Information processing systems, information processing methods, and programs

Abstract

This invention provides an information processing system, method, and program for identifying security risks in the supply chain. [Solution] A method in an information processing system, wherein in the transaction investigation request acceptance step, the trading organization receives first request information regarding the necessity of a secondary transaction investigation of the trading partner organization in which the transaction takes place. The secondary transaction investigation is an investigation regarding the trading partner organization's transactions with other organizations that are the subject of the transaction. In the security investigation request acceptance step, the trading organization receives second request information regarding the necessity or type of security investigation of the trading partner organization. The security investigation is an investigation regarding the security of the trading partner organization. In the form submission step, in accordance with the first request information, a first response form is sent to the trading partner organization for inputting responses to the secondary transaction investigation, and in accordance with the second request information, a second response form is sent to the trading partner organization for inputting responses to the security investigation.

Description

Technical Field

[0001] The present invention relates to an information processing system, an information processing method, and a program.

Background Art

[0002] Patent Document 1 describes a technique for requesting an answer to a security-related question and performing checks such as security.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In a supply chain, it is necessary to grasp the risks related to the security of the supply chain.

[0005] In view of the above circumstances, the present invention aims to provide an information processing system and the like that can grasp the risks related to the security of the supply chain.

Means for Solving the Problems

[0006] According to one aspect of the present invention, an information processing system is provided, comprising at least one processor, the processor configured to perform the following steps by reading a program, wherein in the transaction investigation request acceptance step, the system receives first request information from the trading organization regarding the necessity of a secondary transaction investigation of the trading partner organization in which the transaction is conducted, and the secondary transaction investigation is an investigation concerning the trading partner organization's transactions with other organizations that are the subject of the transaction; in the security investigation request acceptance step, the system receives second request information from the trading organization regarding the necessity or type of security investigation of the trading partner organization, and the security investigation is an investigation concerning the security of the trading partner organization; and in the form submission step, the system sends a first response form to the trading partner organization in which it inputs a response to the secondary transaction investigation in accordance with the first request information, and sends a second response form to the trading partner organization in which it inputs a response to the security investigation in accordance with the second request information.

[0007] In this configuration, the trading organization can collect information on secondary suppliers and security-related information from its trading partners. Therefore, it can identify security risks within the supply chain. [Brief explanation of the drawing]

[0008] [Figure 1] This is a diagram showing the configuration of Information Processing System 1. [Figure 2] This block diagram shows the hardware configuration of the server device 10 and the trading organization terminal 20. [Figure 3] This block diagram shows the hardware configuration of the evaluator terminal 30 and the trading partner organization terminal 40. [Figure 4] This is a block diagram showing the functions implemented by the server device 10 (control unit 11). [Figure 5] This is a block diagram showing the functions realized by the trading source organization terminal 20 (control unit 21), the evaluator terminal 30 (control unit 31), and the trading partner organization terminal 40 (control unit 41). [Figure 6]This figure shows an example of the first survey request screen SD1 displayed on the trading organization terminal 20. [Figure 7] This figure shows an example of the state in which the trading partner organization has been entered into the first survey application screen SD1. [Figure 8] This figure shows an example of the second investigation request screen SD2 displayed on the trading organization terminal 20. [Figure 9] This figure shows an example of the third investigation request screen SD3 displayed on the trading organization terminal 20. [Figure 10] This figure shows an example of the first response form display screen FD that is displayed on the client organization terminal 40. [Figure 11] This figure shows an example of the hierarchical structure display screen HD shown on the trading organization terminal 20. [Figure 12] This figure shows another example of the transaction hierarchy structure HS displayed on the hierarchical structure display screen HD in Figure 11. [Figure 13] This figure shows yet another example of the hierarchical structure display screen HD shown on the trading organization terminal 20. [Figure 14] This figure shows the state of the hierarchical structure display screen HD as it has changed. [Figure 15] This figure shows an example of the progress display screen PD displayed on the trading organization terminal 20. [Figure 16] This figure shows an example of the investigation list display screen LD shown on the trading organization terminal 20. [Figure 17] This figure shows an example of the SRD (Service Level Display) screen for displaying the investigation results, which is shown on the trading organization's terminal 20. [Figure 18] This figure shows another example of the investigation list display screen LD shown on the trading organization terminal 20. [Figure 19] This is an activity diagram showing an example of the flow of information processing (security investigation processing) performed by Information Processing System 1. [Modes for carrying out the invention]

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Various features shown in the embodiments described below can be combined with each other.

[0010] By the way, a program for realizing software appearing in one embodiment may be provided as a non-transitory computer-readable medium that can be read by a computer, may be provided so as to be downloadable from an external server, or may be provided so that the program is started on an external computer to realize its function on a client terminal (so-called cloud computing).

[0011] Also, in various information processes according to one embodiment, an input and an output corresponding to the input can be realized. Here, if an output is obtained as a result of the input, the mode of information (hereinafter referred to as reference information) referred to in such information processing is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, a predetermined function (including a determination formula such as a regression formula constructed by a statistical method), a learned model in which the correlation between the input and the output has been learned in advance, or a large language model capable of outputting a desired result by inputting a prompt.

[0012] Also, in one embodiment, the "part" may include, for example, hardware resources implemented by a circuit in a broad sense and information processing of software that can be specifically realized by these hardware resources. Also, in one embodiment, various information is handled, and these information are represented, for example, by physical values of signal values representing voltage and current, the level of signal values as a set of binary bits composed of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculation can be executed on a circuit in a broad sense.

[0013] Furthermore, a circuit in a broad sense is a circuit realized by appropriately combining at least a circuit (Circuit), circuitry (Circuitry), a processor (Processor), and a memory (Memory), etc. Also, the processor may be a general-purpose processor or a dedicated circuit. That is, it includes an application specific integrated circuit (ASIC), a programmable logic device (for example, a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration In this section, the hardware configuration will be described.

[0015] <Information Processing System 1> FIG. 1 is a configuration diagram showing the information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of source organization terminals 20, at least one evaluator terminal 30, and a plurality of destination organization terminals 40. The server device 10, the source organization terminals 20, the evaluator terminal 30, and the destination organization terminals 40 are configured to be able to communicate with each other through the communication line 2. The connections of the server device 10, the source organization terminals 20, the evaluator terminal 30, and the destination organization terminals 40 may be wired or wireless.

[0016] Information processing system 1 constitutes at least a part of a security evaluation system used by multiple trading source organizations (first trading source organization U1 and second trading source organization U2), at least one evaluator U3, and multiple trading partner organizations (first trading partner organization U4 and second trading partner organization U5). Information processing system 1 primarily performs security evaluations of trading partner organizations and collects supply chain information. In one embodiment, information processing system 1 consists of one or more devices or components. These components will be described below.

[0017] <Server device 10> Figure 2 is a block diagram showing the hardware configuration of the server device 10 and the trading organization terminal 20. As shown in Figure 2A, the server device 10 comprises a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. The control unit 11, the storage unit 12, and the communication unit 13 are electrically connected within the server device 10 via the communication bus 14.

[0018] <Control Unit 11> The control unit 11 performs processing and control of the overall operation related to the server device 10. The control unit 11 is, for example, a Central Processing Unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading predetermined programs stored in the memory unit 12. That is, information processing by software stored in the memory unit 12 is concretely realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being a single unit, and there may be multiple control units 11 for each function. Furthermore, the control unit 11 may have a configuration that combines these.

[0019] <Storage section 12> The storage unit 12 stores various types of information as defined above. This can be done, for example, as a storage device such as a solid-state drive (SSD) that stores various programs related to the server device 10 executed by the control unit 11, or as memory such as random access memory (RAM) that stores temporarily necessary information (arguments, arrays, etc.) related to program calculations. The storage unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Department 13> The communication unit 13 preferably uses wired communication methods such as USB, IEEE1394, Thunderbolt®, and wired LAN network communication, but may also include wireless LAN network communication, mobile communication such as 3G / LTE / 5G, and Bluetooth® communication as needed. In other words, it is more preferable to implement it as a collection of these multiple communication methods. That is, the server device 10 may communicate various information from the outside via the communication unit 13 and the network.

[0021] The server device 10 may be on-premises or in a cloud environment. A cloud-based server device 10 may provide the above-mentioned functions and processing in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Trading Organization Terminal 20> The trading organization terminal 20 is an information processing terminal used by the trading organization (an organization that has a trading partner) or its representative. Transactions can include all forms of transactions, such as the provision of goods and services, and the outsourcing of operations. Furthermore, "organization" includes for-profit corporations (e.g., companies), non-profit corporations (e.g., cooperatives, foundations, etc.), public corporations (e.g., local governments, etc.).

[0023] A trading organization is an organization that requests a transaction from a trading partner organization, and receives or uses the goods or services provided by the trading partner organization. For example, if the goods or services traded are physical objects, the trading organization is the purchaser of the goods (finished products or parts) manufactured by the trading partner organization. Also, for example, if the goods or services traded are services, the trading organization is the user of the services provided by the trading partner organization. Furthermore, for example, if the goods or services traded are operations (work), the trading organization is the client or contractor for those operations.

