Patent ID: 11907959
Assignee: VENMINDER, INC.
Field: IT methods for management (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method for determining risk levels associated with a vendor, the method comprising the steps of:
causing to display, by a processor of an enterprise system, one or more graphical user interfaces (GUIs) associated with one or more risk assessment modules, the risk assessment modules comprising a template management module for managing questionnaire templates;
receiving, by a processor of an enterprise system, a first input from a first client, the first input comprising instructions to access a selected module of the one or more risk assessment modules;
performing, by the first client, a multi-step risk assessment comprising:
(a) determining an inherent risk score based on an inherent risk associated with the vendor by answering, by the first client, a plurality of inherent risk questions based on at least one attribute that is specific to the vendor;
(b) assessing mitigating controls for the vendor by answering a plurality of residual risk questions, the residual risk questions being based on at least one of the following analyses of the vendor: financial analyses, cyber-security reviews, expert reviews, and assessment of regulatory requirements, wherein each of the inherent risk questions and each of the residual risk questions fall within one of a plurality of risk levels upon which the vendor is evaluated; and
(c) determining a residual risk score representative of a residual risk associated with the vendor after application of the mitigating controls to the vendor, the residual risk score being equal to the inherent risk score after adjusting for a mitigation allowance, the mitigation allowance being determined based on answers to the residual risk questions;

receiving, by the processor of the enterprise system, subsequent input from the first client specific to the selected risk assessment module, the subsequent input comprising answers to at least one of the inherent risk questions and the residual risk questions; and
updating, in a memory of the enterprise system, risk assessments information stored in association with the first client, based on the subsequent input, the risk assessments information comprising at least one of (1) the inherent risk score, and (2) the residual risk score;
wherein the template management module comprises a residual risk flag which:
when turned “off,” hides a residual risk module in which the residual risk questions are displayed, and
when turned “on,” causes a weighted question feature for the inherent risk score to be visible within the risk assessments module.