Patent ID: 8671039

Claim:
An information processing system comprising: a receiving unit that receives a plurality of risks and a plurality of controls, wherein the plurality of risks are improperly user implemented steps of a process defined by a document and the plurality of controls are safeguards that detect the errors; a risk control matrix storage unit that stores a risk control matrix, the risk control matrix defining relationships between the plurality of risks and the plurality of controls; an assessment result storage unit that stores an evaluation of a design effectiveness of the document, the evaluation indicating whether each of the plurality of controls is effective for controlling risks among the plurality of risks associated with each of the plurality of controls based on the relationships in the risk control matrix; a display unit that displays whether the plurality of controls is effective for controlling the plurality of risks, in units of risks based on the evaluation of design effectiveness stored in the assessment result storage unit; and a dummy control setting unit that automatically sets a dummy control for a risk that does not have a control, wherein the display unit displays a risk having no corresponding control that the evaluation indicates as effective and a message indicating the dummy control is created in a remarks column, in a different manner from other risks.