[0024] A trading organization may be a trading partner, requesting party, ordering party, buyer, parent company, etc., from the perspective of a trading partner organization. Trading organizations include end users and intermediaries in the supply chain. End users include, for example, final product manufacturers, trading companies, and telecommunications companies. Intermediaries include, for example, parts manufacturers, material manufacturers (intermediate manufacturers), processors, distributors, and wholesale intermediaries. Furthermore, a trading organization may also be a trading partner organization to other trading organizations.

[0025] As shown in Figure 2B, the trading organization terminal 20 comprises a control unit 21, a storage unit 22, a communication unit 23, an input unit 24, an output unit 25, and a communication bus 26. The control unit 21, storage unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected within the trading organization terminal 20 via the communication bus 26. The descriptions of the control unit 21, storage unit 22, and communication unit 23 are the same as the descriptions of each part in the server device 10 and are therefore omitted.

[0026] <Input section 24> The input unit 24 receives operation inputs made by the user. The operation inputs are transmitted as command signals to the control unit 21 via the communication bus 26. The control unit 21 can perform predetermined controls or calculations based on the transmitted command signals as needed. The input unit 24 may be included in the housing of the trading organization terminal 20 or it may be externally attached. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input tap operations, swipe operations, etc. to the input unit 24. Instead of a touch panel, the input unit 24 can be a switch button, mouse, trackpad, QWERTY keyboard, etc.

[0027] <Output section 25> The output unit 25 displays a graphical user interface (GUI) screen that can be operated by the user. The output unit 25 may be included in the housing of the trading organization terminal 20 or it may be an external device. Specifically, the output unit 25 can be implemented as a display device such as a CRT display, liquid crystal display, organic EL display, or plasma display. It is preferable that these display devices be used according to the type of trading organization terminal 20.

[0028] <Evaluator terminal 30> The evaluator terminal 30 is an information processing terminal used by evaluators to evaluate the responses of client organizations. The evaluators are organizations such as companies that conduct security evaluations (for example, security evaluation companies that conduct security evaluations of services such as cloud services and software) or their personnel. The evaluators, for example, conduct service evaluations from the evaluator terminal 30 via the information processing system 1.

[0029] Figure 3 is a block diagram showing the hardware configuration of the evaluator terminal 30 and the trading partner organization terminal 40. As shown in Figure 3A, the evaluator terminal 30 comprises a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. The control unit 31, storage unit 32, communication unit 33, input unit 34, and output unit 35 are electrically connected within the evaluator terminal 30 via the communication bus 36. The descriptions of the control unit 31, storage unit 32, communication unit 33, input unit 34, and output unit 35 of the evaluator terminal 30 are the same as the descriptions of each part in the trading partner organization terminal 20, so they are omitted.

[0030] <Client Organization Terminal 40> The trading partner organization terminal 40 is an information processing terminal used by a trading partner organization (an organization that receives transactions from another organization) or its representative. A trading partner organization includes primary trading partner organizations that receive transactions directly from the trading source organization, secondary trading partner organizations that receive secondary transactions from primary trading partner organizations, and so on. In other words, the trading partner organization terminal 40 is a terminal used by a primary trading partner organization or an Nth-tier trading partner organization (N>1) from the perspective of the trading source organization. Primary and Nth-tier trading partner organizations for a single transaction constitute a supply chain for that transaction. The transaction includes goods traded, outsourced services, etc. Furthermore, a trading partner organization may also include individual business owners who receive transactions.

[0031] A trading partner organization is an organization located downstream from the trading partner organization in the supply chain. From the perspective of the trading partner organization, a trading partner organization may include trading partners, contractors (including subcontractors and sub-subcontractors), vendors, suppliers, sellers, subsidiaries, etc. A trading partner organization may include entities other than end users in the supply chain.

[0032] As shown in Figure 3B, the trading partner organization terminal 40 comprises a control unit 41, a storage unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. The control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 are electrically connected within the trading partner organization terminal 40 via the communication bus 46. The descriptions of the control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 of the trading partner organization terminal 40 are the same as the descriptions of each part in the trading source organization terminal 20 and are therefore omitted.

[0033] 2. Functional Configuration This section describes the functional configuration of this embodiment. Information processing by software stored in the memory unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor provided by the information processing system 1).

[0034] Figure 4 is a block diagram showing the functions implemented by the server device 10 (control unit 11). As shown in Figure 4, the server device 10 (control unit 11) includes a basic display control unit 111, a transaction investigation request reception unit 112A, a security investigation request reception unit 112B, a form submission unit 113, a ticket management unit 114, a first response reception unit 115A, a second response reception unit 115B, a response registration unit 116, a hierarchical structure display control unit 117, a progress display control unit 118, an investigation list display control unit 119, and an artificial intelligence unit 120.

[0035] Figure 5 is a block diagram showing the functions realized by the trading source organization terminal 20 (control unit 21), the evaluator terminal 30 (control unit 31), and the trading partner organization terminal 40 (control unit 41). As shown in Figure 5A, the trading source organization terminal 20 (control unit 21) includes a display unit 211 and an operation acquisition unit 212. As shown in Figure 5B, the evaluator terminal 30 (control unit 31) includes a display unit 311 and an operation acquisition unit 312. As shown in Figure 5C, the trading partner organization terminal 40 (control unit 41) includes a display unit 411 and an operation acquisition unit 412.

[0036] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the trading organization terminal 20, the evaluator terminal 30, and the trading partner organization terminal 40. For example, the basic display control unit 111 displays the input form in which the trading partner organization enters its answers, the answers entered by the trading partner organization, and the evaluator's evaluation results on the display unit 211 of the trading organization terminal 20, the display unit 311 of the evaluator terminal 30, or the display unit 411 of the trading partner organization terminal 40.

[0037] <Transaction Investigation Request Reception Department 112A> The Transaction Investigation Request Reception Unit 112A is configured to receive, as first request information, whether a secondary transaction investigation is necessary for the trading partner organization in which the transaction takes place. A secondary transaction investigation is an investigation into the trading partner organization's transactions with other organizations that are the subject of the transaction. For example, a secondary transaction investigation is an investigation into the existence of N-th tier trading partner organizations (N>1) from the perspective of the trading partner organization, including secondary trading partner organizations that directly receive secondary transactions from the primary trading partner organization, as well as tertiary trading partner organizations that receive tertiary transactions from the secondary trading partner organization, and may be read as an "N-th tier transaction investigation." A secondary transaction investigation may also be called a "subcontractor investigation." In other words, the Transaction Investigation Request Reception Unit 112A receives requests from the primary trading partner organization to provide information on N-th tier trading partner organizations (M-th tier trading partner organizations (M≧1) from the perspective of the primary trading partner organization). A secondary transaction investigation may also be an investigation into the constituent organizations of the subsupply chain formed by the trading partner organization with respect to the subject of the transaction.

[0038] If a trading organization conducts direct transactions with multiple primary trading partners for a single transaction, the transaction investigation request reception unit 112A accepts whether a secondary transaction investigation is necessary for each of the multiple primary trading partners. In other words, the first request information may include whether a secondary transaction investigation is necessary for each of the multiple primary trading partners.

[0039] The Transaction Investigation Request Reception Unit 112A may also accept, as initial request information, whether a secondary transaction investigation is necessary for the secondary trading partner organization in which the secondary transaction of the target transaction takes place. This allows the primary trading organization to directly request a secondary transaction investigation from secondary trading partner organizations that it is aware of. Note that "secondary transaction investigation for N-th tier trading partner organizations" refers to an investigation concerning trading partners downstream from the N-th tier trading partner organization (i.e., N+1-th tier trading partner organizations and beyond).

[0040] The transaction investigation request reception unit 112A receives input, for example, from the trading source organization terminal 20, including the name of the trading partner organization and whether a secondary transaction investigation of the trading partner organization is necessary. Whether a secondary transaction investigation is necessary is entered, for example, by selecting an option indicating the necessity. The trading partner organization name may also be selected from a pre-registered list.

[0041] The transaction investigation request receiving unit 112A may accept information regarding whether or not secondary transactions are prohibited for the trading partner organization. For trading partner organizations where the prohibition of secondary transactions has been entered in the trading source organization terminal 20 (trading partner organizations where the attribute "prohibition of secondary transactions (subcontracting)" is set), the transaction investigation request receiving unit 112A sets the secondary transaction investigation as "unnecessary" (that is, it sets the initial value for the necessity of a secondary transaction investigation as "unnecessary" or accepts the first request information where the necessity of a secondary transaction investigation is set as "unnecessary"). On the other hand, for trading partner organizations where secondary transactions are not prohibited (where the prohibition of secondary transactions has not been entered), the transaction investigation request receiving unit 112A separately accepts input regarding the necessity of a secondary transaction investigation. In other words, the transaction investigation request receiving unit 112A does not accept input regarding the necessity of a secondary transaction investigation for trading organizations where secondary transactions are prohibited.

[0042] <Security Investigation Request Reception Department 112B> The Security Investigation Request Reception Unit 112B is configured to receive information from the trading organization regarding the necessity or type of security investigation for the trading partner organization as second-party request information. The security investigation is an investigation concerning the security of the trading partner organization. The security covered by the security investigation includes, for example, the security of the trading partner organization itself, and the security of the transaction object (i.e., the goods, services, etc., provided by the trading partner organization).

