Abstract:
In one embodiment, the invention can be a method of protecting confidentiality in a real-time survey, the method including receiving from each of a plurality of organization respondents a real-time response to a survey topic; receiving an indication of an organizational change affecting a first member of the organization, the organizational change comprising the first member departing or joining a first department, the first department comprising a plurality of first department respondents, the plurality of first department respondents being a first subset of the plurality of organization respondents; defining a first safe group comprising a first subset of the plurality of first department respondents, the first safe group having first safe group responses to the survey topic; and providing a response report for at least the first department, the response report excluding the first safe group responses.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    The present application claims priority to U.S. Provisional Patent Application No. 62/075,097 filed Nov. 4, 2014, the entirety of which is incorporated herein by reference. 
     
    
     BACKGROUND 
       [0002]    Surveys can help an organization to better understand its members. Such surveys generally ask members to provide anonymous answers regarding topics such as engagement, organizational health, and satisfaction. The feedback provided by surveys can help an organization diagnose problems and find new opportunities for improvement. 
         [0003]    When an organization member leaves or joins a department, a resulting change to the department&#39;s aggregate survey results can compromise the confidentiality of the responses of the old or new member. This is especially an issue for real-time survey systems, where changes to survey results can be seen almost immediately. What is needed is a survey system that can better protect the confidentiality of those responding to the survey. 
       BRIEF SUMMARY 
       [0004]    The present disclosure is directed to a method, system, and storage medium for protecting confidentiality in a real-time survey. In one aspect, a method includes receiving from each of a plurality of organization respondents a real-time response to a survey topic; receiving an indication of an organizational change affecting a first member of the organization, the organizational change comprising the first member departing or joining a first department, the first department comprising a plurality of first department respondents, the plurality of first department respondents being a first subset of the plurality of organization respondents; defining a first safe group comprising a first subset of the plurality of first department respondents, the first safe group having first safe group responses to the survey topic; and providing a response report for at least the first department, the response report excluding the first safe group responses. 
         [0005]    In another aspect, a system includes a) respondent devices of first department respondents to a survey topic, wherein i) each of the first department respondents belongs to a first department; ii) each of the respondent devices is configured to execute a first instance of a survey application; and iii) the first instance of the survey application is configured to receive from each of the first department respondents a real-time response to the survey topic; b) a first member device of a first member of the first department; c) a manager device of a manager of the first department; and d) a server configured to i) receive an indication of an organizational change affecting the first member, the organizational change comprising the first member departing the first department; ii) define a safe group comprising a subset of the first department respondents; and iii) hide the responses of the safe group from the manager of the first department. 
         [0006]    In yet another aspect, a non-transitory computer-readable storage medium encoded with instructions which, when executed on a processor, performs a method that includes receiving from each of a plurality of organization respondents a response to a survey topic; receiving an indication of an organizational change affecting a first member of the organization, the organizational change comprising the first member departing or joining a first department, the first department comprising a plurality of first department respondents, the plurality of first department respondents being a first subset of the plurality of organization respondents; defining a first safe group comprising a first subset of the plurality of first department respondents, the first safe group having first safe group responses to the survey topic; and providing a response report for at least the first department, the response report excluding the first safe group responses. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0007]    The invention of the present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein: 
           [0008]      FIG. 1  is a block diagram of a system according to one embodiment of the present invention. 
           [0009]      FIG. 2  is an image of a respondent user interface of a respondent device according to one embodiment of the present invention. 
           [0010]      FIG. 3  is an image of a manager user interface of a manager device according to one embodiment of the present invention. 
           [0011]      FIG. 4  is a block diagram of a hierarchy according to one embodiment of the present invention. 
           [0012]      FIG. 5A  is a block diagram of a hierarchy before and after a member leaves an organization without confidentiality protection according to one embodiment of the present invention. 
           [0013]      FIG. 5B  is a block diagram of a hierarchy before and after a member leaves an organization with confidentiality protection according to one embodiment of the present invention. 
           [0014]      FIG. 6  is a block diagram of a hierarchy before and after a responding member moves laterally within an organization according to one embodiment of the present invention. 
           [0015]      FIG. 7  is a block diagram of a hierarchy before and after a non-responding member moves laterally within an organization according to one embodiment of the present invention. 
           [0016]      FIG. 8  is a block diagram of a hierarchy according to one embodiment of the present invention. 
