Automatic compliance tools
A facility for representing a mandate occurring in an authority document with a control is described. For each of one or more controls in a set of existing controls, the facility determines a similarity score measuring the similarity of the mandate and the control; where the similarity score exceeds a similarity threshold, the facility links the mandate to the control. Where the mandate is not linked to any control in the set of controls, the facility adds a control to the set of controls that is based on the mandate, and links the mandate to the added control.
1. A method comprising:
accessing at least one source authority document comprising mandates;
determining a group of controls, each control in the group of controls representing one or more of the mandates of the at least one source authority document, based, at least in part, on a similarity rating between individual controls and individual mandates, and
wherein the similarity rating between a particular control and a particular mandate is determined by:
identifying a control verb in the particular control and a control noun in the particular control,
identifying a mandate verb in the particular mandate and a mandate noun in the particular mandate,
determining a first minimum quantity of edges in accordance with a first shortest path identified between the control verb and the mandate verb in a semantic graph,
determining a second minimum quantity of edges in accordance with a second shortest path identified between the control noun and the mandate noun in the semantic graph, and
computing the similarity rating based on a combination of the first minimum quantity of edges with the second minimum quantity of edges; and
generating a substitute authority document containing one copy of each control of the determined group of controls.
2. The method of claim 1 , wherein the mandate noun is the object of the mandate verb, semantically.
3. The method of claim 1 , wherein the semantic graph represents relationships between terms including at least one of a word or phrase.
4. The method of claim 3 , wherein the semantic graph includes nodes corresponding to the terms, and wherein a node is connected to another node via an edge that identifies a nature of relationship between the terms corresponding to the connected nodes.
5. The method of claim 1 , wherein the similarity rating is inversely related to at least one of the first minimum quantity of edges or second minimum quantity of edges.
6. The method of claim 5 , wherein the similarity rating is inversely related to a weighted combination of the first minimum quantity of edges and second minimum quantity of edges.
7. The method of claim 6 , wherein in the weighted combination, a weight associated with the first minimum quantity of edges is greater than a weight associated with the second minimum quantity of edges.
8. The method of claim 1 , wherein determining the group of controls comprises constructing at least one of the controls, in the group of controls, based on one or more of the mandates of the at least one source authority document.
9. A computer-readable medium excluding transitory signals, per se, the computer-readable medium storing instructions that, when executed by a computing system, cause the computing system to perform a method, the method comprising:
accessing at least one source authority document comprising mandates;
determining a group of controls, each control in the group of controls representing one or more of the mandates of the at least one source authority document, based, at least in part, on a similarity rating between individual controls and individual mandates, and
wherein the similarity rating between a particular control and a particular mandate is determined by:
identifying a control verb in the particular control and a control noun in the particular control,
identifying a mandate verb in the particular mandate and a mandate noun in the particular mandate,
determining a first distance in accordance with a first shortest path identified between the control verb and the mandate verb in a semantic graph,
determining a second distance in accordance with a second shortest path identified between the control noun and the mandate noun in the semantic graph, and
computing the similarity rating based on the first distance between the control verb and the mandate verb and the second distance between the control noun and the mandate noun; and
generating a substitute authority document containing one copy of each control of at least a subset of the determined group of controls.
10. The computer-readable medium of claim 9 , wherein the method further comprises:
accessing a set of contextual authority documents; and
determining controls representing the mandates from the contextual authority documents;
wherein at least two controls in the group of controls are controls from the contextual authority documents.
11. The computer-readable medium of claim 9 , wherein the semantic graph includes nodes corresponding to terms, and wherein a node is connected to another node via an edge that identifies a nature of relationship between the terms corresponding to the connected nodes.
12. The computer-readable medium of claim 9 , wherein the similarity rating is inversely related to at least one of the first distance or second distance.
13. The computer-readable medium of claim 12 , wherein the similarity rating is inversely related to a weighted combination of the first distance and second distance.
14. The computer-readable medium of claim 9 ,
wherein at least one control in the group of controls represents multiple of the mandates; and
wherein each of the multiple mandates represented by a corresponding control is represented by that control based on a determination that each of those multiple mandates can be satisfied by an action that satisfies the control.
15. The computer-readable medium of claim 9 , wherein
wherein at least a particular control, in the group of controls, represents multiple of the mandates; and
wherein that particular control represents each particular mandate, of the multiple mandates, based on a determination that a similarity rating between the particular control and the particular mandate is above a threshold.
16. A computing system comprising:
one or more processors; and
one or more memories storing instructions that, when executed by the one or more processors, cause the computing system to perform a process comprising:
accessing at least one source authority document comprising mandates;
determining a group of controls, each control in the group of controls representing one or more of the mandates of the at least one source authority document, based, at least in part, on a similarity rating between individual controls and individual mandates, and
wherein the similarity rating between a particular control and a particular mandate is determined by:
identifying a control verb in the particular control and a control noun in the particular control,
identifying a mandate verb in the particular mandate and a mandate noun in the particular mandate,
determining a first distance in accordance with a first shortest path identified between the control verb and the mandate verb in a semantic graph,
determining a second distance in accordance with a second shortest path identified between the control noun and the mandate noun in the semantic graph, and
computing the similarity rating based on the first distance between the control verb and the mandate verb and the second distance between the control noun and the mandate noun; and
generating a substitute authority document containing one copy of each control of at least a subset of the determined group of controls.
17. The computing system of claim 16 , wherein the mandate noun is the object of the mandate verb, semantically.
18. The computing system of claim 16 , wherein the semantic graph represents relationships between terms including at least one of a words or phrase.
19. The computing system of claim 16 , wherein the first distance is determined based on a minimum number of edges between two nodes representing the control verb and the mandate verb.
20. The computing system of claim 16 , wherein the process further comprises linking each control, in the group of controls, to the mandates that control represents.