Determining relative risk in a network system

Patent metadata

Field	Value
Publication number	US-2022351098-A1
Application number	US-202217730300-A
Country	US
Kind code	A1
Filing date	Apr 27, 2022
Priority date	Apr 30, 2021
Publication date	Nov 3, 2022
Grant date	—

Abstract

Relative risk in a network system can be determined according to some examples. For example, a system can receive a plurality of risk data for a plurality of risk factors within a network. The system can determine a hierarchy of groupings for the plurality of risk factors. The system can determine a plurality of associations between the plurality of risk data and a plurality of predetermined risk controls. Each predetermined risk control can represent an amount of control for reducing the riskiness of a risk factor. The system can determine a risk assessment for each grouping of the hierarchy of groupings based on the plurality of risk data, the plurality of predetermined risk controls, and the hierarchy of groupings. The system can output the risk assessment for each grouping of the hierarchy of groupings for display on a user interface.

First claim

What is claimed is:

1 . A system comprising:
a processor; and a non-transitory computer-readable memory comprising instructions that are executable by the processor for causing the processor to:
receive a plurality of risk data for a plurality of risk factors within a network;
determine a hierarchy of groupings for the plurality of risk factors;
determine a plurality of associations between the plurality of risk data and a plurality of predetermined risk controls, each predetermined risk control of the plurality of predetermined risk controls representing an amount of control for reducing riskiness of a risk factor for the plurality of risk factors;
determine a risk assessment for each grouping of the hierarchy of groupings based on the plurality of risk data, the plurality of predetermined risk controls, and the hierarchy of groupings; and
output the risk assessment for each grouping of the hierarchy of groupings for display on a user interface.

2 . The system of claim 1 , wherein the instructions are further executable by the processor for causing the processor to determine the risk assessment by:
determining a first risk assessment for a first grouping of the hierarchy of groupings and a second risk assessment for a second grouping of the hierarchy of groupings, the first grouping and the second grouping belonging to a same level within the hierarchy of groupings; and determining, based on the first risk assessment and the second risk assessment, a third risk assessment for a third grouping of the hierarchy of groupings, the third grouping comprising the first grouping and the second grouping.

3 . The system of claim 1 , wherein the instructions are further executable by the processor for causing the processor to determine the risk assessment by:
determining, based on a particular risk data of the plurality of risk data, an inherent risk value for a particular risk factor of the plurality of risk factors; determining, based on an association of the plurality of associations between the particular risk data and a particular predetermined risk control of the plurality of predetermined risk controls, a residual risk value for the particular risk factor, the residual risk value representing an amount of risk for the particular risk factor after the particular predetermined risk control is applied to the particular risk factor; and determining the risk assessment based on the inherent risk value and the residual risk value.

4 . The system of claim 3 , wherein the instructions are further executable by the processor for causing the processor to determine the risk assessment by:
determining a risk progress value by comparing the residual risk value with a predetermined acceptable risk level; and determining the risk assessment based on the risk progress value.

5 . The system of claim 4 , wherein the instructions are further executable by the processor for causing the processor to output the risk assessment by:
displaying, on the user interface, the inherent risk value, the residual risk value, and the predetermined acceptable risk level for a grouping of the hierarchy of groupings on a range diagram; and displaying, on the user interface, a ranking of the hierarchy of groupings according to the residual risk value for each grouping of the hierarchy of groupings.

6 . The system of claim 4 , wherein the instructions are further executable for causing the processor to output the risk assessment by:
displaying, on the user interface, a pie chart representing the risk progress value for a grouping of the hierarchy of groupings.

7 . The system of claim 3 , wherein instructions are further executable by the processor for causing the processor to:
determine, based on the residual risk value, a change in the residual risk value over time; and determine the risk assessment based on the change in the residual risk value over time.

8 . A method comprising:
receiving, by a processor, a plurality of risk data for a plurality of risk factors within a network; determining, by the processor, a hierarchy of groupings for the plurality of risk factors; determining, by the processor, a plurality of associations between the plurality of risk data and a plurality of predetermined risk controls, each predetermined risk control of the plurality of predetermined risk controls representing an amount of control for reducing riskiness of a risk factor of the plurality of risk factors; determining, by the processor, a risk assessment for each grouping of the hierarchy of groupings based on the plurality of risk data, the plurality of predetermined risk controls, and the hierarchy of groupings; and outputting, by the processor, the risk assessment for each grouping of the hierarchy of groupings for display on a user interface.

9 . The method of claim 8 , wherein determining the risk assessment comprises:
determining a first risk assessment for a first grouping of the hierarchy of groupings and a second risk assessment for a second grouping of the hierarchy of groupings, the first grouping and the second grouping belonging to a same level within the hierarchy of groupings; and determining, based on the first risk assessment and the second risk assessment, a third risk assessment for a third grouping of the hierarchy of groupings, the third grouping comprising the first grouping and the second grouping.

10 . The method of claim 8 , wherein determining the risk assessment comprises:
determining, based on a particular risk data of the plurality of risk data, an inherent risk value for a particular risk factor of the plurality of risk factors; determining, based on an association of the plurality of associations between the particular risk data and a particular predetermined risk control of the plurality of predetermined risk controls, a residual risk value for the particular risk factor, the residual risk value representing an amount of risk for the particular risk factor after the particular predetermined risk control is applied to the particular risk factor; and determining the risk assessment based on the inherent risk value and the residual risk value.

11 . The method of claim 10 , wherein determining the risk assessment comprises:
determining a risk progress value by comparing the residual risk value with a predetermined acceptable risk level; and determining the risk assessment based on the risk progress value.

12 . The method of claim 11 , wherein outputting the risk assessment comprises:
displaying, on the user interface, the inherent risk value, the residual risk value, and the predetermined acceptable risk level for a grouping of the hierarchy of groupings on a range diagram; and displaying, on the user interface, a ranking of the hierarchy of groupings according to the residual risk value for each grouping of the hierarchy of groupings.

13 . The method of claim 11 , wherein outputting the risk assessment comprises:
displaying, on the user interface, a pie chart representing the risk progress value for a grouping of the hierarchy of groupings.

14 . The method of claim 10 , further comprising:
determining, based on the residual risk value, a change in the residual risk value over time; and determining the risk assessment based on the change in the residual risk value over time.

15 . A non-transitory computer-readable medium comprising program code that is executable by a processor for causing a processor to:
receive a plurality of risk data for a plurality of risk factors within a network; determine a hierarchy of groupings for the plurality of risk factors;

Assignees

• Truist Bank

Inventors

• Sheppard Jason C
• Dick Jennifer

Classifications

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title