Financial audit risk tracking systems and methods
OwnerBrad Ageeinventor
Life of this patent
Estimating the term…
Abstract
A system is provided for audit risk and tracking (ART) including an audit firm application (ART1) and a client bank application (ART2). The system maintains a data model of control activities for a best practices bank (BPB), against which control activity gap assessments are conducted for client banks. An interactive gap assessment report allows insight into controls that are lacking versus the BPB. The ART1 and ART2 systems interact to allow the client bank to interact with the audit firm to cooperate in assessing and managing business initiatives and other control, audit, and ERM activity. Novel risk scoring assessments are provided to help manage client bank controls in relation to the BPB model. A web service is provided that automatically updates the BPB model from ART1 to ART2.
Claims19
A method of assessing risk management in a bank using one or more software applications running on one or more application server processors, the method comprising:
- a) providing a data model of a hypothetical best practices bank stored in memory of one of the application servers;
- b) presenting one or more web forms to one or more client bank employees and receiving through the web forms data indicative of first risk management control activities operating at the client bank;
- c) receiving data classifying selected ones of the first risk management control activities as being associated with certain business functions present in the data model of the hypothetical best practices bank;
- d) generating a control activity gap assessment report comparing the first risk management control activities to the data model of the hypothetical best practices bank and identifying areas where the first risk management control activities are lacking compared to the hypothetical best practices bank;
- and
- e) making the control activity gap assessment report accessible to an employee of the client bank.
A method of providing risk scoring services to a bank using one or more software applications running on one or more application server processors, the method comprising:
- a) receiving an indication that a set of risk factors is associated with a logical parent entity of an institution being evaluated;
- b) providing an indicator of a risk factor score associated with an estimated inherent risk level for each respective one of the set of risk factors;
- c) providing an indicator of a risk factor weight associated with each response one of the set of risk factors;
- d) calculating a final inherent risk score value for each of the respective set of risk factors from its associated risk factor score and risk factor weight;
- e) receiving an indicator of one or more control activities associated with at least one of the set of risk factors;
- f) for each control activity related to each risk factor, providing an indicator of an initial marginal percentage rate based on an assessment of how much the control activity mitigates the respective associated risk factor;
- g) for one or more of the set of risk factors having two or more associated control activities, receiving an assessment of a percent impact exposure for each of the control activities associated with the risk factor;
- h) for each control activity, providing a weakness point total based on a set of weakness point assignments associated with the control activity;
- i) calculating a mitigation markdown percentage for each control activity based on its respective weakness point total and percentage impact estimate;
- j) for one or more of the set of risk factors having two or more associated control activities, calculating a final mitigation markdown percentage based on the mitigation markdown percentage and a number of layered control activities associated with each risk factor;
- k) calculating a residual risk score for at least one of the logical parent entities based on the final inherent risk score, the initial marginal percentage rate, and the final markdown percentage for all of the risk factors associated with the parent entity.
A method of providing an update to a data model of a best practices bank, the data model employed by a client bank to assess adequacy of their functioning control activities, the method comprising:
- a) storing, in memory at an application server, a data model of a best practices bank;
- b) determining that an update is needed to the best practices bank model;
- c) receiving, by the application server, an indication of a change goal related to the update;
- d) receiving, by the application server, an indication of a change to be made to implement the change goal;
- e) preparing update data to send to a client bank application server indicative of the change to the made to implement the update;
- f) transmitting the update data to the client bank application server.
Dependencies are inferred from the claim text.