality of events during a time period being associated with a common (i) critical business process, (ii) geographic region, (iii) location, (iv) event type, or (v) entity system.

4. The change convergence risk mitigation system according to claim 1, wherein:

identifying a risk mitigation event comprises (i) receiving information associated with a risk mitigation event, the information associated with the risk mitigation event including event risk information, and (ii) determining the event risk score of the risk mitigation event; and

the risk mitigation event is a hypothetical event.

5. The change convergence risk mitigation system according to claim 1, wherein:

receiving information associated with a plurality of events comprises receiving information associated with the risk mitigation event, wherein the information associated with the risk mitigation event includes event timing information and event risk information, the event timing information associated with the risk mitigation event indicating that the risk mitigation event is associated with a first time period;

aggregating the event risk scores of the plurality of events and determining a risk level for each of the plurality of time periods comprises determining that the first time period has the predefined risk level;

identifying the risk mitigation event is based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period; and

determining the risk mitigation time period from the plurality of time periods is further based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period.

6. The change convergence risk mitigation system according to claim 1, wherein the predefined risk level comprises a high and/or elevated risk level.

7. A computer program product for change convergence risk mitigation comprising a non-transitory computer-readable storage medium having computer-executable instructions for:

receiving information associated with a plurality of events occurring during a plurality of time periods, wherein the information associated with each event includes event timing information and event risk information;

determining an event risk score for each of the plurality of events;

aggregating the event risk scores of the plurality of events and, based on the event risk scores, determining a risk level for each of the plurality of time periods;

identifying a risk mitigation event;

based on an event risk score of the risk mitigation event, determining a risk mitigation time period from the plurality of time periods such that the risk mitigation time period would not have a predefined level if the risk mitigation event occurred during the risk mitigation time period; and

providing a recommendation that the risk mitigation event occur during the risk mitigation time period.

8. The computer program product according to claim 7, wherein determining a risk level for each of the plurality of time periods is further based on one or more secondary convergence factors.

9. The computer program product according to claim 8, wherein the secondary convergence factors comprise a plurality of events during a time period being associated with a common (i) critical business process, (ii) geographic region, (iii) location, (iv) event type, or (v) entity system.

10. The computer program product according to claim 7, wherein:

identifying a risk mitigation event comprises (i) receiving information associated with a risk mitigation event, the information associated with the risk mitigation event including event risk information, and (ii) determining the event risk score of the risk mitigation event; and

the risk mitigation event is a hypothetical event.

11. The computer program product according to claim 7, wherein:

receiving information associated with a plurality of events comprises receiving information associated with the risk mitigation event, wherein the information associated with the risk mitigation event includes event timing information and event risk information, the event timing information associated with the risk mitigation event indicating that the risk mitigation event is associated with a first time period;

aggregating the event risk scores of the plurality of events and determining a risk level for each of the plurality of time periods comprises determining that the first time period has the predefined risk level;

identifying the risk mitigation event is based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period; and

determining the risk mitigation time period from the plurality of time periods is further based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period.

12. The computer program product according to claim 7, wherein the predefined risk level comprises a high and/or elevated risk level.

13. A method for change convergence risk mitigation, comprising:

receiving, via a processor, information associated with a plurality of events occurring during a plurality of time periods, wherein the information associated with each event includes event timing information and event risk information;

determining, via a processor, an event risk score for each of the plurality of events;

aggregating, via a processor, the event risk scores of the plurality of events and, based on the event risk scores, determining a risk level for each of the plurality of time periods;

identifying, via a processor, a risk mitigation event;

based on an event risk score of the risk mitigation event, determining, via a processor, a risk mitigation time period from the plurality of time periods such that the risk mitigation time period would not have a predefined level if the risk mitigation event occurred during the risk mitigation time period; and

providing, via a processor, a recommendation that the risk mitigation event occur during the risk mitigation time period.

14. The method according to claim 13, wherein determining a risk level for each of the plurality of time periods is further based on one or more secondary convergence factors.

15. The method according to claim 14, wherein the secondary convergence factors comprise a plurality of events during a time period being associated with a common (i) critical business process, (ii) geographic region, (iii) location, (iv) event type, or (v) entity system.

16. The method according to claim 13, wherein:

identifying a risk mitigation event comprises (i) receiving information associated with a risk mitigation event, the information associated with the risk mitigation event including event risk information, and (ii) determining the event risk score of the risk mitigation event; and

the risk mitigation event is a hypothetical event.

17. The method according to claim 13, wherein:

receiving information associated with a plurality of events comprises receiving information associated with the risk mitigation event, wherein the information associated with the risk mitigation event includes event timing information and event risk information, the event timing information associated with the risk mitigation event indicating that the risk mitigation event is associated with a first time period;

aggregating the event risk scores of the plurality of events and determining a risk level for each of the plurality of time periods comprises determining that the first time period has the predefined risk level;

identifying the risk mitigation event is based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period; and

determining the risk mitigation time period from the plurality of time periods is further based on (i) determining that the first time period has the predefined risk level and (ii) determining that the first time period would not have the predefined risk level if the risk mitigation event was not associated with the first time period.

18. The method according to claim 13, wherein the predefined risk level comprises a high and/or elevated risk level.