[0043] The necessity and type of security investigation are selected based on factors such as the type of transaction, the type of information handled (e.g., whether or not specific information such as personal information is handled), the importance of the trading partner organization, the scope of responsibility borne by the primary trading partner organization and the trading partner organization, and the trading partner organization's risk tolerance. The type of security investigation is also defined by factors such as the number of questions and the types of questions. For example, two types of security investigations may be offered: a "standard investigation" and a "simplified investigation" with fewer questions than the "standard investigation."

[0044] If a trading organization conducts direct transactions with multiple primary trading partners for a single transaction, the transaction investigation request reception unit 112A accepts inquiries regarding the necessity or type of security investigations for the multiple primary trading partners. In other words, the second request information may include whether or not security investigations are necessary or the type of security investigations for the multiple primary trading partners.

[0045] The Security Investigation Request Reception Unit 112B may further accept information regarding the necessity or type of security investigation for secondary trading partners as second-tier request information. This allows the primary trading organization to directly request security investigations from secondary trading partners that it is aware of.

[0046] The security investigation request reception unit 112B does not accept security investigation requests from the trading organization's terminal 20 for trading partner organizations that have a ban on secondary transactions. In other words, the trading organization cannot select the option to indicate that a security investigation is necessary for trading partner organizations that have a ban on secondary transactions.

[0047] The security investigation request reception unit 112B accepts input from, for example, the trading partner organization's terminal 20, including the trading partner organization's name and whether or not a security investigation is necessary or of the type. The necessity or type of security investigation is entered, for example, by selecting from options indicating the necessity or type. The trading partner organization's name may also be selected from a pre-registered list. Furthermore, the trading partner organization name may be accepted by both the transaction investigation request reception unit 112A and the security investigation request reception unit 112B from a single input field. In other words, a portion of the input form for the first request information to the transaction investigation request reception unit 112A and a portion of the input form for the second request information to the security investigation request reception unit 112B may be shared.

[0048] The security investigation request receiving unit 112B accepts input of the attributes of the trading partner organization from the trading partner organization and may also present the trading partner organization with options for selecting whether or not a security investigation is necessary or what type of investigation is required, with initial values ​​set based on the attributes of the trading partner organization. This enables the trading partner organization to manage the supply chain based on the attributes of the trading partner organization and reduces the burden on the trading partner organization to input information regarding security investigation requests.

[0049] The attributes of a trading partner organization include attributes related to the organization itself, attributes related to the transaction, etc. Attributes related to the organization include, for example, the organization's location or nationality (region, country, etc.), industry, business type, size (number of employees, etc.), whether it is a corporation or an individual, etc. Attributes related to the transaction include the type of transaction, business scale, distribution channel, consignment information, etc. Furthermore, the attributes of a trading partner organization may include important attributes indicating that it is a trading partner organization that the trading source organization considers important (for example, a trading partner organization for which there are no alternatives). The attributes of a trading partner organization are entered, for example, by selecting an input object such as a checkbox that displays the attribute on the trading source organization terminal 20. Alternatively, initial attribute values ​​may be assigned to the trading partner organization, for example, by referring to an organization database.

[0050] The security investigation request receiving unit 112B may accept input of information deposit attributes from the trading organization, indicating that the trading organization will receive specific information from the trading organization. "Specific information" includes, for example, highly sensitive information such as personal information, confidential information, and information whose use should be restricted.

[0051] The security investigation request receiving unit 112B sets the initial value (hereinafter referred to as "initial investigation value") for the necessity or type of security investigation based on the attributes set for the trading partner organization and reference information. The reference information includes the correlation between attributes and the initial investigation value and is stored, for example, in the storage unit 12. The reference information includes, for example, tables, algorithms, etc., that define attributes or combinations of multiple attributes and the corresponding initial investigation value.

[0052] For example, the security investigation request reception unit 112B sets the initial investigation value to "Security investigation required - simplified investigation" based on reference information for business partners that do not have an information deposit attribute set (for example, do not accept personal information). Alternatively, the security investigation request reception unit 112B may set the initial investigation value to "Security investigation required - standard investigation" for business partners that have an information deposit attribute set (for example, handle important information) or business partners that have the attribute "important contractor".

[0053] For example, the security investigation request reception unit 112B may set the initial investigation value to "no security investigation" depending on the business operations of the client organization.

[0054] The security investigation request reception unit 112B displays the field for selecting whether or not a security investigation is necessary or the type of investigation on the trading organization's terminal 20, with, for example, an initial investigation value (e.g., "Do not investigate") selected initially, and the trading organization being able to modify the selection.

[0055] If there is no need to change the initial investigation value, the trading organization confirms the request for a security investigation on the trading organization terminal 20 with the initial investigation value selected. On the other hand, if there is a need to change the initial investigation value, the trading organization selects an option other than the initial investigation value on the trading organization terminal 20 and then confirms the request for a security investigation.

[0056] A request for a security investigation may be made before the request for a secondary transaction investigation, or after the response to the secondary transaction investigation (response to the second response form). In other words, the security investigation request reception unit 112B may accept requests for security investigations against trading partner organizations included in the response to the secondary transaction investigation (trading partner organizations newly added to the supply chain).

[0057] <Investigation Request Submission Screen> Figure 6 shows an example of the first survey request screen SD1 displayed on the trading organization terminal 20. Figure 7 shows an example of the first survey request screen SD1 with the trading partner organization entered. The first survey request screen SD1 includes a case input field CF, a trading partner input field BF, and a create button B11. The case input field CF accepts input such as the case name (name of the trading subject) and case summary (summary of the outsourced work in the examples of Figures 6 and 7).

[0058] The customer input field BF accepts input of customer organization information, investigation request details, etc. The customer input field BF includes the organization registration field OF and the information input field IF. The organization registration field OF accepts input of the customer organization's name and the customer organization's hierarchy in the supply chain (information indicating which level of customer it is). Specifically, the organization registration field OF displays the organization name input box NF, the move object MO, the edit object EO, the detail display object SO, the organization add object AO, and the import object IO.

[0059] The Organization Name Input Field NF accepts the name of the outsourced organization. The Organization Name Input Field NF displays a number indicating the tier of the business partner at the beginning. A Move Object MO is assigned to each Organization Name Input Field NF, and accepts operations to move the corresponding Organization Name Input Field NF up or down. Specifically, when a Move Object MO is selected and dragged, the displayed row of the Organization Name Input Field NF is changed.

[0060] Each editing object EO is assigned to a single organization name input field NF, and accepts changes to the hierarchy of the corresponding organization name input field NF. Specifically, an input operation on the left arrow contained in the editing object EO moves the corresponding organization name input field NF up one level. Similarly, an input operation on the right arrow contained in the editing object EO moves the corresponding organization name input field NF down one level. As shown in Figure 7, the left and right display positions of the organization name input fields NF are determined according to the hierarchy. Specifically, lower-level organizations are displayed to the right. In addition, an input operation on the X mark contained in the editing object EO deletes the corresponding organization name input field NF.

[0061] The detail display object SO is assigned to each organization name input field NF, and displays the detailed information (request setting items) of the corresponding trading partner organization in the information input field IF. The organization addition object AO accepts input to add an organization name input field NF to the organization registration field OF. The import object IO accepts input to import trading partner organization information, supply chain information, etc.

[0062] The information input field IF accepts input of detailed information about the trading partner organization, its attributes, and whether or not a security investigation is necessary or the type of investigation. Specifically, the information input field IF displays the organization information input area OA, the attribute input area AA, and the investigation input area SA. The organization information input area OA is the area that displays and accepts input of the company name, corporate number, address, contact information (person in charge), etc., of the trading partner organization selected in the organization registration field OF. The trading partner organization information may be automatically obtained from, for example, the organization database (master information).

[0063] The attribute input area AA is the area for receiving input of attributes for the trading partner organization selected in the organization registration field OF. For example, attribute options are displayed along with selection objects such as checkboxes. The survey input area SA is the area for receiving input regarding whether or not a security survey is necessary or the type of security survey for the trading partner organization selected in the organization registration field OF. For example, options indicating whether or not a security survey is necessary or the type of security survey are displayed along with single-choice selection objects such as radio buttons.

[0064] When an input operation is performed on the Create button B11, the information of the trading partner organization entered in the trading partner input field BF, the necessity or type of security investigation, etc., are registered in the supply chain database of the storage unit 12, for example.

[0065] Figure 8 shows an example of the second investigation request screen SD2 displayed on the trading organization terminal 20. The second investigation request screen SD2 is a screen for requesting a second-level transaction investigation from the trading partner organization. The second investigation request screen SD2 is called up, for example, after registering the trading partner organization's information on the first investigation request screen SD1 in Figure 7, by an instruction from the trading organization terminal 20 to request a transaction investigation (for example, inputting the transaction target that will display the second investigation request screen SD2).

[0066] The second investigation request screen SD2 includes a request recipient selection area RA1 and a request button B21. The request recipient selection area RA1 displays at least one trading partner organization PO entered on the first investigation request screen SD1 as an option, along with information indicating the supply chain hierarchy (how many tiers the trading partner is). Each trading partner organization PO is accompanied by a selection acceptance object, such as a checkbox. The trading organization selects the trading partner organization PO to request a second-tier transaction investigation from the trading organization terminal 20 by inputting information into the selection acceptance object.

