System and method for risk detection reporting and infrastructure

• US 20050021360A1
• Filed: 06/08/2004
• Published: 01/27/2005
• Est. Priority Date: 06/09/2003
• Status: Active Grant

• Current Assignee: Smartsafety Software Inc.
• Original Assignee: A-T Solutions (PAE, Inc.)
• Inventors: Miller, Charles J., Rosenkrantz, Noah J., Frankel, Yair
• Granted Patent: US 8,484,066 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/08 Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method, a system, and a device for monitoring risks associated with at least one business process, including: evaluating at least one of a plurality of document instances, wherein each of the document instances includes, in association therewith, a plurality of document values, against a plurality of risk categories; implementing the plurality of risk categories pursuant to at least one acceptable risk policy approved for the at least one business process; and qualifying at least one of the at least one of the plurality of documents pursuant to an approval rating of the at least one document in at least one risk category. The system, method, and device efficiently monitor risk, and allow for flexibility in modifying or updating risk policy.

Claims

1. A method for monitoring risks associated with at least one business process, comprising the steps of:

evaluating at least one of a plurality of document instances, wherein each of said document instances includes, in association therewith, a plurality of document values, against a plurality of risk categories;

implementing said plurality of risk categories pursuant to at least one acceptable risk policy approved for the at least one business process; and

qualifying at least one of the at least one of the plurality of documents pursuant to an approval rating of the at least one document in at least one risk category.

2. The method of claim 1, wherein the risk is associated with infrastructure.

3. The method of claim 1, wherein said evaluating comprises a required intervening by at least one member of a group specified in the at least one acceptable risk policy.

4. The method of claim 3, wherein said implementing comprises at least one notification to the at least one member.

5. The method of claim 1, wherein said qualifying allows the at least one document to enter the business process.

6. The method of claim 1, wherein the document comprises a survey.

7. The method of claim 1, wherein the document comprises a superset of a second plurality of documents.

8. The method of claim 1, where said risk policies may be hierarchical.

9. The method of claim 1, wherein the qualifications may be hierarchical.

10. The method of claim 1, where the document describes at least one asset in the business process.

11. The method of claim 10, where said evaluating comprises evaluating for at least one of the group consisting of controls on physical security, controls on personnel security, controls on data systems, historical controls, insurance, actions against the asset, contractual controls, vendor controls, record keeping, and auditing controls.

12. The method of claim 11, wherein the auditing controls include authorization.

13. The method of claim 11, wherein the auditing controls include denial.

14. The method of claim 11, wherein the auditing controls include physical custody.

15. The method of claim 1, wherein said qualifying disallows use of the at least one document in the business process.

16. A method for monitoring risks associated with at least one business process, comprising the steps of:

evaluating at least one of a plurality of document instances, wherein each of said document instances includes, in association therewith, a plurality of document values, against a plurality of risk categories;

implementing said plurality of risk categories pursuant to at least one acceptable risk policy approved for the at least one business process; and

disqualifying at least one of the at least one of the plurality of documents pursuant to a disapproval rating of the at least one document in at least one risk category.

17. The method of claim 16, wherein the risk is associated with infrastructure.

18. The method of claim 16, wherein said evaluating comprises a required intervening by at least one member of a group specified in the at least one acceptable risk policy.

19. he method of claim 16, wherein said qualifying allows the at least one document to enter the business process.

20. The method of claim 16, where said risk policies may be hierarchical.

21. The method of claim 16, wherein the qualifications may be hierarchical.