Systems and methods for providing vendor management and advanced risk assessment with questionnaire scoring

A method for determining risk levels associated with a vendor, the method comprising the steps of:

• causing to display, by a processor of an enterprise system, one or more graphical user interfaces (GUIs) associated with one or more risk assessment modules, the risk assessment modules comprising a template management module for managing questionnaire templates;
• receiving, by a processor of an enterprise system, a first input from a first client, the first input comprising instructions to access a selected module of the one or more risk assessment modules;
• performing, by the first client, a multi-step risk assessment comprising:
• (a) determining an inherent risk score based on an inherent risk associated with the vendor by answering, by the first client, a plurality of inherent risk questions based on at least one of (1) internal policies of the vendor, (2) internal procedures of the vendor, and (3) the line of business in which the vendor is engaged, each of the plurality of inherent risk questions falling into one of a plurality of inherent risk sections, each inherent risk section comprising an associated section weight, each of the inherent risk questions comprising a question weight within the corresponding inherent risk section;
• (b) assessing mitigating controls for the vendor by answering a plurality of residual risk questions, each of the plurality of residual risk questions falling into one of a plurality of residual risk sections, each residual risk section comprising an associated section weight, each of the residual risk questions comprising a question weight within the corresponding residual risk section;
• (c) determining a residual risk score representative of a residual risk associated with the vendor after application of the mitigating controls to the vendor, the residual risk score being equal to the inherent risk score after adjusting for a mitigation allowance, the mitigation allowance being determined based on answers to the residual risk questions;
• and
• (d) determining, by the first client, a final risk score, the final risk score based at least partially on each of the inherent risk score, the residual risk score, the question weights, and the section weights;
• and
• receiving, by the processor of the enterprise system, subsequent input from the first client specific to the selected risk assessment module, the subsequent inputs comprising answers to at least one of the inherent risk questions and the residual risk questions;
• wherein determining at least one of the inherent risk score and the residual risk score comprises adjusting, by the first client, at least one of an inherent risk section weight and an inherent risk question weight.

An enterprise system workflow for vendor risk assessment comprising:

• causing to display, by a processor of the enterprise system, one or more graphical user interfaces (GUIs) associated with one or more risk assessment modules;
• creating, by a first client via the one or more risk assessment modules, a risk assessment template, the risk assessment template configured to allow the first client to define rating scales, risk levels, and/or scoring formats;
• selecting, by the first client, a plurality of risk assessment questionnaires comprising an inherent risk questionnaire and a residual risk questionnaire;
• defining, by the first client, a plurality of risk levels for each of the inherent risk questionnaire and the residual risk questionnaire;
• performing, by the first client, an inherent risk assessment by answering a plurality of inherent risk questions in the inherent risk questionnaire, wherein answering the plurality of inherent risk questions comprises sliding a slider corresponding to each question within the inherent risk questionnaire to the appropriate risk level for each corresponding question within the inherent risk questionnaire;
• performing, by the first client, a residual risk assessment by answering a plurality of residual risk questions in the residual risk questionnaire, the residual risk questions identifying mitigating controls that are being implemented by the vendor to mitigate risks identified via the inherent risk questionnaire, wherein answering the plurality of residual risk questions comprises sliding a slider corresponding to each question within the residual risk questionnaire to the appropriate risk level for each corresponding question within the residual risk questionnaire;
• and
• determining a final risk score, based at least partially on (1) an inherent risk score determined from the inherent risk questionnaire, and (2) a residual risk score determined from the residual risk questionnaire,
• wherein at least one of the inherent risk questionnaire and the residual risk questionnaire comprises at least one tiered question only visible to the first client if a particular response to a parent question of the inherent risk questionnaire and/or the residual risk questionnaire was selected by the first client.