SYSTEM AND METHOD FOR ENTERPRISE RISK MANAGEMENT
A system and method for assessing, controlling, and reporting risk in an enterprise related to governance, risk management, and compliance activities.
1 . A system for managing risk in an enterprise comprising a process automation workflow, a plurality of dynamic forms, and a central repository of electronically embodied risk control methods.
2 . A method for unifying a risk controlled governance and performance management enterprise application comprising the processes of:
identifying a risk among a universe of governance and performance risks applicable to an enterprise;
associating a risk with a performance metric or a governance objective; and
setting scoping rules for risk control.
3 . The method of claim two wherein the step of setting scoping rules for risk control further comprises at least one of
applying a threshold value to a continuous numerical indicator of key risk and identifying a trigger event relating to a loss in the universe of governance and performance risks.
4 . The method of claim two wherein governance and performance risks comprise financial operation risks and regulatory compliance risks.
5 . The method of claim four wherein risks further comprise uncertainty in budgeting planning, financial performance, decision making, and compliance tasks.
6 . The method of claim two further comprising displaying the status of risks assigned the property of “in scope” associated with a business process automation process.
7 . The method of claim two wherein identifying a risk comprises the steps of
establishing a control hierarchy,
determining a risk priority,
quantifying a risk materiality to a business process,
scheduling controls, and
activating a risk control process.
8 . A method comprising a risk control planning process,
a risk control execution process, and
a risk control reporting process
whereby an enterprise recognizes a universe of risks, tracks the status of material and significant risks, and includes risk optimization in its budgeting, compliance, financial reporting, and decision making on a day to day basis.
9 . The risk control reporting process of claim eight comprising the steps of certifying results of a control task,
disclosing a result of a control task, and
retaining an audit trail of a control task.
10 . The risk control reporting process of claim nine further comprising the steps of
determining the readiness of a control task,
reporting results of a control task, and
reviewing effectiveness of a control task.
11 . The risk control execution process of claim eight comprising the steps of
testing control tasks,
performing control tasks, and
reviewing the output of control tasks.
12 . The risk control execution process of claim eleven further comprising
managing the workload of control tasks,
monitoring the progress of control tasks, and
remediating weaknesses of control tasks.
13 . The risk control planning process of claim eight comprising the steps of
identifying a risk,
establishing a control hierarchy of risks,
determining risk priorities, and
determining risk materiality.
14 . The risk control planning process of claim thirteen further comprising the steps
of setting risk control scope,
scheduling risk controls, and
activating risk controls.
15 . The method of claim eight further comprising the step of displaying a list of on-time and late risks organized by relative impact on financial statement line items.
16 . The method of claim eight further comprising the step of displaying progress of risk universe control activities according to on-time, and late.
17 . The method of claim eight further comprising the step of displaying a heat map view of risk universe.
18 . The method of claim eight further comprising the step of displaying real time status of risk tasks and remediation activities.
19 . The method of claim eight further comprising the step of displaying for a risk control its status if done, passed, late, and failed and its applicable period ,and its impact, owner and due date if active or late.
20 . The method of claim eight further comprising the step of applying scoping rules to a compliance activity as a condition of scheduling a compliance activity.
21 . The method of claim eight further comprising the step of linking a control activity to a member of a risk universe.
22 . An article of manufacture comprising computer readable electronic media in which is encoded a program product adapted to control a processor, tangibly embodying a method for managing risk in an enterprise comprising a process automation workflow comprising the processes of
identifying a risk among a universe of governance and performance risks;
associating a risk with a performance metric; and
setting scoping rules for risk control.
23 . The article of claim 22 further comprising:
applying a threshold value to a continuous numerical indicator of key risk and identifying a trigger event relating to a loss;
displaying the status of risks assigned the property of “in-scope”,
displaying the status of risk controls as “on-time”, “late”, and its impact, owner, and due date if active or late.
24 . The article of claim 22 further comprising:
establishing a control hierarchy,
determining relative risk priority,
quantifying risk materiality, and
scheduling and activating a risk control process.
25 . A method comprising the processes of:
displaying real time status of risk control tasks and of remediating activities;
defining a scoping rule for a risk control which activates scheduling of risk control tasks;
defining a plurality of risks and a plurality of control activities; and
linking a control activity to a plurality of risks and a risk to a plurality of control activities.