[0067] In the request recipient selection area RA1, the additional information frame AF for the selected trading partner organization PO is expanded according to the selection of the trading partner organization PO (e.g., by clicking, tapping, or hovering the pointer over it). The additional information frame AF displays a display field or input field for the trading partner organization PO's contact person, labels indicating attributes assigned to the trading partner organization PO, etc.

[0068] When at least one trading partner organization PO is selected as the recipient of a secondary transaction investigation, and input is made on the request button B21, the first response form, as described below, is sent to the selected trading partner organization PO.

[0069] Figure 9 shows an example of the third investigation request screen SD3 displayed on the trading organization terminal 20. The third investigation request screen SD3 is a screen for requesting a security investigation from the trading organization. The third investigation request screen SD3 is called up, for example, after registering the trading organization's information on the first investigation request screen SD1 in Figure 7, by an instruction from the trading organization terminal 20 to request a security investigation (for example, input of the trading target that will display the third investigation request screen SD3).

[0070] The third survey request screen, SD3, includes a request details input area CA, a recipient selection area RA2, and a request button B31. The request details input area CA accepts input such as the name of the requesting organization (name of the trading organization), the case name (name of the trading target), the background of the request, remarks, and priority. At least a portion of the information entered in the request details input area CA is sent to the organization requesting the security survey, either together with or as part of the second response form described later.

[0071] The request recipient selection area RA2 displays the ticket count TN, the filter selection object FO, and at least one request setting area RF. The ticket count TN is the remaining number of security investigation tickets for the trading organization, as described below. The filter selection object FO is an object for inputting or selecting a filter to narrow down the trading organization to display the request setting area RF from among the trading organization organizations registered in the supply chain database via the first investigation acceptance screen SD1, etc.

[0072] One Request Setting Area RF is displayed for each trading partner organization. The Request Setting Area RF displays objects for selecting the attributes of the trading partner organization (checkboxes in the example in Figure 9), objects for selecting whether a security investigation is necessary (checkboxes in the example in Figure 9), objects for selecting the type of security investigation (checkboxes in the example in Figure 9), and input fields for entering the recipient of the security investigation request. For example, if the attributes of the trading partner organization, whether a security investigation is necessary, or the type of security investigation has already been entered on the First Investigation Request Screen SD1 (i.e., if this information is registered in the supply chain database), the Request Setting Area RF will display the entered (registered) options as the initial values ​​for the attributes, whether a security investigation is necessary, or the type of security investigation.

[0073] Furthermore, it is not necessary for at least one of the following to be re-selected (modified from the initial value) in the Request Settings RF: the attributes of the trading partner organization, whether a security investigation is necessary, and the type of security investigation. In addition, of the attributes of the trading partner organization, whether a security investigation is necessary, and the type of security investigation, only the type of security investigation may be editable. Also, if neither "Simplified investigation" nor "Do not investigate" is selected, a standard investigation will be selected as the type of security investigation.

[0074] In the request selection area RA2, multiple request setting areas RF are displayed in a form that shows the supply chain entered on the first survey acceptance screen SD1. That is, multiple request setting areas RF are connected by lines that show the flow of the transaction targets, and are displayed at positions that indicate each level.

[0075] When a request is made to the request button B31 while a security investigation is required in at least one request setting area RF, a second response form, described later, corresponding to the selected type of security investigation, is sent to the trading partner organization that required the security investigation.

[0076] <Form submission section 113> The form submission unit 113 is configured to send a first response form to the trading partner organization in which it enters its response to the second transaction investigation, in response to the first request information received by the transaction investigation request reception unit 112A, and to send a second response form to the trading partner organization in which it enters its response to the security investigation, in response to the second request information received by the security investigation request reception unit 112B.

[0077] The form submission unit 113 may send a first response form to the secondary trading partner organization in response to the first request information, and may also send a second response form to the secondary trading partner organization in response to the second request information. In other words, if the first request information received by the transaction investigation request reception unit 112A includes a request for a secondary transaction investigation to the secondary trading partner organization, the form submission unit 113 will also send the first response form to the secondary trading partner organization. Furthermore, if the second request information received by the security investigation request reception unit 112B includes a request for a security investigation to the secondary trading partner organization, the form submission unit 113 will also send the second response form to the secondary trading partner organization.

[0078] The first and second response forms are created and sent for each transaction. The order in which the first and second response forms are sent is not particularly important; for the same trading partner organization, the first response form may be sent before the second response form, or the second response form may be sent before the first response form.

[0079] The form submission unit 113 sends the first response form to trading partner organizations (first-tier trading partner organizations and Nth-tier trading partner organizations) that require a second-tier transaction investigation. The form submission unit 113 also sends a second response form corresponding to the type of security investigation selected to trading partner organizations that require a security investigation. For example, trading partner organizations that select "Standard Investigation" as the type of security investigation will be sent a second response form with a large number of questions (e.g., around 120 items), while trading partner organizations that select "Simplified Investigation" as the type of security investigation will be sent a second response form with fewer questions than the "Standard Investigation" (e.g., around 30 items).

[0080] <Ticket Management Department 114> The ticket management unit 114 is configured to manage the security investigation tickets required for the source organization to submit the second response form. Specifically, the ticket management unit 114 consumes the security investigation tickets assigned to the source organization in accordance with the number of second response forms submitted to the client organization and the secondary client organization. This helps to reduce requests for security investigations to organizations that do not require them.

[0081] Even when the form submission unit 113 submits the second response form to third-tier and subsequent trading partners, security investigation tickets should be consumed in proportion to the number of second response forms submitted. In other words, the ticket management unit 114 may consume security investigation tickets assigned to the trading partner organization in proportion to the number of second response forms submitted to the first-tier trading partner organization and the Nth-tier trading partner organization (N>1).

[0082] The ticket management unit 114 increases its stock of security investigation tickets in response to the purchase of security investigation tickets by the trading organization. Security investigation tickets may also be provided to the trading organization free of charge as a perk or benefit.

[0083] <First response reception section 115A> The first response receiving unit 115A is configured to receive responses to the first response form from trading partner organizations (first-tier trading partner organizations and Nth-tier trading partner organizations). The first response form includes input fields for information (organization name, contact person, attributes, etc.) of the Nth-tier trading partner organization (N>1) from the perspective of the trading partner organization.

[0084] The information about the trading partner organization entered in the first response form is the same as the information about the trading partner organization entered by the trading source organization in the transaction investigation request reception department 112A. In other words, the response to the first response form may include the attributes of the secondary trading partner organization. Furthermore, the response to the first response form may include whether or not the secondary trading partner organization has an information deposit attribute.

[0085] The responses received by the first response reception unit 115A are registered in the supply chain database. Unlike the second response form, responses to the first response form are not evaluated by evaluators.

[0086] Figure 10 shows an example of the first response form display screen FD displayed on the trading partner organization terminal 40. The first response form display screen FD includes the requester information CI, transaction information field DF, trading partner input field BF, and send button B41, which constitute the first response form. The requester information CI includes information indicating the requester (trading partner organization). The transaction information field DF displays the requesting party (trading partner organization), the transaction target, and the handling of specific information such as personal information, or accepts input of this information. The trading partner input field BF is the same as the trading partner input field BF in the first survey reception screen SD1. However, in the trading partner input field BF of the first response form, the survey input area SA is not displayed in the information input field IF.

[0087] When an input operation is performed on the submit button B41, the answer entered in the first response form (information of the Nth-tier trading partner organization) is sent to the server device 10. Furthermore, sub-supply chain information based on the answer entered in the first response form is sent from the server device 10 to the trading source organization terminal 20.

[0088] <Second response reception section 115B> The second response receiving unit 115B is configured to receive responses to the second response form from trading partner organizations (primary trading partner organizations and nth-tier trading partner organizations). The second response form includes several questions regarding security within the trading partner organizations. The questions included in the second response form may include a so-called security checklist.

[0089] The answers to the questions are obtained as evaluation information for the evaluator to create a report or document on the security of the trading organization. The evaluation information may be evaluated only once or multiple times. In other words, the evaluation of the evaluation information may include an initial evaluation (so-called review), an intermediate evaluation, a final evaluation, etc. The initial and intermediate evaluations are evaluations in which further evaluations are conducted after the initial evaluation. Multiple evaluations may be performed by the same evaluator or by different evaluators (so-called reviewers, etc.). The final evaluation creates the evaluation to be used in the report or document provided to the trading organization.

[0090] The evaluation information is registered, for example, in the answer database of the memory unit 12. The answers to each question included in the evaluation information are the answers that the trading organization entered into the input form for each question presented in the input form, and these answers are registered in the answer database. The answers to a single question may be hierarchical.

[0091] The questions in the second response form include, for example, those that confirm security certifications or evaluations, service levels, scope of responsibility, security measures within the trading organization, handling of data created by the trading partner organization, and service development, maintenance, or operational policies (such as account management) (questions that require responses from the trading organization).