           [0017]      FIG. 9  is a flow chart of a method where a member moves within a hierarchy according to one embodiment of the invention. 
           [0018]      FIG. 10  is a flow chart of a method for populating a safe group using expanding scopes according to one embodiment of the invention. 
           [0019]      FIG. 11  is a flow chart of a method for populating a safe group from direct reports according to one embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0020]    The following description of the preferred embodiment(s) is merely exemplary in nature and is in no way intended to limit the invention. The description of illustrative embodiments is intended to be read in connection with the accompanying drawings, which are to be considered part of the entire written description. In the description of the exemplary embodiments disclosed herein, any reference to direction or orientation is merely intended for convenience of description and is not intended in any way to limit the scope of the present invention. The discussion herein describes and illustrates some possible non-limiting combinations of features that may exist alone or in other combinations of features. 
         [0021]    Features of the present invention may be implemented in software, hardware, firmware, or combinations thereof. The computer programs described herein are not limited to any particular embodiment, and may be implemented in an operating system, application program, foreground or background processes, driver, or any combination thereof. The computer programs may be executed on a single computer or server processor or multiple computer or server processors. 
         [0022]    Processors described herein may be any central processing unit (CPU), microprocessor, micro-controller, computational, or programmable device or circuit configured for executing computer program instructions (e.g. code). Various processors may be embodied in computer and/or server hardware of any suitable type (e.g. desktop, laptop, notebook, tablets, cellular phones, etc.) and may include all the usual ancillary components necessary to form a functional data processing device including without limitation a bus, software and data storage such as volatile and non-volatile memory, input/output devices, graphical user interfaces (GUIs), removable data storage, and wired and/or wireless communication interface devices including Wi-Fi, Bluetooth, LAN, etc. 
         [0023]    Computer-executable instructions or programs (e.g. software or code) and data described herein may be programmed into and tangibly embodied in a non-transitory computer-readable medium that is accessible to and retrievable by a respective processor as described herein which configures and directs the processor to perform the desired functions and processes by executing the instructions encoded in the medium. A device embodying a programmable processor configured to such non-transitory computer-executable instructions or programs may be referred to as a “programmable device”, or “device”, and multiple programmable devices in mutual communication may be referred to as a “programmable system.” It should be noted that non-transitory “computer-readable medium” as described herein may include, without limitation, any suitable volatile or non-volatile memory including random access memory (RAM) and various types thereof, read-only memory (ROM) and various types thereof, USB flash memory, and magnetic or optical data storage devices (e.g. internal/external hard disks, floppy discs, magnetic tape CD-ROM, DVD-ROM, optical disk, ZIP™ drive, Blu-ray disk, and others), which may be written to and/or read by a processor operably connected to the medium. 
         [0024]    In certain embodiments, the present invention may be embodied in the form of computer-implemented processes and apparatuses such as processor-based data processing and communication systems or computer systems for practicing those processes. The present invention may also be embodied in the form of software or computer program code embodied in a non-transitory computer-readable storage medium, which when loaded into and executed by the data processing and communications systems or computer systems, the computer program code segments configure the processor to create specific logic circuits configured for implementing the processes. 
         [0025]    Referring now to  FIG. 1 , a block diagram of a system  10  according to one embodiment of the present invention is shown. The exemplified system  10  includes a server  12  and router  16  connected to the internet  14 , as well as respondent devices  22  and a manager device  32 . The respondent devices  22  belong to department respondents  20 , that is, members of a department of an organization  23  that have responded to a survey topic. A department can be any collection of members of an organization  23 , and a member of an organization can be any person affiliated with the organization, including employees, contractors, and non-paid volunteers. In the exemplified embodiment, the department respondents include a first member  21  of the organization  23  having a respondent device  22 . 
         [0026]    The manager device  32  belongs to a manager  30  within the organization  23 . The manager  30  can be any member of the organization  23  that has authority to assess the performance of other members of the organization  23 . The manager  30  may also have authority to generate new survey topics for response. In the exemplified embodiment, the manager  30  has authority to assess the performance of the department respondents  20 . 
         [0027]    In the exemplified embodiment, the system can enable a manager  30  to provide survey topics in real-time, and to receive responses in real-time. For example, after a meeting, a manager can immediately send a survey question to the participants in the meeting (e.g., “How was the meeting?”), and can view the responses in a response report that updates in real-time as the survey responses are received. As used herein, the term real-time is understood to mean immediately or substantially immediately (e.g., within seconds). In other embodiments, the method can use less rapid communications. 
