Assessing and managing computational risk involved with integrating third party computing functionality within a computing system

Patent metadata

Field	Value
Publication number	US-11816224-B2
Application number	US-202217977285-A
Country	US
Kind code	B2
Filing date	Oct 31, 2022
Priority date	Apr 16, 2021
Publication date	Nov 14, 2023
Grant date	Nov 14, 2023

Abstract

In general, various aspects of the present disclosure provide methods, apparatuses, systems, computing devices, computing entities, and/or the like for addressing a modified risk rating identifying a risk to an entity of having computer-implemented functionality provided by a vendor integrated with a computing system of the entity. In accordance various aspects, a method is provided that comprises: receiving a first assessment dataset for computer-implemented functionality; detecting an inconsistency between a value of an attribute for the computer-implemented functionality specified in the first assessment dataset and a corresponding value of the attribute specified in a second assessment dataset for the computer-implemented functionality; modifying a risk rating that identifies a risk to the entity of having the computer-implemented functionality integrated with the computing system to generate a modified risk rating based on the inconsistency; and in response, performing an action with respect to the computing system to address the modified risk rating.

First claim

What is claimed:

1. A method comprising:
providing, by computing hardware, a first question from a set of questions found in an electronic assessment for display on a user interface, wherein the user interface solicits a first answer to the first question, and the set of questions relates to computer-implemented functionality provided by a vendor;
receiving, by the computing hardware and via the user interface, the first answer to the first question to provide a first question/answer pairing;
mapping, by the computing hardware, the first question/answer pairing to an attribute related to the computer-implemented functionality;
mapping, by the computing hardware, the attribute to a second question/answer pairing, wherein the second question/answer pairing:
is related to the attribute,
comprises a second question of the set of questions, and
comprises a second answer provided to the second question;

comparing, by the computing hardware, the first answer to the second answer to identify an inconsistency in the first answer with respect to the second answer;
determining, by the computing hardware, to address the inconsistency; and
responsive to determining to address the inconsistency, performing, by the computing hardware, an action to address the inconsistency, wherein the action comprises at least one of:
(1) prompting, via the user interface, to provide at least one of supporting information or supporting documentation to address the inconsistency, (2) providing, via the user interface, a follow up question related to the inconsistency, or (3) requesting, via the user interface, the inconsistency in the first answer to be redressed.

2. The method of claim 1 , wherein determining to address the inconsistency comprises processing the inconsistency via a decision engine to generate a relevance of the inconsistency, the decision engine comprising a rules-based model configured to use a set of rules in determining a level of the inconsistency as a measure of the relevance of the inconsistency.

3. The method of claim 1 further comprising determining, by the computing hardware, the action to perform by:
processing at least one of the first question/answer pairing or the second question/answer pairing using a machine-learning model to generate a data representation having a set of predictions in which each prediction is associated with a particular action to take to address the inconsistency; and
selecting, based on the set of predictions, the action to address the inconsistency.

4. The method of claim 3 , wherein the machine-learning model is trained using training data derived from responses to follow up requests previously provided for inconsistencies detected in past assessment question/answer pairings that comprises at least one of (1) whether the inconsistencies detected in the past assessment question/answer pairings were ignored, (2) whether related follow up actions for the inconsistencies detected in the past assessment question/answer pairings were ignored, (3) particular types of actions taken in response to the inconsistencies detected in the past assessment question/answer pairings, or (4) at least one of a framework or standard that is mapped to the past assessment question/answer pairings.

5. The method of claim 1 , wherein mapping the first question/answer pairing to the attribute related to the computingcomputer-implemented functionality and mapping the attribute to the second question/answer pairing is performed via a data structure that maps the first question/answer pairing and the second question/answer pairing to the attribute.

6. The method of claim 1 , wherein the first answer and the second answer are in a freeform text format and comparing the first answer to the second answer to identify the inconsistency in the first answer with respect to the second answer involves:
performing a natural language processing technique on the first answer to generate a first embedded representation of the first answer,
performing the natural language processing technique on the second answer to generate a second embedded representation of the second answer, and
comparing the first embedded representation to the second embedded representation to identify the inconsistency.

7. The method of claim 1 further comprising determining, by the computing hardware, the action to take to address the inconsistency based on at least one of a type of the attribute or a past response to a past inconsistency related to the attribute.

8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
providing a first question found in an electronic assessment for display on a user interface, wherein the user interface solicits a first answer to the first question, and the first question relates to computer-implemented functionality;
receiving, via the user interface, the first answer to the first question to provide a first question/answer pairing;
mapping the first question/answer pairing to a plurality of attributes related to the computer-implemented functionality;
mapping the plurality of attributes to a second question/answer pairing, wherein the second question/answer pairing comprises a second question, and a second answer provided to the second question;
comparing the first answer to the second answer to identify an inconsistency in the first answer with respect to the second answer;
determining to address the inconsistency; and
responsive to determining to address the inconsistency, performing an action to address the inconsistency, wherein the action comprises at least one of: (1) prompting, via the user interface, to provide at least one of supporting information or supporting documentation to address the inconsistency, (2) providing, via the user interface, a follow up question related to the inconsistency, or (3) requesting, via the user interface, the inconsistency in the first answer to be redressed.

9. The system of claim 8 , wherein determining to address the inconsistency comprises processing the inconsistency using a rules-based model configured to use a set of rules in determining a level of the inconsistency as a measure of a relevance of the inconsistency.

10. The system of claim 8 , wherein the operations further comprise determining the action to perform by:
processing at least one of the first question/answer pairing or the second question/answer pairing using a machine-learning model to generate a data representation having a set of predictions in which each prediction is associated with a particular action to take to address the inconsistency; and
selecting, based on the set of predictions, the action to address the inconsistency.

11. The system of claim 10 , wherein the machine-learning model is trained using training data derived from responses to follow up requests previously provided for inconsistencies detected in past assessment question/answer pairings that comprises at least one of (1) whether the inconsistencies detected in the past assessment question/answer pairings were ignored, (2) whether related follow up actions for the inconsistencies detected in the past assessment question/answer pairings were ignored, (3) particular types of actions taken in response to the inconsistencies detected in the past assessment question/answer pairings, or (4) at least one of a framework or standard that is mapped to the past assessment question/answer pairings.

12. The system of claim 8 , wherein mapping the

Assignees

• Onetrust Llc

Inventors

• Sabourin Jason L
• Patel Shiven

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• G06Q10/0635

  Risk analysis of enterprise or organisation activities · CPC title