# US 2022/0036262 A1 · Method and System for Normalization and Aggregation of Risks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0036262 A1 - Document ID: US20220036262A1 - Status: Published application - Kind: A1 - Application number: 17/312,611 - Filed: 2020-01-30 - Published: 2022-02-03 - Earliest claimed: 2019-01-30 - Assignees: Inbario AS - Applicants: Inbario AS - Inventors: Harald Amundsen - Web page: https://patentgrep.com/patent/US20220036262A1 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06N 3/0499: Feedforward networks - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - G06Q 10/06375: {Prediction of business process outcome or impact based on a proposed change} - G06N 3/08: Learning methods - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Method and system for normalization of risks using mapping of risk matrices, wherein the consequence and probability rating scales are normalized to the same range, and wherein the risks are normalized to wards an extended risk matrix mapping area. The method and system will further be arranged for normalized presentation and aggregation of risks in protection layer hierarchies, wherein the risks are presented as if they had been assessed in other protection layers, for example in other organizational layers. ## Claims ### Claim at position 1 1-15. (canceled) ### Claim 16 A data processing Enterprise Risk Management method, comprising the steps of: (a) providing an initial Enterprise Risk Management System risk matrix (ERM risk matrix) having a plurality of cells as basis; (b) using at least one processor to form an extended ERM risk matrix from the initial ERM risk matrix by adding at least one row of cells to the initial ERM risk matrix for mapping and scaling of at least one other risk matrix, (c) mapping the at least one other risk matrix by selecting a corresponding mapping area (800) in the extended ERM risk matrix and storing the selected mapping area (800) of the of the at least one other risk matrix, (d) using the at least one processor to perform scale normalizations of the at least one other risk matrix and the corresponding stored selected mapping area (800) in the extended ERM risk matrix to the same normalization ranges, (e) using the at least one processor to perform risk assessment normalization of risks assessed towards the at least one other risk matrix onto the corresponding selected mapping area (800) of the extended ERM risk matrix by selecting the mapping area (800) cell with normalized scale values mathematically closest to the normalized scale values of the risk assessment of the at least one other risk matrix, and (f) using the at least one processor to create normalized risks from the selected mapping area (800) cells in step (e). ### Claim 17 (depends on 16) The method according to claim 16, wherein the corresponding mapping area (800) is selected manually by user interaction or automatically via a machine learning model. ### Claim 18 (depends on 16) The method according to claim 16, wherein the mapping areal (800) cell with normalized scale values mathematically closest to the normalized scale values of the risk assessment of the at least one other risk matrix is selected manually by user interaction or automatically by means of a machine learning model. ### Claim 19 (depends on 16) The method according to claim 16, comprising the step of normalizing and mapping risk matrices according to organizational hierarchy before mapping and risk normalization into the extended ERM risk matrix. ### Claim 20 (depends on 18) The method according to claim 18, wherein the step of mapping and normalizing risk matrices includes mapping and normalizing at least one sub-layer risk matrix into a parent layer risk matrix. ### Claim 21 (depends on 18) The method of claim 18, wherein the step of normalizing the of the risk rating scales of the extended ERM risk matrix and at least one other risk matrix, the sub-layer risk matrix or parental layer risk matrix is performed via or a mix of linear, exponential, logarithmic or customized normalization or a combination thereof. ### Claim 22 (depends on 16) The method according to claim 16, wherein the step of normalizing the risk rating scales of the extended ERM risk matrix and at least one other risk matrix is performed by linear, exponential, logarithmic or customized normalization or a combination thereof. ### Claim 23 (depends on 21) The method according to claim 21, comprising counting the number of rows and columns in each risk rating scale and each risk rating scale index, representing the row or column id, and normalizing the at least one other risk matrix, sub-layer risk matrix, parental layer risk matrix, and the selected mapping area (800) of the extended ERM risk matrix according to the formula: Normalized scale index=(Scale index-1)/(No. of indexes in the scale-1). ### Claim 24 (depends on 16) The method according to claim 16, comprising counting the number of rows and columns in each risk rating scale and each risk rating scale index, representing the row or column id, and normalizing the at least one other risk matrix and the selected mapping area (800) of the extended ERM risk matrix according to the formula: Normalized scale index=(Scale index-1)/(No. of indexes in the scale-1). ### Claim 25 (depends on 18) The method according to claim 18, comprising counting the number of rows and columns in each risk rating scale and each risk rating scale