         [0028]    The server  12  can be any computer or processor (or collection thereof) for carrying out programs in accordance with the functions described herein. In the exemplified embodiment, the server  12  communicates with the respondent and manager devices  22 ,  32  through an internet connection, the router  16  providing wireless internet connection to the respondent and manager devices  22 ,  32 . In other embodiments, the server  12  can communicate with the respondent and manager devices  22 ,  32  through any standard communication means, including through use of a telecommunication network (e.g., 3G or 4G) or a wired internet connection (e.g., wired Ethernet cables). 
         [0029]      FIG. 2  is an image of a respondent user interface  41  of a respondent device  22  where a respondent posts a response according to one embodiment of the invention. In the exemplified embodiment, the respondent device  22  is a mobile smartphone. In other embodiments, the respondent device  22  can be any computer device capable of carrying out programs in accordance with the functions described herein (including laptop computers, desktop computers, and tablets). 
         [0030]    The user interface  41  of the respondent device  22  shows a first instance of a survey application  40 . In the exemplified embodiment, the survey application  40  is a smartphone application. In other embodiments, the survey application  40  can be any program for carrying out the functions described herein. The respondent device  22  provides the respondent user interface  41 . In the exemplified embodiment, the user interface  41  utilizes a touch screen provided by the smartphone. In other embodiments, the user interface can be any user interface capable of enabling a user to communicate with and carry out the functions described herein, including an interface utilizing a computer monitor, mouse, and/or keyboard. 
         [0031]    The respondent user interface  41  shows a survey topic  42 , namely, “How are we doing at achieving our purpose?” The survey topic  42  can be any question or topic for which a respondent can provide a response or rating. The respondent user interface  41  provides options for a response  44 . In the exemplified embodiment, there are five rating options to choose from (from left to right): a question cloud, a red circle, an amber circle, a green circle, and a star. These options represent different ratings of how the company is doing regarding achieving the organization&#39;s purpose. In the exemplified embodiment, the question cloud represents the No Answer response, which can be described as follows: “I don&#39;t care. I can&#39;t decide. I don&#39;t understand. My feedback won&#39;t matter. I&#39;m worried about being honest. Or, this isn&#39;t applicable to me.” The red circle represents the Bad rating, which can be described as follows: “There are significant problems that need to be dealt with urgently.” The yellow circle represents the Needs Improvement rating, which can be described as follows: “There are obvious and valuable improvements that can be made.” The green circle represents the Good rating, which can be described as follows: “Nothing&#39;s perfect, but we are doing well overall.” Finally, the star represents the Exceptional rating, which can be described as follows: “We are doing better here at achieving our purpose than anywhere else I know of.” In the exemplified embodiment, the red option has been chosen as the response  44 . In other embodiments, other rating options having other meanings can be available. 
         [0032]    In the exemplified embodiment, the respondent is also asked to comment on why the chosen response  44  was given. In this embodiment, the respondent can provide an unstructured written comment  46 . In the exemplified embodiment, the respondent states the organization has “Poor leadership.” In other embodiments, structured responses (e.g., a list of possible explanations) can be provided for selection and/or unstructured responses can be eliminated. 
         [0033]    In the exemplified embodiment, the response to the survey topic is the response  44  that provides a rating. In other embodiments, however, the response can refer to any other type of response to a survey topic or question, such as comment  46 . 
         [0034]      FIG. 3  is an image of a manager user interface  55  of a manager device according to one embodiment of the present invention. In the exemplified embodiment, the manager device  32  (shown in  FIG. 1 ) is a laptop computer. In other embodiments, the device  22  can be any computer device capable of carrying out programs in accord with the functions described herein (including desktop computers, smartphones, and tablets). 
         [0035]    In the exemplified embodiment, the second instance of the survey application  50  is a computer program running on the manager device. In other embodiments, the second instance of the survey application can be any program for carrying out the functions described herein. In the exemplified embodiment, the user interface  55  utilizes a keyboard, touchpad, and screen as part of a laptop computer. In other embodiments, the user interface can be any user interface capable of enabling a user to communicate with and carry out the functions described herein. 
