# US 8,543,444 B2 · Method and system for assessing compliance risk of regulated institutions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,444 B2 - Document ID: US8543444B2 - Status: Granted - Kind: B2 - Application number: 13/743,813 - Filed: 2013-01-17 - Published: 2013-05-23 - Granted: 2013-09-24 - Earliest claimed: 2011-10-21 - Assignees: NeighborBench LLC - Applicants: NeighborBench LLC - Inventors: Kenneth Price Agle; Robert Patrick Ryan; Ken Wolff - Web page: https://patentgrep.com/patent/US8543444B2 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A system and method for assessing compliance risk of a regulated institution. Data on a plurality of regulated institutions is extracted from publicly available sources and stored in an extracted information database. A client questionnaire is created and separated into a plurality of role categories. A list of employees and their area of responsibility is obtained from a client regulated institution. The client questionnaire is distributed to the employees, each employee receiving questions from a role category based on their area of responsibility. Answers are stored in a client questionnaire database. Data on the client regulated institution is located in the extracted information database. Then, based on the questionnaire answers and extracted data, the risk that the client regulated institution will not be compliant with a set of regulations is assessed. ## Claims ### Claim 1 A method for assessing compliance risk of regulated institutions, comprising: extracting, by a computer processing device, data on a plurality of regulated institutions from at least one publicly available source; storing, in an extracted information database, the extracted data; receiving, by the computer processing device, an employee list from a client regulated institution, wherein the employee list includes a plurality of employees and an area of responsibility associated with each employee of the plurality of employees; creating, by the computer processing device, a client questionnaire based on the data stored in the extracted information database, wherein the client questionnaire includes questions associated with at least one of a plurality of role categories, each role category of the plurality of role categories corresponding to an area of responsibility; distributing the client questionnaire to each employee of the plurality of employees, wherein each employee receives questions associated with a role category corresponding to the area of responsibility associated with the employee; receiving, by the computer processing device, answers to the questions distributed in the client questionnaire; storing, in a client questionnaire database, the received answers; identifying, in the extracted information database, data corresponding to the client regulated institution; storing, in the client questionnaire database, the identified data corresponding to the client regulated institution; assessing, by the processing device, the risk that the client regulated institution will not be compliant with a set of regulations based on the answers and data stored in the client questionnaire database; identifying, by the computer processing device, a risk rating value to be associated with the client regulated institution based on the assessed risk; and transmitting at least one notification to the client regulated institution, wherein the notification includes activities the client regulated institution is required to perform as prescribed by the set of regulations based on the associated risk rating value. ### Claim 2 (depends on 1) The method of claim 1, further comprising; storing any media generated by the client regulated institution when performing the prescribed activities in a client compliance database; and analyzing, by the processing device, the media stored in the client compliance database for compliance with the set of regulations. ### Claim 3 (depends on 2) The method of claim 2, further comprising: updating, by the processing device, the client questionnaire database to include new data, wherein the new data is data obtained from performing the analyzing step; repeating the assessing and creating steps after performing the updating step; and transmitting at least one notification to the client financial institution of updates to the activities to be performed as a result of the repeating step. ### Claim 4 (depends on 1) The method of claim 1, wherein the risk rating value reflects a relative risk weighing of a plurality of risk categories. ### Claim 5 (depends on 4) The method of claim 4, wherein the plurality of risk categories are impacted by at least one factor including: market environment, economic, political, technological, infrastructure, prior review, self-assessment questionnaire, and personnel risk. ### Claim 6 (depends on 4) The method of claim 4, wherein each of the plurality of risk categories includes a plurality of individual risk elements. ### Claim 7 (depends on 1) The method of claim 1, wherein transmitting the at least one notification to the client regulated institution includes transmitting a notification to each employee including activities the employee is required to perform or a request for additional review based on the area of responsibility associated with the employee. ### Claim 8 (depends on 1) The method of claim 1, wherein the client regulated institution is a financial institution. ### Claim 9 A method for assessing compliance risk of regulated institutions, comprising: extracting, a computer processing device, data on a plurality of regulated institutions from at least one publicly available source; storing, in an extracted information database, the extracted data; receiving, by the computer processing device, an employee list from a client regulated institution, wherein the employee list includes a plurality of employees and an area of responsibility associated with each employee of the plurality of employees; creating, by the processing device, a client questionnaire based on the data stored in the extracted information database, wherein the client questionnaire includes questions associated with at least one of a plurality of role categories, each