Patent ID: 7260549
Filing Date: 2007-08-21
Classification: G06Q

Abstract:
1. A method for determining compliance with organizational business policies associated with a business risk, said method comprising: a. a computer, coupled to a server via a network, receiving a user selection of a business risk element from a business risk element list which is displayed to the user, said business risk element list being retrieved from a database coupled to said computer via said network; b. in response to the selection of said business risk element, the computer retrieving one or more predetermined control procedures, the control procedures identified by an administrator as a means for complying with business policies associated with said selected business risk element; c. the computer associating said one or more predetermined control procedures with said selected business risk element, said predetermined control procedures being stored in said database; d. in response to the retrieving of the control procedures, the computer retrieving a weight assigned to each one of said predetermined control procedures, said weight being stored in said database; e. the computer receiving a user selection of a compliance rating for each said predetermined control procedure, the rating selected by the user indicating a level of compliance with each one of said predetermined control procedures, for each of said predetermined control procedures the level of compliance is a subjective rating selected from a rigid set of compliance ratings, the same set of compliance ratings is available for each of said predetermined control procedures, wherein said compliance ratings comprise at least one rating identifying a non-fully compliant control procedures; f. the computer calculating a compliance score, said compliance score being a function of said assigned weights and said compliance rating of said predetermined control procedures; g. for each said control procedure having a non-fully compliant rating, the computer receiving a user generated signal indicating whether said non-fully compliant rating is accepted or not accepted; and h. for each said non-fully compliant control procedure which is indicated as not accepted, requiring the user to provide signals for generating an action plan.