         [0036]    The second instance of the survey application  50  enables the manager to view a response report  56 . The response report  56  can be any description of the responses to a survey. In the exemplified embodiment, the response report  56  shows first department survey results for the survey topic  42  indicated at the top of the manager user interface  55 . The response report includes a first response summary  51 , a second response summary  52 , and a comment summary  54 . 
         [0037]    The first response summary  51  uses area to represent how the respondents in the displayed department responded to the displayed topic. This summary  51  focuses attention on the large groups of identical answers and de-emphasizes outlying responses. This helps protect confidentiality and helps leaders to focus on the big picture and not minor issues. A written description of the response summary is also provided (“Between good an exceptional (with a lot of non-responders) . . . ”). 
         [0038]    The second response summary  52  is a timeline chart. This summary  52  displays small circles that summarize the state of the responses to the displayed topic  42  at various moments in time. The gaps between the options are calculated by assigning a probability-based logit score to each of the four scale values and then averaging together all of the responses. A color summary is also used to communicate the practical differences between the items. 
         [0039]    In the comment summary  54 , comments are displayed with a byline that varies based on the chosen confidentiality preferences of the person that made the comment. In the exemplified embodiment, each member can choose a default confidentiality level. Non-limiting examples of chosen default confidentiality levels are Fearless, A Little Worried, and Scared. The level chosen will help control the amount of confidentiality provided to a member when the member submits a response or comment. For example, when a member is an employee submitting a comment, the employee can be identified by the employee&#39;s name, as an employee of a certain department, as an employee of a larger department, or simply as an employee of the company, depending on the level of anonymity desired. 
         [0040]      FIG. 4  is a block diagram of a hierarchy  5  according to one embodiment of the present invention. Department D 3  has members M 16 -M 20  and department D 4  has members M 21 -M 25 . Departments D 3  and D 4  report to department D 1 , which has members M 6 -M 10 . Department D 1  reports to the top department TD, which has members M 1 -M 5 . Department D 5  has members M 26 -M 30  and department D 6  has members M 31 -M 33 . Departments D 5  and D 6  report to department D 2 , which has members M 11 -M 15 . Department D 2  reports to the top department TD. Organization respondents  24  are those members that have submitted a response  44  to a survey topic. For example, member M 6  of department D 1  is an organization respondent  24  that has submitted response R 6   44 . In the exemplified embodiment, the department D 1  respondents are M 6 , M 7 , and M 8 . A manager can see responses from members of the manager&#39;s department, as well members in departments that are descendants to the given manager&#39;s department (below the department manager&#39;s department in the hierarchy). Thus, the manager of the top department TD can see responses from any of the members in departments TD and D 1 -D 6 , and the manager of D 1  can see responses from any of the members of departments D 1 , D 3 , and D 4 . Similar hierarchies are shown in subsequent figures. 
         [0041]      FIG. 5A  is a block diagram of a hierarchy  5  before and after a first member M 7  leaves an organization without confidentiality protection according to one embodiment of the present invention. The departure of first member M 7  is a type of organizational change. An organizational change can refer to various organizational changes, such as the departure of or addition of a member, or movement of a member from one department to another. 
         [0042]    The first member M 7  is a member of a first department D 1 . In first department D 1 , all members M 6 -M 10  have provided responses R 6 -R 10  to the survey topic. Thus, all of the first department members M 6 -M 10  are first department respondents. The first member M 7  has chosen a confidentiality level of Fearless. In the exemplified embodiment, when a member chooses a confidentiality level of fearless, the confidentiality protections discussed below are not triggered. Rather, after the first member M 7  leaves the organization, the first member M 7  and his response R 7  are simply removed from the hierarchy. If the response R 7  of the first member M 7  was negative, a manager such as M 5  may note a change in to a department D 1  response report. For example, if response R 7  was negative, a manager may notice that the D 1  response report showed more positive ratings after member M 7  department, thereby indicating to the manager that the first member M 7  was the source of a negative response. 
         [0043]      FIG. 5B  is a block diagram of a hierarchy  5  before and after a first member M 7  leaves an organization with confidentiality protection according to one embodiment of the present invention. The first member M 7  is a member of a first department D 1 . In the first department D 1 , all members M 6 -M 10  have provided responses R 6 -R 10  to the survey topic. Thus, all first department members M 6 -M 10  are first department respondents. The first member M 7  has chosen a confidentiality level of A Little Worried. In this embodiment, selection of such a confidentiality level ensures that, after the first member M 7  leaves the organization, the system will provide special protections for the confidentiality of the first member M 7 . 
