Patent Document ID: 8135605
Application ID: 11279301
Patent Status: 1

Claim One:
1. A method for evaluating both risks and controls implemented to mitigate the risks associated with a plurality of objects, the method comprising: for each of a plurality of objects receiving information at a self assessment computer sufficient to uniquely identify the object; receiving, at the self assessment computer, risk input reflective of a risk level associated with each of a plurality of risk categories associated with that object; receiving, at the self assessment computer, a plurality of control responses indicative of whether or not each of a plurality of control attributes has been implemented, wherein the plurality of control attributes are organized into a plurality of control categories; storing the information, the risk input, and the plurality of control responses in a relational database associated with the self assessment computer; computing, using the self assessment computer, at least one risk score based on said risk input; computing, using the self assessment computer, at least one control score based on said plurality of control responses, wherein said step of computing at least one control score comprises first computing component control metrics for each of said plurality of control categories by computing a ratio between a number of affirmative responses regarding whether a particular control attribute has been implemented to a maximum possible number of affirmative responses for that control category; storing on the self assessment computer a plurality of adjustment levels, wherein the plurality of adjustment levels comprise: if a percentage of the affirmative responses is less than a first percentage of the maximum possible number of affirmative responses, the ratio is reduced by a first adjustment level; if the percentage of the affirmative responses is less than a second percentage but greater than or equal to the first percentage of the maximum possible number of affirmative responses, the ratio is reduced by a second adjustment level; and if the percentage of the affirmative responses is less than a third percentage but greater than or equal to the second percentage of the maximum possible number of affirmative responses, the ratio is reduced by a third adjustment level; determining, using the self assessment computer, which of the plurality of adjustment levels applies to the ratio; and adjusting the ratio based on the determination.