Patent Application
20120290989
The art of risk management typically involves making sense of a large amount of information about risks, as well as their causes, relationships, and relative importance. While computers can often calculate inputted information with ease, it has become increasingly challenging to present increasingly complex and large amounts of risk-related information to human users without overwhelming them.
A traditional way to measure and document risk may be through the use of a spreadsheet with multiple tables, columns, and rows, similar to a FEMA template. However, once documentation is complete, users interpreting the information may feel that the focus of the information may have been buried among large quantities of data. Accordingly, user may not have a clear picture of various risks, their importance, and their correlation.
Various examples of a risk management system, method, and software are described herein that may be able to present risk-related information to a human user in a meaningful and helpful way. In particular, one or more user interfaces may be presented to a user by a computer, and that may allow a risk management team to better understand the level of interconnection among risks and make appropriate decisions from this information. Such a user interface may provide a tool for robustly documenting risks, and for visually communicating their characteristics such as likelihood, severity, detectability, and/or domain, as well as the interrelations between the risks. The awareness of the interconnection of risks may then be weaved into decision-making for key areas such as people, processes, regulations, technology, operations, and/or environment.
For instance, the user interface may include a master risk landscape map that includes nodes representing risks and links representing correlations between the risks. The visual appearance of the nodes and links may provide information about their characteristics, such as risk likelihood, risks severity, risk detectability, and/or strength of interconnectivity. The user may be able to interact with the master risk landscape map to drill down to further detail while simultaneously removing less relevant information as desired, thereby potentially allowing the user to focus on the most relevant information.
Some aspects as described herein are directed to a computer comprising a processor and a non-transitory computer-readable medium storing computer-executable instructions for causing the computer to perform steps, and further storing data representing a correlation between each of a plurality of pairs of risks. The steps may include generating a first user interface of a plurality of nodes and a plurality of links between the nodes, wherein each of the nodes represents one of the risks and each of the links represents one of the correlations, and causing the first user interface to be displayed on a display device.
Further aspects are directed to a method, which may be implemented by computer-executable instructions stored on a non-transitory computer-readable medium. The method may include determining, for each of a plurality of pairs of risks, correlations between the respective pair of risks; generating, by a computer, a first user interface of a plurality of nodes and a plurality of displayed links the nodes, wherein each of the nodes represents one of the risks and each of the links represents one of the correlations, and displaying, on a display device, the first user interface.
These and other aspects of the disclosure will be apparent upon consideration of the following detailed description.
A more complete understanding of the present disclosure and the potential advantages of various aspects described herein may be acquired by referring to the following description in consideration of the accompanying drawings, in which like reference numbers indicate like features, and wherein:
Various example embodiments of a user interface are described herein. The user interfaces may be generated and/or displayed by, e.g., a computer. A computer may include any electronic, electro-optical, and/or mechanical device, or system of multiple physically separate such devices, that is able to process and manipulate information, such as in the form of data. Non-limiting examples of a computer include one or more personal computers (e.g., desktop, tablet, or laptop), servers, smart phones, personal digital assistants (PDAs), television set top boxes, service gateway devices, digital video recorders, mobile video devices, and/or a system of these in any combination or subcombination. In addition, a given computer may be physically located completely in one location or may be distributed amongst a plurality of locations (i.e., may implement distributive computing). A computer may be or include a general-purpose computer and/or a dedicated computer configured to perform only certain limited functions, such as a network router.
An example functional-block representation of a computer 100 is shown in
Computer-readable medium 102 may include not only a single physical non-transitory medium or single type of such medium, but also a combination of one or more such media and/or types of such media. Examples of computer-readable medium 102 include, but are not limited to, one or more memories, hard drives, optical discs (such as CDs or DVDs), magnetic discs, and magnetic tape drives. Computer-readable medium 102 may be physically part of, or otherwise accessible by, computer 100, and may store computer-readable data representing computer-executable instructions (e.g., software) and/or non-executable data.
Computer 100 may also include a user input/output interface 103 for receiving input from a user via a user input device (e.g., a keyboard, a mouse, touch-sensitive display, and/or a remote control) and providing output to the user via a user output device (e.g., a display device 105, an audio speaker, and/or a printer). Display device 105 may be any device capable of presenting information for visual consumption by a human, such as a television, a computer monitor or display, a touch-sensitive display, or a projector. Computer 100 may further include a communication input/output interface 104 for communicating with devices external to computer 100, such as with other computers and/or other nodes in a network.