[0092] The second response form may include transaction-related questions concerning the transaction subject and organization-related questions concerning the trading partner organization itself, which are independent of the transaction subject. "Transaction-related questions" are, for example, questions to confirm security measures regarding the goods, services, etc., provided by the trading partner organization. "Organization-related questions" are, for example, questions to confirm the information management system, security policies, etc., of the trading partner organization.

[0093] The second response receiving unit 115B may accept responses to questions identical or similar to those already answered by the response registration unit 116 described later, by submitting responses to the second response form, which already contains pre-filled answers to the previously answered questions. This eliminates the need to re-enter answers to previously answered questions, thereby reducing the workload required for the trading partner organization to submit their responses to the second response form.

[0094] The similarity between two questions is determined, for example, by comparing the vector data obtained by vectorizing the content of the answered question with the vector data obtained by vectorizing the content of the question in the second answer form. The similarity criterion between questions is a threshold for the difference (vector distance) between the vector data of the two questions. For example, questions whose vector data difference is less than the threshold (for example, cosine similarity is greater than or equal to the threshold) are judged to be similar.

[0095] The second response receiving unit 115B may input the answered question and the question from the second response form into the similarity judgment model of the artificial intelligence unit 120, have the similarity judgment model output the similarity score between the two, and determine the similarity between the answered question and the question from the second response form based on that similarity score. The similarity judgment model is a trained model that takes two questions as input and is capable of outputting the similarity score between the two questions.

[0096] The similarity judgment model is a learning model that has learned using training data consisting of sets of training questions and combinations of similarity or similarity scores corresponding to those sets of questions. The similarity judgment model may also be a generative AI that includes a large-scale language model. In this case, the second response receiving unit 115B takes the answered questions and the questions from the second response form as input, and inputs a prompt to the similarity judgment model that includes an instruction to output the similarity or similarity score between the two questions, causing the similarity judgment model to output the similarity score. The second response receiving unit 115B may also generate a prompt that gives the similarity judgment model an instruction to output the similarity or similarity score between the answered questions and the answers from the second response form, and input this prompt to the similarity judgment model. In addition, the second response receiving unit 115B may input a prompt to the similarity judgment model that includes, for example, one or more samples of answered questions and questions from the second response form, and one or more samples of similarity or similarity scores corresponding to them, as input and output samples, in addition to the instructions to output similarity or similarity scores and the answered questions and questions from the second response form. The similarity determination model outputs the degree of similarity or similarity between the answered question and the question in the second answer form, according to the input prompt.

[0097] Furthermore, the second response receiving unit 115B may pre-enter entered answers to organization-related questions that are identical or similar to those already answered. This eliminates the need to input answers to organization-related questions whose content is consistent regardless of the transaction target, thereby significantly reducing the workload required for responses from trading partners.

[0098] The responses received by the second response reception unit 115B are registered by the response registration unit 116, which will be described later, and are also evaluated by evaluators (evaluation input and registration by the evaluator terminal 30). "Evaluation" is the act of checking for any deficiencies in the response included in the evaluation information, creating comments on the content of the response, scoring the response, etc.

[0099] For example, if the evaluation is conducted in two stages, the initial evaluation (review) involves checking for deficiencies and creating points of concern. Subsequently, the final evaluation is conducted on the evaluation information after the initial evaluation, including scoring the content (responses) and creating comments on the evaluation information as a whole. A report or document (e.g., a security report) containing the results is then created. The report or document is created by the final evaluator or by the evaluation unit of the control unit 11. The evaluation unit is configured to generate part or all of the report or document based on the input evaluation information. The evaluation results of the evaluation information may be included in the report or document as part of the report or as reference information. The report or document is transmitted to the trading organization terminal 20.

[0100] Furthermore, a supply chain score, which is a security score for the entire supply chain, may be calculated using the evaluation scores of each trading partner organization. The supply chain score is calculated, for example, as the evaluation score of the highest-risk (lowest-rated) organization among the evaluation scores of multiple trading partner organizations linked in the flow of goods in the supply chain.

[0101] The supply chain score may be calculated using a value obtained by multiplying the evaluation scores of multiple trading partners by a coefficient specific to each trading partner. This coefficient is set based on, for example, the proportion of each partner's contribution to the provision of the goods being traded (dependence), the importance or amount of information entrusted to them, their business model, organizational size, location, contract amount, and the importance of the technologies they utilize.

[0102] <Response Registration Section 116> The response registration unit 116 is configured to register the questions answered by the business partner organization in the security survey and the answers entered by the business partner organization to those questions in the response database. The questions answered may be answered using the second response form or using a form other than the second response form.

[0103] <Hierarchical structure display control unit 117> The hierarchical structure display control unit 117 is configured to display a transaction hierarchy structure on the trading source organization terminal 20, showing the transaction relationships of the trading target, including the trading source organization and the secondary trading source organization with which the secondary transaction takes place, based on the trading partner organization's response to the first response form. This allows the trading source company to consider whether or not a security investigation is necessary or what type of investigation is needed while gaining an overview of the transaction relationships.

[0104] "Transaction relationships" refer to, for example, the flow of goods that are the subject of a transaction. "Transaction hierarchy" refers to, for example, block diagrams, node diagrams, etc., that show the supply chain for a single transaction item.

[0105] The hierarchical structure display control unit 117 may display a transaction hierarchy structure, including a specific information flow, on the source organization terminal 20 based on the information deposit attributes of the trading partner organization and the secondary trading partner organization. This allows the source organization to get an overview of the information management risks in the supply chain.

[0106] The hierarchical structure display control unit 117 may display a transaction hierarchy structure on the trading organization terminal 20, in which labels indicating attributes are assigned to each trading partner organization and secondary trading partner organization. This makes it possible to understand the position of important trading partner organizations in addition to the transaction relationship (flow of goods) in the transaction hierarchy structure, making it easier for the trading organization to consider whether or not a security investigation is necessary or what type of investigation is needed.

[0107] The hierarchical structure display control unit 117 may display multiple transaction hierarchical structures associated with the same source organization overlaid on top of each other. This makes it easier for the source organization to simultaneously grasp the transaction hierarchical structures for multiple transactions and to identify trading partners common to multiple transaction hierarchical structures. For example, the hierarchical structure display control unit 117 may arrange multiple transaction hierarchical structures one by one in multiple layers and display the multiple layers overlaid on the source organization terminal 20. The position (up-down relationship) of the layers can be switched, for example, by instructions from the source organization terminal 20.

[0108] Furthermore, the hierarchical structure display control unit 117 may display information indicating that a trading partner organization included in one transaction hierarchy structure is also included in other transaction hierarchy structures of the same trading source organization. For example, the hierarchical structure display control unit 117 may display a transaction hierarchy structure with a label indicating that a trading partner organization included in multiple supply chains is also included in another supply chain.

[0109] Furthermore, the hierarchical structure display control unit 117 may display multiple transaction hierarchical structures associated with the same trading source organization on a single screen, without overlapping them, but in an independent manner. In this case as well, if a trading partner organization included in one transaction hierarchical structure is also included in other transaction hierarchical structures of the same trading source organization, the hierarchical structure display control unit 117 may display information indicating this fact on the transaction hierarchical structure.

[0110] Figure 11 shows an example of a hierarchical structure display screen HD displayed on the trading organization terminal 20. The hierarchical structure display screen HD includes a hierarchical structure display field HF, a first investigation status display field SF1, a second investigation status display field SF2, and an information display field IDF.

[0111] The hierarchical structure display area HF shows the type selection object KO and the transaction hierarchy structure HS. In the transaction hierarchy structure HS, the transaction relationships for a single transaction object are represented in a block diagram. In the transaction hierarchy structure HS in Figure 11, transaction relationships are shown by lines connecting organizations, with the lower the line, the lower the hierarchy. In the transaction hierarchy structure HS in Figure 11, two primary trading partner organizations are displayed in parallel, and transaction relationships are further connected in series from each primary trading partner organization to secondary and tertiary trading partner organizations.

[0112] Furthermore, in the transaction hierarchy structure HS, the flow (deposit) of specific information (e.g., personal information) is highlighted with a thick line. Specifically, organizations (nodes) that handle specific information are highlighted (shown with a thick border) compared to other organizations (organizations that do not handle specific information). In addition, the flow (edge) of the transfer of specific information is also highlighted (shown with a thick line) compared to other flows (flows that do not involve the transfer of specific information). Note that highlighting may also be achieved by coloring or increasing the size.

[0113] Furthermore, each organization included in the transaction hierarchy structure HS is displayed with a label LB indicating its organizational attributes, security investigation evaluation score, and whether it is also included in other transaction hierarchy structures.

[0114] The Type Selection Object KO accepts input for selecting the type of information to highlight in the transaction hierarchy structure HS. Examples of information types include personal information, confidential information, and information whose use should be restricted.

[0115] The first investigation status display field SF1 shows the progress of the secondary transaction investigation for the trading partner organization selected in the transaction hierarchy structure HS. The second investigation status display field SF2 shows the progress of the security investigation for the trading partner organization selected in the transaction hierarchy structure HS. The information display field IDF shows the information of the trading partner organization selected in the transaction hierarchy structure HS.

