Patent ID: 11907959
Assignee: VENMINDER, INC.
Field: IT methods for management (Electrical engineering)
Classification: CPC G | IPC G

Claim 12:
13. A method for determining risk levels associated with a vendor, the method comprising the steps of:
causing to display, by a processor of an enterprise system, one or more graphical user interfaces (GUIs) associated with one or more risk assessment modules, the risk assessment modules comprising a template management module for managing questionnaire templates;
receiving, by a processor of an enterprise system, a first input from a first client, the first input comprising instructions to access a selected module of the one or more risk assessment modules;
performing, by the first client, a multi-step risk assessment comprising:
(a) determining an inherent risk score based on an inherent risk associated with the vendor by answering, by the first client, a plurality of inherent risk questions based on at least one of (1) internal policies of the vendor, (2) internal procedures of the vendor, and (3) the line of business in which the vendor is engaged, each of the plurality of inherent risk questions falling into one of a plurality of inherent risk sections, each inherent risk section comprising an associated section weight, each of the inherent risk questions comprising a question weight within the corresponding inherent risk section;
(b) assessing mitigating controls for the vendor by answering a plurality of residual risk questions, each of the plurality of residual risk questions falling into one of a plurality of residual risk sections, each residual risk section comprising an associated section weight, each of the residual risk questions comprising a question weight within the corresponding residual risk section;
(c) determining a residual risk score representative of a residual risk associated with the vendor after application of the mitigating controls to the vendor, the residual risk score being equal to the inherent risk score after adjusting for a mitigation allowance, the mitigation allowance being determined based on answers to the residual risk questions; and
(d) determining, by the first client, a final risk score, the final risk score based at least partially on each of the inherent risk score, the residual risk score, the question weights, and the section weights; and

receiving, by the processor of the enterprise system, subsequent input from the first client specific to the selected risk assessment module, the subsequent inputs comprising answers to at least one of the inherent risk questions and the residual risk questions;
wherein determining at least one of the inherent risk score and the residual risk score comprises adjusting, by the first client, at least one of an inherent risk section weight and an inherent risk question weight.