         [0044]    To provide such confidentiality, a first safe group  26  is created. In the exemplified embodiment, the safe group  26  comprises four respondents from the department D 1  of the first member M 7 . Specifically, the safe group  26  comprises first member M 7  and members M 8 -M 10 . As is shown, after the organizational change, the responses R 7 -R 10  of the safe group  26  are expired. With these responses expired, a response report for department D 1  will not include responses R 7 -R 10 . Thus, a manager such as M 5  comparing before and after response reports for department D 1  will have little ability to determine what changes to the responses were caused by the departure of first member M 7 . A safe group can be any group of members whose responses are expired for excluding the responses of the safe group members from a response report, and can include or exclude the first member (whether or not the first member has provided a response). 
         [0045]    In the exemplified embodiments of  FIGS. 5A and 5B , the size of the safe group is determined by the general confidentiality level chosen by the first member  21 . If Fearless is chosen, the safe group size is one, thus providing no significant confidentiality protection. If A Little Worried or Scared is chosen, the safe group size is four. The invention is not so limited. In other embodiments, the safe group size can be any number and can be determined based on other factors, such as a safe group size chosen by the first member, or by a predetermined number. Further, in the exemplified embodiment, the first member, when a respondent, is part of the safe group. In other embodiments, a safe group can exclude a respondent (or non-respondent) first member. Further, safe groups can be of the same or a different number. 
         [0046]      FIG. 6  is a block diagram of a hierarchy  5  before and after a member moves laterally within an organization according to one embodiment of the present invention. The hierarchy  5  before the lateral movement is similar to that of  FIG. 5B , with first member M 6  belonging to first department D 1 , and departments D 1  and D 2  reporting to top department TD. An organizational change occurs such that first member M 6  is moved from first department D 1  to second department D 2 . In this embodiment, a first safe group  26  has four members, namely, first member M 6  and respondents M 7 -M 9 . The responses R 6 -R 9  of these respondents are expired after the organizational change. Further, a second safe group  66  having four members is defined. This second safe group  66  includes member M 6  and respondents M 11 -M 13 . The responses R 11 -R 13  of these respondents are expired. By creating these safe groups  26 ,  66 , the confidentiality of the first member M 6   21  is once again protected for purposes of D 1  response reports and D 2  response reports. That is, a manager viewing before and after response reports for departments D 1  or D 2  would not be able to infer the response R 6  of first member M 6 . 
         [0047]    In this embodiment, the responses R 6 -R 9  and R 11 - 13  are not simply expired, but are also recreated in the Top Department. Thus, while a response report on first department D 1  alone, or a response report on second department D 2  alone, will not include the responses of the first safe group or second safe group (the responses are expired with respect to these response reports), a report on a larger scope (such as a report on the organization as a whole) would include the expired responses R 6 -R 9  and R 11 -R 13 . In the exemplified embodiment, the only departments that see an impact to their response reports are the first and second departments D 1 , D 2 , since their membership changed. From the perspective of top department TD, however, membership did not change. 
         [0048]    In this embodiment, when members move laterally within an organizational hierarchy, the safe group responses are recreated in the nearest common ancestor scope (NCAS). For a lateral organizational change, the NCAS is the deepest scope in the hierarchy that includes both the original department (source scope) and the new department (target scope) as descendants within the hierarchy. In the current example, the NCAS is the top department. The safe group responses are recreated in the NCAS because this scope will have the same hierarchical membership, and therefore its reports need not be impacted by the organizational change. 
         [0049]    A scope can be understood as a group of members that can be treated identically for confidentiality purposes. A scope can either be a single node (e.g., a single department), or it can be a node and all of that node&#39;s descendent nodes. A descendent node of node X can be a child node of node X or a descendent node of one of node X&#39;s child nodes. An ancestor node of node X can be the parent of node X or an ancestor node of node X&#39;s parent node. 
         [0050]    When a respondent&#39;s response is expired or recreated, this can be referred to as response invalidation. When a response is invalidated, it is no longer available for the respondent to review. Thus, while not shown in  FIG. 6 , the recreated responses will appear to the members of the safe groups that their responses disappeared. If the topic is still active, the respondent can provide a new response, and can be prompted to do so. If a respondent provides a new response, any previously recreated response for that survey take is immediately expired. 