[0116] Figure 12 shows another example of the transaction hierarchy structure HS displayed on the hierarchical structure display screen HD in Figure 11. In the transaction hierarchy structure HS of Figure 12, one organization included in multiple transaction hierarchy structures is displayed in a way that it is shared across these transaction hierarchy structures. In the example of Figure 12, the limited liability company CCC, which is common to the transaction hierarchy structure shown by the solid line and the transaction hierarchy structure shown by the dashed line, is shared across the two transaction hierarchy structures and is also highlighted relative to the other organizations.

[0117] Figure 13 shows yet another example of the hierarchical structure display screen HD displayed on the trading organization terminal 20. The hierarchical structure display screen HD in Figure 13 displays the highlight setting object HO and the transaction hierarchy structure HS. The highlight setting object HO accepts input for the organization to be highlighted in the transaction hierarchy structure HS. In the example in Figure 13, the highlight setting object HO accepts input or selection for the company name, project name, security investigation evaluation score, type of information handled, whether or not it is a key trading partner, and whether or not it is eligible for subcontracting.

[0118] The transaction hierarchy structure HS is a block diagram similar to the transaction hierarchy structure HS in Figure 11, and each organization included in the block diagram is displayed with a label LB indicating the organization's attributes, security investigation evaluation score, and whether it is also included in other transaction hierarchy structures.

[0119] In the transaction hierarchy structure HS in Figure 13, organizations that meet the conditions selected in the highlighting object HO are highlighted. Furthermore, if information is selected as the target for highlighting, the flow of that information is also highlighted. In the example in Figure 13, "Personal Information" is selected in the highlighting object HO, and organizations handling personal information and the flow of personal information (deposit) are highlighted with thick lines.

[0120] Figure 14 shows the state after the hierarchical structure display screen HD of Figure 13 has changed. When any organization included in the transaction hierarchy structure HS is selected in the hierarchical structure display screen HD of Figure 13, the detailed information display area SIA of that organization is expanded as shown in Figure 14. The detailed information display area SIA displays, for example, the security investigation history, corrective action management status, case ledger, etc. of the selected organization. Note that Figure 14 shows the state when AAA Corporation is selected in the transaction hierarchy structure HS.

[0121] <Progress display control unit 118> The progress display control unit 118 displays the progress of the secondary transaction investigation at the trading partner organization or the secondary trading partner organization where the secondary transaction of the trading target takes place on the trading partner organization terminal 20. This makes it possible to grasp the progress of the secondary transaction investigation in the supply chain, including secondary trading partners and beyond.

[0122] Please note that data from secondary supplier investigations is registered and displayed without evaluation (review) by evaluators (reviewers). On the other hand, security investigations require evaluation by evaluators, and data is registered and displayed only after the evaluation is completed.

[0123] Figure 15 shows an example of a progress display screen PD displayed on the trading source organization terminal 20. The progress display screen PD includes a trading partner organization list field LF and a progress display field PF.

[0124] The LF column of the supplier organization list displays a list of Nth-tier supplier organizations that have been requested to conduct a second-tier supplier survey (by submitting the first response form). The LF column of the supplier organization list also displays the hierarchy of each supplier organization using a number and display position. The response status of the second-tier supplier survey is displayed for each supplier organization. For example, "Responded" indicates that the first response form has been submitted and the system is accepting responses; "Confirmed" indicates that the responses have been entered and data checks are being performed for registration in the supply chain database; "Completed" indicates that the responses have been registered in the supply chain database (the response results are reflected in the transaction hierarchy structure displayed on the supplier organization terminal 20); and "Added" indicates that a second-tier supplier survey has not yet been conducted for a supplier organization that has been added, for example, by the response of another supplier organization's second-tier supplier survey.

[0125] The Progress Display field (PF) shows detailed progress information for the secondary transaction investigation for the account organization selected in the Account Organization List field (LF) (for example, when an input operation is performed on the "Details" object). The Account Organization List field (LF) displays the progress for each step, such as sending the request for the secondary transaction investigation (submission of the first response form), the account organization's response, and receiving (registering) the response from the account organization, along with the date and time.

[0126] <Investigation List Display Control Unit 119> The investigation list display control unit 119 is configured to display a list of secondary transaction investigations and / or security investigations requested by the trading organization on the trading organization terminal 20 upon receiving instructions from the trading organization, and to display a list of secondary transaction investigations and / or security investigations that the trading organization has been requested to conduct as a trading partner organization for other trading organizations on the trading organization terminal 20 upon receiving further instructions from the trading organization. This allows for centralized management of the investigation status of transactions (supply chains) initiated by the trading organization itself and investigation requests for other transactions in which the trading organization is a trading partner organization and constitutes the supply chain, all within a single application.

[0127] The security evaluation system provided by Information Processing System 1 allows the same organization to act as both the client (requesting the investigation) and the client (responding to the investigation). In other words, one organization can use the service as both a client and a client with a single account.

[0128] The survey list display control unit 119 receives a display instruction from, for example, the trading organization terminal 20 to display a list of survey requests to trading organizations (hereinafter referred to as the "first list"), and displays the first list on the trading organization terminal 20. The first list includes, for example, the name or ID of the survey, the type of survey, the recipient of the survey (respondent), the status of the survey, the date of the request, the completion date, etc. The first list may also include the evaluation of security surveys for which evaluation has been completed (evaluation score for each trading organization or supply chain score for the entire supply chain).

[0129] The investigation list display control unit 119 receives a display instruction from, for example, the trading organization terminal 20 to display a list of investigation requests from other trading organizations (hereinafter referred to as the "second list"), and displays the second list on the trading organization terminal 20. The second list includes, for example, the requesting organization (other trading organizations), the type of investigation, the investigation status, the date of the request, the deadline, etc.

[0130] Figure 16 shows an example of the survey list display screen LD displayed on the trading organization terminal 20. The survey list display screen LD includes a menu area MA and a display area DA. The menu area MA displays a mode switching object CO and a menu list ML. The mode switching object CO accepts an operation to switch the survey list displayed in the display area DA between the first list (trading organization mode) and the second list (customer organization mode). In the example in Figure 16, when "Client" is selected, the first list (list of survey requests as a trading organization) is displayed in the display area DA, and when "Responder" is selected, the second list (list of survey requests as a customer organization) is displayed.

[0131] The menu list ML displays a list of items to be shown in the display area DA. In the example in Figure 16, "Client" is selected in the mode switching object CO, and "List of Investigation Requests" is selected in the menu list ML. The contents of the menu list ML change depending on the mode selected by the mode switching object CO.

[0132] The display area DA shows information corresponding to the selection made in the menu area MA. In the example in Figure 16, the display area DA shows the first list RL1 of surveys that have been requested from the trading partner organization. When a survey included in the first list RL1 is selected, detailed information about the survey (survey results report) is displayed on the trading partner organization's terminal 20.

[0133] Figure 17 shows an example of the SRD (Service Response Display) screen displayed on the trading organization terminal 20. The SRD screen includes a detailed information display field SIF, a supply chain display field SCF, a security assessment display field SVF, and a response content display field ACF.

[0134] The Detailed Information (SIF) field displays information about the surveyed organization (the trading partner organization), the survey details, etc. In the example in Figure 17, the Detailed Information (SIF) field is displayed in a collapsed state. The Supply Chain (SCF) field displays the supply chain (trading hierarchy structure) that includes the surveyed trading partner organization. The Supply Chain (SCF) field displays labels indicating the attributes of each trading partner organization, the security survey evaluation (score), etc.

[0135] The Security Assessment Display (SVF) section shows the evaluator's assessment results (report) for the responses to the security survey. The Response Content Display (ACF) section shows the responses to the security survey from the trading partner organization (responses to the second response form) along with the questions. The Response Content Display (ACF) section also displays a filter setting area (FSA) to narrow down the responses to be displayed.

[0136] Figure 18 shows another example of the survey list display screen LD displayed on the trading organization terminal 20. The survey list display screen LD in Figure 18 is displayed when the mode is switched from trading organization mode to trading partner organization mode by the mode switching object CO in the survey list display screen LD of Figure 16. In the example in Figure 18, "Responder" is selected for the mode switching object CO, and "Survey Request" is selected for the menu list ML. Also, in the example in Figure 18, the second list RL2 of surveys requested by multiple trading organizations is displayed in the display area DA.

[0137] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by each functional unit of the server device 10 may be common to all units, or it may be prepared individually for each functional unit.

[0138] The artificial intelligence unit 120 is an AI (Artificial Intelligence) equipped with learning models such as transformers including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3 and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), and language models such as recurrent neural networks (RNNs), and may also include generative AI.

[0139] The language model is an example of a learning model using a machine learning algorithm. Specific machine learning algorithms include nearest neighbors, naive Bayes, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0140] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data. Training data consists of pairs of input data and output data (correct answer data) for training. Furthermore, the language model may not only be one trained for a specific task, but also a general-purpose model that can be used universally for a wide range of tasks.