index, representing the row or column id, and normalizing the at least one other risk matrix and the selected mapping area (800) of the extended ERM risk matrix according to the formula: Normalized scale index=(Scale index-1)/(No. of indexes in the scale-1). ### Claim 26 (depends on 16) The method according to claim 16, comprising configuring the selected mapping for normalization and mapping of risks to only partly cover scaling of consequences. ### Claim 27 A risk management system (100) comprising: at least one client (102), a network (106) providing communication links between various clients (102) connected together within the risk management system (100), the client (102) being provided with a communication device adapted to the network (106), a graphical user interface (107) and at least one processor for processing information, wherein the at least one processor includes software for: (a) based on an initial Enterprise Risk Management risk matrix (ERM risk matrix) having a plurality of cells, forming an extended ERM risk matrix by adding at least one row to the initial ERM risk matrix for mapping and scaling of consequences of at least one other risk matrix, (b) mapping the at least one other risk matrix by selecting a corresponding mapping area (800) of cells in the extended ERM risk matrix, and storing the selected mapping area (800) of the at least one other risk matrix, (c) performing scale normalizations of the at least one other risk matrix and the stored corresponding selected mapping area (800) in the extended ERM risk matrix to the same normalization ranges, (d) performing risk assessment normalization of risks assessed towards the at least one other risk matrix onto the corresponding selected mapping area (800) of the extended ERM risk matrix by selecting the mapping area (800) cell with normalized scale values mathematically closest to the normalized scale values of the risk assessment of the at least one other risk matrix, and (e) creating normalized risks from the selected mapping area (800) cells. ### Claim 28 (depends on 27) The system according to claim 27, wherein the at least one processor is further provided with software for performing risk normalization and mapping of risk matrices according to organizational hierarchy prior to mapping and risk normalization into the extended ERM risk matrix. ### Claim 29 (depends on 28) The system according to claim 28, wherein the at least one processor is further provided with software for performing risk normalization and mapping at least one sub-layer risk matrix into a parent layer risk matrix. ### Claim 30 (depends on 27) The system according to claim 27, wherein the at least one processor is further provided with software for performing linear, exponential, logarithmic or customized normalization or a combination thereof of the risk rating scales of the extended ERM risk matrix and at least one other risk matrix. ### Claim 31 (depends on 29) The system according to claim 29, wherein the at least one processor is further provided with software for performing linear, exponential, logarithmic or customized normalization or a combination thereof of the risk rating scales of the extended ERM risk matrix and at least one other risk matrix, sub-layer risk matrix, or parental layer risk matrix. ### Claim 32 (depends on 30) The system according to claim 30, wherein the at least one processor is further provided with software for counting the number of rows and columns in each risk rating scale and each risk rating scale index, representing the row and column id, and normalizing the at least one other risk matrix and the selected mapping area (800) of the extended ERM risk matrix according to the formula: Normalized scale index=(Scale index-1)/(No. of indexes in the scale-1). ### Claim 33 (depends on 31) The system according to claim 31, wherein the at least one processor is further provided with software for counting the number of rows and columns in each risk rating scale and each risk rating scale index, representing the row and column id, and normalizing the at least one other risk matrix, sub-layer risk matrix, parental layer risk matrix, and the selected mapping area (800) of the extended ERM risk matrix according to the formula: Normalized scale index=(Scale index-1)/(No. of indexes in the scale-1). ### Claim 34 (depends on 27) The system according to claim 27, wherein the at least one processor is further provided with software for configuring the selected mapping for normalization and mapping of risks to only partly cover scaling of consequences. ### Claim 35 (depends on 27) The system according to claim 27, wherein the corresponding mapping area (800) is selected based on user input or the at least one processor is provided with software for machine learning for the selection, or the mapping area (800) cell with normalized scale values mathematically closest to the normalized scale values of the risk assessment of the at least one other risk matrix is selected based on user input or the at least one processor is provided with software for machine learning for the selection, or the corresponding mapping area (800) and the mapping area (800) cell with normalized scale values mathematically closest to the normalized scale values of the risk assessment of the at least one other risk matrix is selected based on user input or the at least one processor is provided with software for machine learning for the selection.