         [0051]      FIG. 7  is a block diagram of a hierarchy  5  before and after a non-responding member M 25  moves laterally within an organization according to one embodiment of the present invention. The hierarchy  5  before the lateral movement is similar to that of  FIG. 4 , but with additional members in department D 6  and additional responses. In this embodiment, first member M 25  moves from first department D 4  to second department D 5 . First department D 4  includes respondents M 21 -M 24  (the first department respondents) and second department D 5  includes respondents M 26 -M 30  (the second department respondents). 
         [0052]    But unlike  FIG. 6 , the first member M 25  moving laterally did not provide a response to the survey topic (there is no R 25 ), and therefore the first member M 25  is not among the first department respondents M 21 -M 24 . As a result, the first safe group  26  does not include first member M 25 . Rather, since the safe group size is four, the safe group includes M 21 -M 24 . Thus, responses R 21 -R 24  are expired after the organizational change. 
         [0053]    As for the second safe group  66 , even though the first member M 25  is not a respondent to the survey topic, the first member M 25  is included as part of the second safe group, along with M 26 -M 28 , to reach a size of four. Thus, responses M 26 -M 28  are expired. In other embodiments, a safe group can be defined such that a non-responding member like M 25  is not included as one of the second safe group members, or a safe group can include or exclude the first member regardless of whether the first member was a respondent. 
         [0054]      FIG. 7  also differs from  FIG. 6  in that the first department D 4  reports to department D 1 , while the second department D 5  reports to department D 2 . This impacts where the expired responses are recreated. In this embodiment (as in  FIG. 6 ), when members move laterally within an organizational hierarchy, the safe group responses are recreated in the nearest common ancestor scope (NCAS). For a lateral organizational change, the NCAS is the deepest scope in the hierarchy that includes both the original department (source scope) and the new department (target scope) as descendants. In the current example, department D 1  does not include department D 5  as a descendent, and department D 2  does not include department D 4  as a descendant. Thus, the NCAS is top department TD. The safe group responses R 21 -R 24  and R 26 -R 28  are recreated in top department TD because this department will have the same hierarchical membership, and therefore its response reports need not be impacted by the organizational change. 
         [0055]      FIG. 8  is a block diagram of a hierarchy according to one embodiment of the present invention. In this embodiment, first member M 25  is leaving the organization. This figure differs from previous figures in that there are an insufficient number of respondents in the first department D 4  to create a four-respondent safe group. Rather, there is only one respondent, M 24 , in the first department D 4 , also referred to as scope A. To create a safe group of four, there must be three additional respondents from other departments whose responses are expired. To do this, the system looks to the next scope, scope B, for additional respondents. There, it finds M 40  and M 43 . Since the safe group still needs one additional respondent, the system looks to the next scope, scope C, for additional respondents. There, it finds M 8  and M 17 . The system must choose one of their responses, R 8  or R 17 , to expire. In the exemplified embodiment, the system expires response R 17 , because R 17  is the older response (R 8  was provided more recently). If the safe group required yet further respondents, it would expand it search to scope D. In other embodiments, other approaches can be used for determining which member responses to expire. 
         [0056]      FIG. 9  is a flow chart of a process  100  where a member moves laterally within a hierarchy from a first department (source scope) to a second department (target scope) according to one embodiment of the invention. First, the process determines the minimum safe group size (MSGS) (step  102 ). This number can be provided by the first member, be predetermined, or otherwise be determined. Next, the process determines the nearest common ancestor scope (NCAS) for the source scope and the target scope (step  104 ). Next, the process determines whether the MSGS is equal to one (step  106 ). 
         [0057]    If the MSGS is equal to one, the process determines whether the first member has a response (step  108 ). If not, the process ends. If so, the process determines whether the target scope is the topic-asked scope or a descendent (step  110 ). If not, the current response is expired (step  112 ) and the process ends. If so, the process determines whether the current response was invalidated (step  114 ). If so, the current response is expired (step  112 ) and the process ends. If not, the response is expired and recreated in the target scope (step  116 ) and the process ends. 