[0141] The artificial intelligence unit 120 may be a general-purpose natural language processing learning model, such as a Large Language Model (LLM), which has learned from a vast amount of data. An LLM is a learning model that has been pre-trained on a large amount of data consisting of text data, etc. (for example, (i) web content on the internet, or (ii) data stored in a predetermined database), and can perform various language processing tasks by being given a task. It can perform a wide range of natural language processing tasks, such as understanding sentence patterns and context, responding to questions, and generating sentences, according to the given prompts. Such a general-purpose learning model includes language models that can handle various tasks without fine-tuning using One-shot Learning or Few-shot Learning. Furthermore, the general-purpose learning model may also be configured to handle various tasks using Zero-shot Learning. The artificial intelligence used in each functional unit of the control unit 11 may be a separate learning model, or it may be a common general-purpose learning model.

[0142] The learning model (such as a similarity judgment model) included in the artificial intelligence unit 120 can undergo additional learning through transfer learning or fine-tuning. For example, whenever new evaluation information, reports, or documents are registered, the artificial intelligence unit 120 may perform additional learning and fine-tune it using these as new training data. This improves the accuracy of the information output from the learning model.

[0143] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using the original learning model. In knowledge distillation, a pre-trained model, such as a large-scale language model, is used as the teacher model, and the parameters of the student model are adjusted so that the output loss of the student model (distilled model) relative to the output (Soft Target Loss) of the teacher model is small. The student model is then trained, and this student model becomes the distilled model. Alternatively, the student model may be trained so that the output loss of the student model relative to the correct labels (Hard Target) of the teacher data (combinations of input and output data of the learning model) is small. Compared to the original learning model (teacher model), the distilled model has similar performance to the original learning model, but with fewer parameters and a lower processing load. Therefore, using a distilled model can reduce the cost of the information processing system 1.

[0144] For example, the learning model used in each functional unit may be a distilled model that has been trained using combinations of input and output data from a large-scale language model as training data. Alternatively, when the information processing system 1 is introduced, a large-scale language model may be used as the learning model in each functional unit, and once training data from the large-scale language model has been accumulated, the distilled model obtained by knowledge distillation using that training data may be used as the learning model in each functional unit.

[0145] <Display section> The display unit 211 of the trading organization terminal 20, the display unit 311 of the evaluator terminal 30, and the display unit 411 of the trading partner organization terminal 40 each display the screen indicated by the screen data transmitted from the server device 10.

[0146] <Operation acquisition part> The operation acquisition unit 212 of the trading organization terminal 20 accepts operations from the trading organization using the trading organization terminal 20. The operation acquisition unit 312 of the evaluator terminal 30 accepts operations from the evaluator using the evaluator terminal 30. The operation acquisition unit 412 of the trading partner organization terminal 40 accepts operations from the trading partner organization using the trading partner organization terminal 40.

[0147] 3. Information Processing Methods This section describes the information processing method of the server device 10. In this information processing method, each part of the server device 10 is executed by a computer as a step.

[0148] This information processing comprises a transaction investigation request acceptance step, a security investigation request acceptance step, a form submission step, a first response acceptance step, and a second response acceptance step. In the transaction investigation request acceptance step, the transaction source organization receives first request information regarding the necessity of a secondary transaction investigation for the trading partner organization in which the transaction takes place. In the security investigation request acceptance step, the transaction source organization receives second request information regarding the necessity or type of security investigation for the trading partner organization. In the form submission step, a first response form is sent to the trading partner organization in response to the secondary transaction investigation, according to the first request information, and a second response form is sent to the trading partner organization in response to the security investigation, according to the second request information. In the first response acceptance step, the trading partner organization submits a response to the first response form. In the second response acceptance step, the trading partner organization submits a response to the second response form.

[0149] Figure 19 is an activity diagram showing an example of the flow of information processing (security investigation processing) performed by information processing system 1. The information processing will be explained below in accordance with each activity in this activity diagram.

[0150] The security investigation process begins with a request for a secondary transaction investigation or a request for a security investigation. The following describes the flow of the secondary transaction investigation first, but the security investigation may be conducted before the secondary transaction investigation, or the secondary transaction investigation and security investigation may be conducted in parallel, or they may be conducted alternately.

[0151] The trading organization inputs information requesting a secondary transaction investigation from the trading partner organization at the trading organization terminal 20 (Activity A101). The server device 10 accepts the secondary transaction investigation based on the request information sent from the trading organization terminal 20 (Activity A102). Subsequently, the server device 10 sends the first response form to the trading partner organization terminal 40 of the designated trading partner organization (Activity A103). The trading partner organization inputs its response to the first response form at the trading partner organization terminal 40 (Activity A104). The server device 10 accepts the response to the first response form sent from the trading partner organization terminal 40 and registers it in the supply chain database (Activity A105).

[0152] Furthermore, the trading organization inputs information requesting a security investigation from the trading partner organization at the trading partner organization terminal 20 (Activity A106). The server device 10 accepts the security investigation based on the request information sent from the trading partner organization terminal 20 (Activity A107). Subsequently, the server device 10 sends the designated second response form to the trading partner organization's trading partner organization terminal 40 (Activity A108). The trading partner organization inputs its response to the second response form at the trading partner organization terminal 40 (Activity A109). The server device 10 receives the response to the second response form sent from the trading partner organization terminal 40 and registers it in the supply chain database (Activity A110). The registered response to the second response form (evaluation information) is evaluated by the evaluator.

[0153] 4. Effect The operation of this embodiment can be summarized as follows: The trading organization can collect information on secondary suppliers and security-related information from its trading partners. Therefore, it can identify security risks in the supply chain.

[0154] Although embodiments of the present invention have been described above, the present invention is not limited thereto and can be modified as appropriate without departing from the technical spirit of the invention.

[0155] 5. Others In the above embodiment, the server device 10 performed various storage and control functions, but instead of the server device 10, multiple external devices may be used. That is, various information and programs may be stored in a distributed manner across multiple external devices using blockchain technology or the like. In particular, the artificial intelligence unit 120 may be an external configuration of the server device 10. In that case, the external artificial intelligence unit 120 may be provided by, for example, an artificial intelligence service server, and is configured to receive input from each functional unit of the server device 10, receive requests to execute artificial intelligence services, and return the instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed using an LLM. The artificial intelligence service server receives prompt input in the form of text, images, audio, etc., and generates and responds with answers to the prompts.

[0156] The embodiments of this model are not limited to the information processing system 1, but may also be an information processing method or a program. The information processing method comprises each step executed by the information processing system 1. The program causes a computer to execute each step of the information processing system 1.

[0157] The product may be provided in any of the following embodiments.

[0158] (1) An information processing system comprising at least one processor, wherein the processor is configured to perform the following steps by reading a program, wherein in the transaction investigation request acceptance step, the system receives first request information from the trading organization regarding the necessity of a secondary transaction investigation of the trading partner organization in which the transaction subject takes place, where the secondary transaction investigation is an investigation concerning the trading partner organization's transactions with other organizations that are the subject of the transaction; in the security investigation request acceptance step, the system receives second request information from the trading organization regarding the necessity or type of security investigation of the trading partner organization, where the security investigation is an investigation concerning the security of the trading partner organization; and in the form submission step, the system sends a first response form to the trading partner organization in which it inputs a response to the secondary transaction investigation in accordance with the first request information, and sends a second response form to the trading partner organization in which it inputs a response to the security investigation in accordance with the second request information.

[0159] (2) An information processing system as described in (1) above, wherein in the transaction investigation request acceptance step, the system further accepts as first request information whether or not the secondary transaction investigation is necessary for the secondary trading partner organization in which the secondary transaction of the subject of the transaction takes place; in the security investigation request acceptance step, the system further accepts as second request information whether or not the security investigation is necessary or the type of security investigation for the secondary trading partner organization; and in the form submission step, the system submits the first response form to the secondary trading partner organization in accordance with the first request information, and submits the second response form to the secondary trading partner organization in accordance with the second request information.

[0160] (3) The information processing system described in (2) above, wherein the processor is configured to perform the following steps in the ticket management step, the information processing system causing the source organization to consume security investigation tickets in accordance with the number of second response forms submitted to the source organization and the secondary source organization.

[0161] (4) An information processing system according to any one of (1) to (3) above, wherein in the security investigation request acceptance step, the system accepts input of the attributes of the trading partner organization from the trading source organization and presents the trading source organization with options for selecting whether or not a security investigation is necessary or what type of security investigation is to be conducted, with initial values ​​set based on the attributes of the trading partner organization.

[0162] (5) An information processing system according to any one of (1) to (4) above, wherein the processor is configured to further perform the following steps: in the response reception step, the processor receives a response to the first response form from the trading partner organization; and in the hierarchical structure display control step, the processor displays a transaction hierarchy structure indicating the transaction relationship of the transaction subject, including the trading partner organization and the secondary trading partner organization with which the secondary transaction of the transaction subject takes place, based on the response to the first response form.

[0163] (6) An information processing system as described in (5) above, wherein in the security investigation request acceptance step, the system accepts input of an information deposit attribute from the trading source organization indicating that the trading partner organization will receive specific information, the response to the first response form includes whether or not the secondary trading partner organization has the information deposit attribute, and in the hierarchical structure display control step, the system displays the transaction hierarchy structure including the flow of specific information based on the information deposit attributes of the trading partner organization and the secondary trading partner organization.