role category of the plurality of role categories corresponding to an area of responsibility; distributing the client questionnaire to each employee of the plurality of employees, wherein each employee receives questions associated with a role category corresponding to the area of responsibility associated with the employee; receiving, by the computer processing device, answers to the questions distributed in the client questionnaire; storing, in a client questionnaire database, the received answers; identifying, in the extracted information database, data corresponding to the client regulated institution; storing, in the client questionnaire database, the identified data corresponding to the client regulated institution; and assessing, by the processing device, the risk that the client regulated institution will not be compliant with a set of regulations based on the answers and data stored in the client questionnaire database. ### Claim 10 (depends on 9) The method of claim 9, wherein the client regulated institution is a financial institution. ### Claim 11 A system for assessing compliance risk of a regulated institution, comprising: a client questionnaire database; a computer processing device configured to extract data on a plurality of regulated institutions from at least one publicly available source, wherein the computer processing device is further configured to receive an employee list from a client regulated institution, wherein the employee list includes a plurality of employees and an area of responsibility associated with each employee of the plurality of employees; and wherein computer processing device further configured to identify, from the extracted data, data corresponding to a client regulated institution, store, in the client questionnaire database, the identified data corresponding to the client financial institution, and generate a client questionnaire, wherein the client questionnaire includes questions associated with at least one of a plurality of role categories, each role category of the plurality of role categories corresponding to an area of responsibility; and, the computer processing device configured to distribute through a network the client questionnaire to each employee of the plurality of employees, wherein each employee receives questions associated with a role category that corresponds to the area of responsibility associated with the employee, wherein the computer processing device is further configured to receive answers to the questions distributed in the client questionnaire, and the computer processing device is further configured to store the received answers in the client questionnaire database, and assess the risk that the client regulated institution will not be compliant with a set of regulations based on the answers and data in the client questionnaire database. ### Claim 12 (depends on 11) The system of claim 11, wherein the computer processing device is further configured to identify a risk rating value to be associated with each of the plurality of role categories of the client regulated institution based on the assessed risk. ### Claim 13 (depends on 12) The system of claim 12, wherein the risk rating value reflects a relative risk weighing of a plurality of risk categories. ### Claim 14 (depends on 13) The system of claim 13, wherein the plurality of risk categories are impacted by at least one factor including: market environment, economic, political, technological, infrastructure, prior review, self-assessment questionnaire, and personnel risk. ### Claim 15 (depends on 13) The system of claim 13, wherein each of the plurality of risk categories includes a plurality of individual risk elements. ### Claim 16 (depends on 12) The system of claim 12, wherein the computer processing device is further configured to create a set of procedures to follow to achieve and/or maintain compliance with the set of regulations, wherein the set of procedures is based on the risk rating value of the client financial institution. ### Claim 17 (depends on 16) The system of claim 16, wherein the transmitting device is further configured to transmit at least one notification to the client regulated institution, wherein the at least one notification includes activities the client regulated institution is required to perform as prescribed by the set of procedures. ### Claim 18 (depends on 17) The system of claim 17, wherein the computer processing device is further configured to store any media generated by the client financial institution when performing the prescribed activities in a client compliance database, and analyze the media stored in the client compliance database for compliance with the set of regulations. ### Claim 19 (depends on 18) The system of claim 18, wherein the computer processing device is further configured to update the client questionnaire database to include new data obtained by analyzing the media stored in the client compliance database. ### Claim 20 (depends on 17) The system of claim 17, wherein transmitting the at least one notification to the client regulated institution includes transmitting a notification to each employee including activities the employee is required to perform or a request for additional review based on the area of responsibility associated with the employee. ### Claim 21 (depends on 1) The method of claim 1, further comprising: creating a set of procedures for the client regulated institution to follow to achieve and/or maintain compliance with the set of regulations, wherein the set of procedures is based on the identified risk rating value. ### Claim 22 (depends on 21) The method of claim 21, wherein the set of procedures includes a request for additional information to be provided for ongoing review. ### Claim 23 (depends on 16) The system of claim 16, wherein the set of procedures includes a request for additional information to be provided for ongoing review. ### Claim 24 (depends on 1) The method of claim 1, wherein identifying a risk rating value to be associated with the client regulated institution further includes identifying a risk rating value to be associated with each of the plurality of role categories of the client regulated institution.