# US 2014/0156339 A1 · Operational risk and control analysis of an organization

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156339 A1
- Document ID: US20140156339A1
- Status: Published application
- Kind: A1
- Application number: 13/692,297
- Filed: 2012-12-03
- Published: 2014-06-05
- Earliest claimed: 2012-12-03
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Carol A. Boyer; Stephen A. Corrado; Paula E. Pottle; Nooruddin Rahimi; Richard Warren Simpson
- Web page: https://patentgrep.com/patent/US20140156339A1

## CPC

- G06Q 10/0635: Risk analysis of enterprise or organisation activities
- G06Q 10/067: Enterprise or organisation modelling
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Systems and methods that facilitate operational risk and control analysis of an organization may include receiving a plurality of key risks and the plurality of key risks identify operational risks of an organization. A plurality of sets of data is received from a plurality of data providers, and the plurality of the sets of data comprise information associated with a plurality of business units in the organization. Each set of data is associated with a key risk, and the plurality of the sets of data is compiled based on the key risk. The compiled data is quantified, and quantifying the integrated data comprises weighting the compiled data according to the key risk. The quantified data is stored to facilitate risk analysis.

## Claims

### Claim 1

A system, comprising:
a network interface operable to:
receive a plurality of key risks, wherein the plurality of key risks identify operational risks of an organization; and
receive a plurality of sets of data from a plurality of data providers, wherein the plurality of the sets of data comprise information associated with a plurality of business units in the organization;
a processor communicatively coupled to the network interface and operable to:
associate each set of data with a key risk;
compile the plurality of the sets of data based on the key risk; and
quantify the compiled data, wherein quantifying the integrated data comprises weighting the compiled data according to the key risk; and
a memory communicatively coupled to the processor and operable to store the quantified data to facilitate risk analysis.

### Claim 2 (depends on 1)

The system of claim 1, wherein the plurality of data providers comprises internal data providers and external data providers and the plurality of the sets of data comprises structured data and unstructured data.

### Claim 3 (depends on 1)

The system of claim 1, wherein the plurality of the sets of data comprises data associated with the organization and data associated with a plurality of third parties and the data associated with the organization and the data associated with a plurality of third parties is categorized according to operational risk categories and the operational risk categories comprise the following categories: fraud and criminal, human malicious external events, human non-malicious external events, natural events and disasters, third party and vendor, legal, and regulatory and governmental.

### Claim 4 (depends on 1)

The system of claim 1, wherein the processor is further operable to convert the plurality of the sets of data into a standard template before associating each set of data with the key risk.

### Claim 5 (depends on 1)

The system of claim 1, wherein the processor is further operable to:
facilitate quality control review of the associated set of data and the key risk; and
determine whether the associated set of data and the key risk pass the quality control review.

### Claim 6 (depends on 1)

The system of claim 1, wherein the processor is further operable to generate a first report based on the integrated data, wherein the first report comprises at least one pivot table.

### Claim 7 (depends on 1)

The system of claim 1, wherein the processor is further operable to:
generate a second report based on the quantified data; and
communicate the second report to a computer to facilitate additional analysis.

### Claim 8

Non-transitory computer readable medium comprising logic, the logic, when executed by a processor, operable to:
receive a plurality of key risks, wherein the plurality of key risks identify operational risks of an organization;
receive a plurality of sets of data from a plurality of data providers, wherein the plurality of the sets of data comprise information associated with a plurality of business units in the organization;
associate each set of data with a key risk;
compile the plurality of the sets of data based on the key risk;
quantify the compiled data, wherein quantifying the integrated data comprises weighting the compiled data according to the key risk; and
store the quantified data to facilitate risk analysis.

### Claim 9 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein the plurality of data providers comprises internal data providers and external data providers and the plurality of the sets of data comprises structured data and unstructured data.

### Claim 10 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein the plurality of the sets of data comprises data associated with the organization and data associated with a plurality of third parties and the data associated with the organization and the data associated with a plurality of third parties is categorized according to operational risk categories and the operational risk categories comprise the following categories: fraud and criminal, human malicious external events, human non-malicious external events, natural events and disasters, third party and vendor, legal, and regulatory and governmental.

### Claim 11 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein the logic is further operable to:
facilitate quality control review of the associated set of data and the key risk; and
determine whether the associated set of data and the key risk pass the quality control review.

### Claim 12 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein the logic is further operable to generate a first report based on the integrated data, wherein the first report comprises at least one pivot table.

### Claim 13 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein the logic is further operable to:
generate a second report based on the quantified data; and
communicate the second report to a computer to facilitate additional analysis.

### Claim 14

A method, comprising:
receiving a plurality of key risks, wherein the plurality of key risks identify operational risks of an organization;
receiving a plurality of sets of data from a plurality of data providers, wherein the plurality of the sets of data comprise information associated with a plurality of business units in the organization;
associating, by a processor, each set of data with a key risk;
compiling the plurality of the sets of data based on the key risk;
quantifying, by the processor, the compiled data, wherein quantifying the integrated data comprises weighting the compiled data according to the key risk; and
storing the quantified data to facilitate risk analysis.

### Claim 15 (depends on 14)

The method of claim 14, wherein the plurality of data providers comprises internal data providers and external data providers and the plurality of the sets of data comprises structured data and unstructured data.

### Claim 16 (depends on 14)

The method of claim 14, wherein the plurality of the sets of data comprises data associated with the organization and data associated with a plurality of third parties and the data associated with the organization and the data associated with a plurality of third parties is categorized according to operational risk categories and the operational risk categories comprise the following categories: fraud and criminal, human malicious external events, human non-malicious external events, natural events and disasters, third party and vendor, legal, and regulatory and governmental.

### Claim 17 (depends on 14)

The method of claim 14, further comprising converting the plurality of the sets of data into a standard template before associating each set of data with the key risk.

### Claim 18 (depends on 14)

The method of claim 14, further comprising:
facilitating quality control review of the associated set of data and the key risk; and
determining, by the processor, whether the associated set of data and the key risk pass the quality control review.

### Claim 19 (depends on 14)

The method of claim 14, further comprising generating a first report based on the integrated data, wherein the first report comprises at least one pivot table.

### Claim 20 (depends on 14)

The method of claim 14, further comprising:
generating a second report based on the quantified data; and
communicating the second report to a computer to facilitate additional analysis.