[0164] (7) An information processing system as described in (5) or (6) above, wherein in the security investigation request acceptance step, the system accepts input of the attributes of the trading partner organization from the trading source organization, the response to the first response form includes the attributes of the secondary trading partner organization, and in the hierarchical structure display control step, the system displays the transaction hierarchy structure in which labels indicating attributes are assigned to the trading partner organization and the secondary trading partner organization, respectively.

[0165] (8) An information processing system according to any one of (5) to (7) above, wherein in the hierarchical structure display control step, a plurality of transaction hierarchical structures associated with the same source organization are displayed on top of each other.

[0166] (9) An information processing system according to any one of (1) to (8) above, wherein the processor is configured to further perform the following steps, and in the progress display control step, the progress of the secondary transaction investigation in the trading partner organization or the secondary trading partner organization in which the secondary transaction of the subject of the transaction takes place is displayed.

[0167] (10) An information processing system according to any one of (1) to (9) above, wherein the processor is configured to further perform the following steps: in the response registration step, the processor registers the questions answered by the trading partner organization in the security survey and the answers entered by the trading partner organization to the questions answered in the database; and in the response reception step, the processor receives responses to questions identical or similar to the questions answered in the second response form, in which the answers entered in the second response form have been pre-filled.

[0168] (11) An information processing system as described in (10) above, wherein the second response form includes transaction-related questions concerning the transaction object and organization-related questions concerning the trading partner organization itself, which are independent of the transaction object, and in the response reception step, the system pre-enters the entered responses to the organization-related questions which are the same as or similar to the answered questions.

[0169] (12) An information processing system according to any one of (1) to (11) above, wherein the processor is configured to further perform the following steps, wherein in the investigation list display control step, it displays a list of the secondary transaction investigations and / or security investigations requested by the trading organization, and, upon instruction from the trading organization, displays a list of the secondary transaction investigations and / or security investigations that the trading organization has been requested to perform as a trading partner organization to other trading organizations.

[0170] (13) An information processing method comprising each step performed by the information processing system described in any one of (1) to (12) above.

[0171] (14) A program that causes a computer to perform each step of the information processing system described in any one of (1) to (12) above. Of course, this is not always the case.

[0172] Finally, while various embodiments relating to this disclosure have been described, these are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be implemented in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims and their equivalents. [Explanation of symbols]

[0173] 1: Information Processing System 2: Communication lines 10: Server device 11: Control Unit 12: Storage section 13: Communications Department 14: Communications bus 20: Trading organization terminal 21: Control Unit 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communications bus 30: Evaluator terminal 31: Control Unit 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communications bus 40: Partner organization terminal 41: Control Unit 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communications bus 111: Basic Display Control Unit 112A: Transaction Investigation Request Reception Department 112B: Security Investigation Request Reception Department 113: Form submission section 114: Ticket Management Department 115A: First Response Reception Department 115B: Second response reception department 116: Answer Registration Section 117: Hierarchical Structure Display Control Unit 118: Progress display control unit 119: Investigation List Display Control Unit 120: Artificial Intelligence Department 211:Display section 212: Operation acquisition section 311: Display section 312: Operation acquisition section 411: Display section 412: Operation acquisition section AA: Attribute input area ACF: Answer content display field AF: Additional Information Frame AO: Organization Addition Object B11: Create button B21: Request button B31: Request button B41: Send button BF: Customer input field CA: Request details input area CF: Project input field CI: Client Information CO: Mode switching object DA:Display area DF: Transaction Information Section EO: Edit Object FD: First Answer Form Display Screen FO: Filter Selection Object FSA: Filter setting area HD: Hierarchical structure display screen HF: Hierarchical structure display field HO: Highlight setting object HS: Transaction Hierarchy Structure IDF: Information display field IF: Information input field IO: Import Object KO: Type Selection Object LB: Label LD: Survey List Display Screen LF: List of Business Partner Organizations MA: Menu area ML: Menu List MO: Moving Object NF: Organization name input field OA: Organization Information Input Area OF: Organization Registration Field PD: Progress display screen PF: Progress display area PO: Customer Organization RA1: Selection area for service provider RA2: Selection area for service provider RF: Request setting area RL1: List 1 RL2: Second List SA: Survey Input Area SCF: Supply Chain Display Section SD1: First survey application screen SD2: Second survey application screen SD3: Third Survey Application Screen SF1: First Survey Status Display Section SF2: Second Survey Status Display Section SIA: Detailed information display area SIF: Detailed information display field SO: Detailed display object SRD: Survey Results Display Screen SVF: Security Rating Display Section TN: Number of tickets U1: First trading organization U2: Secondary trading organization U3: Evaluator U4: First Customer Organization U5: Second supplier organization

Claims

1. An information processing system, Equipped with at least one processor, The aforementioned processor is configured to perform the following steps by reading a program: In the transaction investigation request acceptance step, the trading organization receives the initial request information regarding the necessity of a secondary transaction investigation of the trading partner organization in which the transaction takes place. Here, the secondary transaction investigation is an investigation into the trading partner organization's transactions with other organizations that are the subject of the transaction. In the security investigation request acceptance step, the business partner organization receives the necessity or type of security investigation for the business partner organization as second request information, and here the security investigation is an investigation concerning the security of the business partner organization. An information processing system that, in the form submission step, sends a first response form to the trading partner organization in which the trading partner organization enters its response to the second transaction survey in response to the first request information, and sends a second response form to the trading partner organization in which the trading partner organization enters its response to the security survey in response to the second request information.

2. In the information processing system described in claim 1, In the transaction investigation request acceptance step, the necessity of the secondary transaction investigation for the secondary trading partner organization in which the secondary transaction of the subject of the transaction takes place is further accepted as the first request information. In the security investigation request acceptance step, the necessity or type of the security investigation for the secondary trading partner organization is further accepted as the second request information. An information processing system that, in the form submission step, sends the first response form to the secondary trading partner organization in response to the first request information, and sends the second response form to the secondary trading partner organization in response to the second request information.

3. In the information processing system described in claim 2, The aforementioned processor is configured to perform the following steps: In the ticket management step, an information processing system consumes security investigation tickets assigned to the primary trading organization in accordance with the number of times the second response form has been submitted to the primary trading organization and the secondary trading organization.

4. In the information processing system described in claim 1, In the security investigation request acceptance step, the information processing system accepts input of the attributes of the trading partner organization from the trading partner organization and presents the trading partner organization with options for selecting whether or not a security investigation is necessary or what type of security investigation is to be conducted, with initial values ​​set based on the attributes of the trading partner organization.

5. In the information processing system described in claim 1, The aforementioned processor is configured to perform the following steps: In the response reception step, responses to the first response form are received from the aforementioned business partner organization. An information processing system that, in the hierarchical structure display control step, displays a transaction hierarchy structure showing the transaction relationships of the transaction target, including the trading partner organization and the secondary trading partner organization with which the secondary transaction of the transaction target takes place, based on the answers to the first answer form.

6. In the information processing system described in claim 5, In the security investigation request acceptance step, the trading organization receives input of an information deposit attribute indicating that the trading partner organization will receive specific information. The responses to the first response form include whether or not the secondary trading partner organization has the aforementioned information deposit attribute, An information processing system that, in the hierarchical structure display control step, displays the transaction hierarchy structure including the specific information flow based on the information deposit attributes of the trading partner organization and the secondary trading partner organization.

7. In the information processing system described in claim 5, In the security investigation request acceptance step, the source organization receives input of the attributes of the trading partner organization, The responses to the first response form include the attributes of the secondary trading partner organization, The information processing system, in the hierarchical structure display control step, displays the transaction hierarchy structure in which labels indicating attributes are assigned to each of the trading partner organizations and the secondary trading partner organizations.

8. In the information processing system described in claim 5, The information processing system, in the hierarchical structure display control step, displays multiple transaction hierarchical structures associated with the same trading source organization on top of each other.

9. In the information processing system described in claim 1, The aforementioned processor is configured to perform the following steps: The progress display control step includes an information processing system that displays the progress status of the secondary transaction investigation in the trading partner organization or the secondary trading partner organization where the secondary transaction of the subject of the transaction takes place.

10. In the information processing system described in claim 1, The aforementioned processor is configured to perform the following steps: In the response registration step, the questions answered by the trading partner organization in the security survey and the answers entered by the trading partner organization to those questions are registered in the database. In the response reception step, the information processing system receives responses to questions identical or similar to the previously answered questions, into the second response form, which already contains the previously entered answers.

11. In the information processing system according to claim 10, The second response form includes transaction-related questions concerning the transaction subject and organization-related questions concerning the trading partner organization itself, which are independent of the transaction subject. In the response reception step, the information processing system pre-enters the previously entered responses to the organization-related questions that are identical or similar to the previously answered questions.

12. In the information processing system described in claim 1, The aforementioned processor is configured to perform the following steps: An information processing system that, in the investigation list display control step, displays a list of the secondary transaction investigations and / or security investigations requested by the trading organization, and, upon receiving instructions from the trading organization, displays a list of the secondary transaction investigations and / or security investigations that the trading organization has been requested to conduct as a trading partner organization for other trading organizations.

13. Information processing method, An information processing method comprising each step performed by the information processing system according to any one of claims 1 to 12.

14. It is a program, A program for causing a computer to perform each step of the information processing system described in any one of claims 1 to 12.

Images