Patent ID: 7853468

Claim:
A computer-implemented method of monitoring compliance for an organization, the computer-implemented method comprising the steps of: providing, using a central processing unit (CPU), a plurality of compliance-related questions to participants of compliance monitoring for an organization, wherein the participants include at least one question designer and at least one assessor; assigning by the at least one question designer, in a data processing system, a probability of occurrence value to each of the plurality of compliance-related questions, wherein the probability of occurrence value is a rating for a probability of occurrence for a threat posed by a compliance-related question; collecting from the at least one assessor, in the data processing system, a plurality of responses to the plurality of compliance-related questions, wherein the plurality of responses include assigning a residual risk value and an impact value to each of the plurality of compliance-related questions, wherein the residual risk value is a value of the threat posed by the compliance-related question, and wherein the impact value is a value of how critical is a result of the threat posed by the compliance-related question if the threat is realized; establishing, using the CPU, a risk rating for each of the compliance-related questions, the risk rating determined from averaging together the values for residual risk, probability of occurrence, and impact, so as to express the risk rating as a function of the residual risk value, probability of occurrence value, and impact value for each of the plurality of compliance-related questions; and producing, using the CPU, an assessment including at least some of the plurality of responses and the risk rating for at least some of the plurality of compliance-related questions.