System and methods for integrated compliance monitoring

• US 20030229525A1
• Filed: 08/30/2002
• Published: 12/11/2003
• Est. Priority Date: 06/10/2002
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Ericson, Martin William Jr., Callahan, Roger Michael
• Granted Patent: US 7,853,468 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/06395 Quality analysis or management
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

System and methods for integrated compliance monitoring. Various application modules work together to accomplish risk assessment and compliance monitoring. A risk assessment module facilitates the development of risk ratings based on responses to a plurality of compliance-related questions. The system can also include an action tracking module, and can further include a training module and a self-assessment module to determine individual compliance gaps. A common database is operatively connected to the modules to monitor the completion of assessments and to track actions based on remediation plans. In some embodiments, the invention is implemented via a computing platform or a collection of computing platforms interconnected by a network, such as a corporate intranet, in which case a web browser can facilitate use of the invention.

Claims

1. An integrated compliance monitoring system comprising:

a risk assessment module operable to facilitate the development of risk ratings based on responses to a plurality of compliance related questions;

at least one action tracking module; and

a common database operatively connected to the risk assessment module and the action tracking module, wherein the risk assessment module, the action tracking module, and the common database are together operative to track actions based on remediation plans associated with at least some of the responses to the plurality of compliance related questions.

2. The system of claim 1 further comprising a training module operatively connected to the common database.

3. The system of claim 2 further comprising a self-assessment module operatively connected to the common database.

4. A method of monitoring compliance for an organization, the method comprising the steps of:

collecting a plurality of responses to a plurality of compliance-related questions;

establishing a risk rating for each of the at least some of the plurality of compliance-related questions based at least in part on a response to each question from among the plurality of responses, the risk rating expressing a compliance risk associated with each of the at least some of the plurality of compliance-related questions; and

producing an assessment including at least some of the plurality of responses and the risk rating for each of the at least some of the plurality of compliance-related questions.

5. The method of claim 4 further comprising the step of calculating an overall risk rating based on the risk rating for each of the at least some of the plurality of compliance-related questions and wherein the assessment further includes the over-all risk rating.

6. The method of claim 4 further comprising the step of acquiring an approval for the assessment.

7. The method of claim 5 further comprising the step of acquiring an approval for the assessment.

8. The method of claim 4 further comprising the step of recording a remediation plan associated with at least one of the plurality of compliance-related questions and wherein the assessment includes the remediation plan.

9. The method of claim 8 further comprising the step of tracking actions associated with the remediation plan.

10. The method of claim 5 further comprising the step of recording a remediation plan associated with at least one of the plurality of compliance-related questions and wherein the assessment includes the remediation plan.

11. The method of claim 10 further comprising the step of tracking actions associated with the remediation plan.

12. The method of claim 6 further comprising the step of recording a remediation plan associated with at least one of the plurality of compliance-related questions and wherein the assessment includes the remediation plan.

13. The method of claim 12 further comprising the step of tracking actions associated with the remediation plan.

14. The method of claim 7 further comprising the step of recording a remediation plan associated with at least one of the plurality of compliance-related questions and wherein the assessment includes the remediation plan.

15. The method of claim 14 further comprising the step of tracking actions associated with the remediation plan.

16. A computer program product comprising a computer program for facilitating compliance monitoring, the computer program further comprising:

instructions for collecting responses to a plurality of compliance-related questions;

instructions for establishing risk ratings comprising at least a risk rating for each of at least some of the plurality of compliance-related questions based on the responses, the risk rating expressing a compliance risk associated with each of the at least some of the plurality of compliance-related questions; and

instructions for producing an assessment including at least some of the responses and at least some of the risk ratings.

17. The computer program product of claim 16 wherein the computer program further comprises instructions for acquiring an approval for the assessment.

18. The computer program product of claim 16 wherein the computer program further comprises instructions for recording a remediation plan associated with at least one of the plurality of compliance-related questions.

19. The computer program product of claim 18 wherein the computer program further comprises instructions for tracking actions associated with the remediation plan.

20. The computer program product of claim 17 wherein the computer program further comprises instructions for recording a remediation plan associated with at least one of the plurality of compliance-related questions.

21. The computer program product of claim 20 wherein the computer program further comprises instructions for tracking actions associated with the remediation plan.

22. Apparatus for facilitating compliance monitoring, the apparatus comprising:

means for collecting responses to a plurality of compliance-related questions;

means for establishing risk ratings comprising at least a risk rating for each of at least some of the plurality of compliance-related questions based on the responses, the risk rating expressing a compliance risk associated with each of the at least some of the plurality of compliance-related questions; and

means for producing an assessment including at least some of the responses and at least some of the risk ratings.

23. The apparatus of claim 22 further comprising means for acquiring an approval for the assessment.

24. The apparatus of claim 22 further comprising means for recording a remediation plan associated with at least one of the plurality of compliance-related questions.

25. The apparatus of claim 24 further comprising means for tracking actions associated with the remediation plan.

26. The apparatus of claim 23 further comprising means for recording a remediation plan associated with at least one of the plurality of compliance-related questions.

27. The apparatus of claim 26 further comprising means for tracking actions associated with the remediation plan.

28. A system comprising:

a computing platform further comprising at least one application module for facilitating compliance monitoring, wherein the at least one application module comprises at least a risk assessment module, the risk assessment module operable to produce an assessment by collecting responses to a plurality of compliance-related questions, determining risk ratings, and producing the assessment including at least some of the responses and at least some of the risk ratings; and

a database operatively connected to the at least one application module for storing and retrieving data produced by the at least one application module for facilitating review, approval and action tracking related to the assessment.

29. The system of claim 28 wherein the database is disposed within the computing platform.

30. The system of claim 28 wherein the database is disposed within a server which is operatively connected to the at least one application module through a network.

31. The system of claim 30 wherein the at least one application module is accessed by a user via a web page.

32. The system of claim 31 further comprising an Email server for sending Email notifications related to the assessment.

33. The system of claim 28 wherein the risk assessment module further comprises a plurality of tailored, risk assessment templates.

34. The system of claim 29 wherein the risk assessment module further comprises a plurality of tailored, risk assessment templates.

35. The system of claim 30 wherein the risk assessment module further comprises a plurality of tailored, risk assessment templates.

36. The system of claim 31 wherein the risk assessment module further comprises a plurality of tailored, risk assessment templates.

37. The system of claim 32 wherein the risk assessment module further comprises a plurality of tailored, risk assessment templates.