         [0058]    If the MSGS does not equal one, the source scope is set as the initial scope to consider as a potential MSG (the seed scope) (step  118 ). Next, the process determines whether the first member is moving to a descendant scope (step  120 ). If not, the MSG is populated by using expanding scopes, that is, by looking at successive parent scopes until a scope is found with the MSGS or greater (step  122 ), and the MSG responses are expired (step  124 ). Next, the process determines whether the target scope is the topic-asked scope or a descendant (step  126 ). If not, the process ends. If so, the process moves to step  134  (discussed below). 
         [0059]    If the first member is moving to a descendant scope (step  120 ), the process determines whether the source scope direct report responses are reportable (step  128 ). If so, the MSG is populated from direct reports (step  130 ), the MSG responses are expired (step  132 ), and the MSG responses are recreated in NCAS and the MSGS (minimum safe group size) is decreased by one (step  134 ). Step  134  also occurs if the source scope direct report responses are not reportable. 
         [0060]    Next, the target scope is set as the initial scope to consider as a potential MSG (the seed scope) (step  136 ). Next, the process determines whether the member is moving to an ancestor scope (step  138 ). If not, the MSG is populated by looking at successive parent scopes until a scope is found with the MSGS or greater (step  140 ), the MSG responses are expired (step  142 ), and the MSG responses re recreated in the NCAS (step  144 ). 
         [0061]    If in step  138  it is determined that the first member is moving to an ancestor scope, the process determines whether the target scope direct report responses are reportable (step  146 ). If not, the process ends. If so, the MSG is populated from direct reports (step  148 ), the MSG responses are expired (step  150 ), and the process ends. 
         [0062]      FIG. 10  is a flow chart of a process  200  for populating a safe group using expanding scopes according to one embodiment of the invention. First, the process determines whether the first member has a response in a seed scope (step  202 ). If so, the process adds a member response to the MSG (step  204 ) and then selects the earliest selectable response from the seed scope direct reports and adds it to the MSG (step  206 ). A selectable response is one that was not already added to the MSG, and was not provided by a leader initiating the current organizational change. Step  206  is also carried out if the first member does not have a response in the seed scope. 
         [0063]    Next, the process determines whether the MSG response count has reached the MSGS (step  208 ). If so, the process ends. If not, the process determines whether there are any more selectable responses in the seed scope direct reports (step  210 ). If so, the process returns to step  206 . If not, the process selects the earliest selectable response from the seed scope descendants and adds it to the MSG (step  212 ) and determines whether the MSG response count has reached the MSGS (step  214 ). If so, the process ends. If not, the process determines whether there are any more selectable responses in the seed scope descendants (step  216 ). If so, the process returns to step  212 . 
         [0064]    If not, the process selects the next higher ancestor scope (step  218 ) and determines whether the selected scope is the NCAS (step  220 ). If so, the process ends. If not, the process selects the earliest selectable response from the selected ancestor scope and descendants and adds it to the MSG (step  222 ). Next, the process determines whether the MSG response count reached the MSGS (step  224 ). If so, the process ends. If not, the process determines whether there are any more selectable responses in the selected ancestor scope or its descendants (step  226 ). If so, the process returns to step  222 . If not, the process returns to step  218 . 
         [0065]      FIG. 11  is a flow chart of a process  300  for populating a safe group from direct reports according to one embodiment of the invention. First, the process determines whether the first member has a response in the seed scope (step  302 ). If so, the process adds a member response to the MSG (step  304 ) and then selects the earliest selectable response from the seed scope direct reports and adds it to the MSG (step  306 ). A selectable response is one that was not already added to the MSG, and was not provided by a leader initiating the current organizational change. Step  306  is also carried out if the first member does not have a response in the seed scope. 
         [0066]    Next, the process determines whether the MSG response count has reached the MSGS (step  308 ). If so, the process ends. If not, the process determines whether there are any more selectable responses in the seed scope direct reports (step  310 ). If so, the process returns to step  306 . If not, the process ends. 
         [0067]    It is noted that the foregoing discussions concern organizational changes for a single survey topic. It is understood that there could be multiple active survey topics, and each topic can have its own set of responses scattered throughout the hierarchy. The confidentiality system can be designed to ensure that a member&#39;s responses (or non-responses) are protected for every topic that was asked in the member&#39;s department. The confidentiality operations described above can be performed simultaneously using a standard database technique. 
         [0068]    While the invention been described with respect to specific examples, those skilled in the art will appreciate that there are numerous variations and permutations of the above described invention. It is to be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope of the present invention. Thus, the spirit and scope should be construed broadly as set forth in the appended claims.