# US 2021/0241192 A1 · Policy-based completion of third party risk assessments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241192 A1 - Document ID: US20210241192A1 - Status: Published application - Kind: A1 - Application number: 16/778,107 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: RSA Security Inc. - Applicants: RSA Security LLC - Inventors: Brian C. Mullins; Victor Malchikov - Web page: https://patentgrep.com/patent/US20210241192A1 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06Q 10/0637: Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals - G06Q 10/067: Enterprise or organisation modelling - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Techniques are provided for policy-based completion of risk assessments. One method comprises obtaining, from a risk assessment creator, a risk assessment comprising a question and a corresponding risk assessment completion policy for the question, wherein the question is processed by a risk assessment completion processing system in accordance with the corresponding risk assessment completion policy and the corresponding risk assessment completion policy comprises a trigger and one or more corresponding actions to perform when the trigger is satisfied; monitoring, by the risk assessment completion processing system, one or more responses from a risk assessment responder to the at least one question; and performing the one or more corresponding actions when the is detected. For multiple questions, the corresponding risk assessment completion policy may prioritize the multiple questions. For multiple triggers, the corresponding actions may be performed when any one of the multiple triggers is satisfied. ## Claims ### Claim 1 A method, comprising: obtaining, from a risk assessment creator, a risk assessment comprising at least one question and a corresponding risk assessment completion policy for the at least one question, wherein: the at least one question is processed by a risk assessment completion processing system in accordance with the corresponding risk assessment completion policy, wherein the corresponding risk assessment completion policy comprises at least one trigger and one or more corresponding actions to perform when the at least one trigger is satisfied; and the risk assessment completion policy is a rule-based completion policy created using a JSON structure, wherein the JSON structure is based on defined numerical scoring that represents how well one or more responses from a risk assessment responder complies with the rule-based completion policy, wherein the JSON structure comprises a policy name, at least one condition that triggers associated actions, and at least one action to perform; comparing, by the risk assessment completion processing system, the one or more responses from the risk assessment responder to the at least one question in accordance with the risk assessment completion policy; and performing the one or more corresponding actions when the at least one trigger is detected by executing the JSON structure, wherein the risk assessment completion processing system comprises at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The method of claim 1, wherein the risk assessment responder delegates one or more responses to another party. ### Claim 3 (depends on 1) The method of claim 1, wherein the corresponding risk assessment completion policy is specified using one or more rules. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one question comprises a plurality of questions and wherein the corresponding risk assessment completion policy prioritizes the plurality of questions. ### Claim 5 (depends on 1) The method of claim 1, wherein the at least one trigger comprises a plurality of triggers and wherein the one or more corresponding actions are performed when any one of the plurality of triggers is satisfied. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one question comprises a plurality of questions, wherein one or more answers for each of the plurality of questions have one or more of a corresponding numerical score and a corresponding score deduction, and wherein the one or more conditions comprise an overall threshold score for the plurality of questions. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more corresponding actions to perform when the at least one trigger is satisfied influence a control flow for a completion of the risk assessment. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more corresponding actions to perform when the at least one trigger is satisfied includes: (i) pausing the risk assessment, (ii) initiating a review of the risk assessment by the risk assessment creator, (iii) rejecting the risk assessment, (iv) stopping the risk assessment, or (v) generating a notification to (a) the risk assessment creator or (b) the risk assessment responder. ### Claim 9 (depends on 1) The method of claim 1, wherein one or more conditions of the at least one trigger comprise: (i) responses to the risk assessment satisfying a predefined completion threshold, or (ii) responses to the risk assessment satisfying a predefined score threshold. ### Claim 10 (depends on 1) The method of claim 1, wherein the at least one question comprises a plurality of questions and wherein one or more conditions of the at least one trigger comprise: a list, a number, or a percentage of the plurality of questions that are not answered in a specified manner. ### Claim 11 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured to implement: obtaining, from a risk assessment creator, a risk assessment comprising at least one question and a corresponding risk assessment completion policy for the at least one question, wherein the at least one question is processed by a risk assessment completion processing system in accordance with the corresponding risk assessment completion policy, wherein: the corresponding risk assessment completion policy comprises at least one trigger and one or more corresponding actions to perform when the at least one trigger is satisfied; and the risk assessment completion policy is a rule-base completion policy created using a JSON structure, wherein the JSON structure is based on defined numerical scoring that represents how well one or more responses from a risk assessment responder complies with the rule-based completion policy, wherein the JSON structure and comprises a policy name, at least one condition that triggers associated actions, and at least one action to perform; comparing, by the risk assessment completion processing system, the one or more responses from the risk assessment responder to the at least one question in accordance with the risk assessment completion policy; and performing the one or more corresponding actions when the at least one trigger is detected by executing the JSON structure. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the at least one question comprises a plurality of questions and wherein the corresponding risk assessment completion policy prioritizes the plurality of questions. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the at least one trigger comprises a plurality of triggers and wherein the one or more corresponding actions are performed when any one of the plurality of triggers is satisfied. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the one or more corresponding actions to perform when the at least one trigger is satisfied influence a control flow for a completion of the risk assessment. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein one or more conditions of the at least one trigger comprise: (i) responses to the risk assessment satisfying a predefined completion threshold, or (ii) responses to the risk assessment satisfying a predefined score threshold. ### Claim 16 A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform: obtaining, from a risk assessment creator, a risk assessment comprising at least one question and a corresponding risk assessment completion policy for the at least one question, wherein the at least one question is processed by a risk assessment completion processing system in accordance with the corresponding risk assessment completion policy, wherein: the corresponding risk assessment completion policy comprises at least one trigger and one or more corresponding actions to perform when the at least one trigger is satisfied; and the risk assessment completion policy is a rule-base completion policy created using a JSON structure, wherein the JSON structure is based on defined numerical scoring that represents how well one or more responses from a risk assessment responder complies with the rule-based completion policy, wherein the JSON structure and comprises a policy name, at least one condition that triggers associated actions, and at least one action to perform; comparing, by the risk assessment completion processing system, the one or more responses from the risk assessment responder to the at least one question in accordance with the risk assessment completion policy; and performing the one or more corresponding actions when the at least one trigger is detected by executing the JSON structure. ### Claim 17 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the at least one question comprises a plurality of questions and wherein the corresponding risk assessment completion policy prioritizes the plurality of questions. ### Claim 18 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the at least one trigger comprises a plurality of triggers and wherein the one or more corresponding actions are performed when any one of the plurality of triggers is satisfied. ### Claim 19 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the one or more corresponding actions to perform when the at least one trigger is satisfied influence a control flow for a completion of the risk assessment. ### Claim 20 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein one or more conditions of the at least one trigger comprise: (i) responses to the risk assessment satisfying a predefined completion threshold, or (ii) responses to the risk assessment satisfying a predefined score threshold.