Application risk and control assessment tool

An apparatus configured to aid in understanding risks and controls implemented to mitigate the risks for a plurality of software applications comprising:

• an input module configured to receive first information that uniquely identifies an object, risk input reflective of a risk level associated with each of a plurality of risk categories associated with that object, and a plurality of control responses indicative of whether or not each of a plurality of control attributes has been implemented, wherein the plurality of control attributes are organized into a plurality of control categories;
• a database configured to store the first information, the risk input, the plurality of control responses, and a plurality of adjustment levels used in calculating at least one control score;
• a self assessment computing module configured to compute at least one risk score based on said risk input and the at least one control score based on said plurality of control responses;
• an output module configured to display second information associated with both the computed at least one risk score and the computed at least one control score, the output module also configured to permit filtering to study only a portion of said second information, wherein the at least one control score is calculated by first computing component control metrics for each of the plurality of control categories, wherein the component control metrics are calculated by computing a ratio between a number of affirmative responses regarding whether a particular control attribute has been implemented to a maximum possible number of affirmative responses for each control category,
• wherein the plurality of adjustment levels comprise:
• if a percentage of the affirmative responses is less than a first percentage of the maximum possible number of affirmative responses, the ratio is reduced by a first adjustment level;
• if the percentage of the affirmative responses is less than a second percentage but greater than or equal to the first percentage of the maximum possible number of affirmative responses, the ratio is reduced by a second adjustment level;
• and
• if the percentage of the affirmative responses is less than a third percentage but greater than or equal to the second percentage of the maximum possible number of affirmative responses, the ratio is reduced by a third adjustment level;
• wherein the self assessment computing module is further configured to determine which of the plurality of adjustment levels applies to the ratio and adjust the ratio based on said determination.