Computer 100 may be used to generate and/or display one or more user interfaces. The user interfaces may present risk assessment information in a way that may be considered extremely useful, such as by presenting a visualization of complex correlations between risks, simultaneously with a visualization of characteristic score data of those risks. For instance, one or more of the user interfaces may dynamically generate an interactive graphical map indicating interconnections between various risks, as well as one or more characteristics of those risks such as risk likelihood, risk severity, and/or the ability for an event associated with a risk to be detected. The user may be able to interact with the map to study the interconnections in isolation and/or in greater detail. Using such a map may potentially facilitate decision making to focus on managing systemic risks more effectively, by vividly demonstrating the interconnection between selected risks and the likelihood and/or severity of those risks themselves. In doing so, the user interface may raise the user's awareness and/or recognition of the interconnection among risks, and may be used as a presentation tool to engage audiences by allowing the user to drill down into the details of different risks and their interactions in the interactive map. Such an interactive dynamic risk map may be useful to a variety of audiences, such as business controls monitoring and readiness teams, strategic planning organizations, line-of-business units, occupancy planning units, and planning directors. Moreover, the computer and/or user to leverage pair-wise comparison in defining weights for different attributes when calculating risk scores.
Risks may be identified by one or more characteristics, each characteristic having a score. As discussed above, the characteristics of each risk may include risk likelihood, risk severity, and/or the ability for an event associated with a risk to be detected. In addition, risks may be interconnected together. For instance, the occurrence of an event associated with a first risk may affect the likelihood of occurrence of, severity of, and/or ability to detect, an event associated with a second risk. Table 1 below shows example data that may define characteristic scores, and Table 2 below shows example data that may define the interconnectivity, or correlation, of various risks. This data may be stored in, e.g., computer-readable medium 102.
A user interface may be presented by computer 100 that may allow a user to enter the information such as in Tables 1 and 2, and to present information from the entered/stored data in a useful format. The user interface may further be interactive, allowing the user to request that additional details about the data be presented and/or focused upon by the user interface. In some embodiments, the user interface may display multiple input fields (e.g., text entry fields) in a tabular format such as that shown in Tables 1 and 2. In such a case, the user may enter the data directly into the input fields representing one or more attributes of the risks (such as any of the attributes represented by the various columns of Table 1) and/or one or more attributes of the correlations between the risks (such as the correlation strengths between risk pairs as shown in Table 2), such as by using a keyboard and/or a mouse. In further embodiments, the data may be entered in a different manner and/or imported from a separate source, such as a computer-readable medium storing the data in a predetermined format.
The nodes may each include a graphical and/or textual label indicating which risk is represented. For instance, node 202A includes the indication of “CC,” which in this example may represent the risk of Capacity Constraints (see Table 1). As another example, the node labeled “HW” may represent the risk of Hours Worked (see Table 1). Any indication may be used to identify which risk is associated with each node, such as the risk name or abbreviation, risk ID. Additionally or alternatively, the appearance of the node may indicate which risk is represented, such as by the node being displayed as, or otherwise including, a particular picture, a particular color, a particular pattern, a particular size, and/or a particular shape.
The nodes may further include a graphical and/or textual indication of which risk domain or other risk category is associated with that node. For example, the appearance of the node may indicate the associated risk domain, such as by the node being displayed as, or otherwise including, a particular picture, a particular color, a particular pattern, a particular size, and/or a particular shape. In the present example, the possible domains are People, Process, Technology, Operations, Environment, and Regulations. However, any set of domains or other categories may be used. Also, in this example, each domain is represented by a different pattern or color.
The nodes may further include a textual and/or graphical indication of the likelihood, severity, and/or detection scores indicated by the stored data (e.g., the data of Table 1). For example, the appearance of the node may indicate any or all of these three features, such as by the node being displayed as, or otherwise including, a particular picture, a particular color, a particular pattern, a particular size, and/or a particular shape. In the particular example shown in
The appearance and/or labeling of the links in the user interface may provide information about various characteristics of the links. For example, in the present example of
The nodes may be arranged in the user interface in any manner desired. For instance, the nodes may be randomly distributed across an area of the display. In such a case, the user interface may be configured to ensure that one node does not unduly obscure another node from view. In other examples, the nodes may be arranged in accordance with one or more characteristics of the risks associated with the nodes. For example, the nodes may be distributed horizontally in accordance with their associated likelihoods and vertically in accordance with their associated severities (or vice versa).
The user interface of
Responsive to the user selecting the “Cyb” node from the user interface of
Where the user further selects one of the nodes displayed in map 401 (e.g., by hovering over, clicking on, or touching the node), an indicator 402 may indicate the likelihood and severity of the further selected node. For instance, responsive to the user selecting the Cyb node in the
Also, when the user selects one of the nodes in the
The
Any of the user interfaces may include one or more buttons or other selectable elements for navigating amongst various user interface screens. For example, the
While some features have been described as being associated only with the
Thus, various example systems, methods, and software have been described that may provide a tool for robustly documenting risks, and for visually communicating their characteristics such as likelihood, severity, detectability, and/or domain, as well as the interrelations between the risks. While embodiments of the present invention have been illustrated and described, it is not intended that these embodiments illustrate and describe all possible forms of the present invention. Rather, the words used in the specification are words of description rather than limitation, and it is understood that various changes may be made without departing from the spirit and scope of the present disclosure.
