Legal compliance support system and legal compliance support method

Abstract

We provide support for organizations in managing evidence trails to ensure compliance with legal regulations. [Solution] The legal compliance support system manages legal compliance management information that associates legal requirements, which define the matters to be implemented in response to laws and regulations, with evidence information related to evidence necessary to show that compliance with legal requirements has been completed. The legal compliance support system analyzes the stored evidence and presents evidence that satisfies legal requirements to the user as evidence candidate via the output unit. The legal compliance support system accepts the evidence selected by the user from the evidence candidate, associates the legal requirements that the evidence satisfies with the evidence selected by the user from the evidence candidate, and registers it in the compliance performance management information.

Description

Technical Field

[0001] The present invention relates to a legal compliance support system and a legal compliance support method.

Background Art

[0002] In recent years, regulations on the security of organizations such as companies have been strengthened, and compliance has become mandatory. An organization with a legal violation, for example, if it cannot receive public works orders due to the violation, will have a great impact on its operations, so appropriate measures are required.

[0003] For example, Patent Document 1 discloses a technique for extracting a plurality of policy rule candidates corresponding to requirements, obligations, and constraints extracted from legal texts from existing policy rules (codes). Also, for example, Patent Document 2 discloses a technique for evaluating the implementation status of information security measures adopted by an organization in comparison with existing evaluation criteria.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] Organizations are required to comply with laws and manage evidence of the implementation of legal compliance. However, the conventional technologies described in Patent Documents 1 and 2 above do not support the management of evidence of legal compliance, so there is a problem that the burden on organizations is large.

[0006] The present invention has been made in view of the above problems, and an object thereof is to support the management of evidence of legal compliance of organizations.

Means for Solving the Problems

[0007] To achieve the above-mentioned objectives, the present invention, in one embodiment, provides a legal compliance support system that assists in compliance with laws and regulations, wherein the legal compliance support system comprises a processor and a storage unit that stores evidence indicating that compliance with the laws and regulations has been completed, the processor manages legal compliance management information that associates legal requirements defining matters to be implemented as compliance with the laws and regulations with evidence information relating to evidence necessary to indicate that compliance with the legal requirements has been completed, the processor analyzes the evidence stored in the storage unit, presents evidence that satisfies the legal requirements as evidence candidate to the user via an output unit, accepts the evidence selected by the user from the evidence candidate, and registers the legal requirements satisfied by the evidence and the evidence selected by the user from the evidence candidate in compliance performance management information. [Effects of the Invention]

[0008] According to the present invention, for example, it is possible to support the management of evidence trails for an organization's compliance with laws and regulations. [Brief explanation of the drawing]

[0009] [Figure 1] A diagram showing the configuration of the legal compliance support system according to Embodiment 1. [Figure 2A] A diagram showing the configuration of the legal compliance management table related to Embodiment 1. [Figure 2B] A diagram showing the configuration of the legal compliance process template related to Embodiment 1. [Figure 2C] A diagram showing the configuration of the performance management table related to Embodiment 1. [Figure 3] A diagram showing a list of periodic response requirements related to Embodiment 1. [Figure 4] A diagram showing a detailed display of the response status according to Embodiment 1. [Figure 5] A diagram showing the correspondence history display for Embodiment 1. [Figure 6] A diagram showing a list of equivalent / similar requirements related to Embodiment 1. [Figure 7]Flowchart showing the main process according to Embodiment 1. [Figure 8] Flowchart showing the legal compliance notification process according to Embodiment 1. [Figure 9] Flowchart showing the legal compliance support process according to Embodiment 1. [Figure 10] Diagram showing the list of event response requirements according to Embodiment 2. [Figure 11] Flowchart showing the event response support process according to Embodiment 2. [Figure 12] Diagram showing the list of response traces according to Embodiment 3. [Figure 13] Flowchart showing the trace list display process according to Embodiment 3. [Modes for Carrying Out the Invention]

[0010] Hereinafter, embodiments of the present invention will be described based on the drawings.

[0011] [Embodiment 1] In Embodiment 1, an example of managing the traces of legal compliance implemented periodically will be described.

[0012] (Configuration of the Legal Compliance Support System 1 According to Embodiment 1) FIG. 1 is a diagram showing the configuration of the legal compliance support system 1 according to Embodiment 1. The legal compliance support system 1 that supports compliance with laws is connected to the security response system 2 and the target system 3. The security response system 2 is an incident response system that outputs incidents related to the security of the target system 3, a vulnerability management system that manages the vulnerabilities of the target system 3, and the like. The target system 3 is a business system, a manufacturing system, etc. that outputs the traces described later. Further, the legal compliance support system 1 is connected to the user terminal 4 of the user who uses the legal compliance support system 1.

[0013] The legal compliance support system 1 is a computer having a storage unit 11, a processor 12, a memory 13, a communication interface 14, and an input / output interface 15.

[0014] The storage unit 11 is composed of secondary storage devices such as an HDD (Hard Disk Drive) and an SSD (Solid State Drive). The storage unit 11 stores a legal operation management table 111, a response result management table 112, a record 113, a record template 114, and a legal table 115. In this embodiment, information is represented in a table format, but the information is not limited to the table format and may be represented in various data formats.

[0015] FIG. 2A is a diagram showing the configuration of the legal operation management table 111 according to Embodiment 1. The legal operation management table 111 has items of a law 111a, a legal requirement ID 111b, a legal requirement 111c, a legal requirement classification 111d, a response deadline 111e, and a legal response process template ID 111f.

[0016] The law 111a indicates the name or identification information of the law stored in the legal table 115. The legal requirement ID 111b is the identification information of the legal requirement 111c. The legal requirement 111c indicates the specific content of the matters to be implemented corresponding to the law identified by the legal requirement ID 111b.

[0017] The legal requirement classification 111d indicates the implementation timing of the matters to be implemented identified by the legal requirement ID 111b. In the legal requirement classification 111d, for example, there are "regular" (execution once a year, once every six months, in real time (repeated at a very short cycle), etc.) and "event" (execution triggered by the output of an event from the security response system 2). The legal requirement classification 111d is "regular" in this embodiment, and "event" will be described later in Embodiment 2. The response deadline 111e indicates the deadline by which the user should implement the response for the corresponding legal requirement.

[0018] Legal Compliance Process Template ID 111f indicates the identification information of a legal compliance process template that shows the legal compliance process for the legal requirement identified by Legal Requirement ID 111b. The legal compliance process is defined by the provisions of the law and the organization's policies. Legal Compliance Process Template ID 111f shows a legal compliance process template that includes a series of actions to be taken in response to the legal requirement identified by Legal Requirement ID 111b, necessary evidence 113, a timeline, etc. Evidence 113 is a file that shows that compliance with the law has been completed, i.e., a file that serves as evidence that the work to respond to the legal requirement has been carried out.

[0019] Figure 2B shows the configuration of the legal compliance process template T1 according to Embodiment 1. The legal compliance process template T1 is provided and stored for each legal compliance process template ID 111f as part of the legal compliance operation management table 111. For example, Figure 2B shows the legal compliance process template T1 when the legal compliance process template ID 111f is "Template001".

[0020] As shown in Figure 2B, the compliance process template T1 has the following items: work item T11, timeline T12, evidence template T13, and evidence retention period T14. Work item T11 indicates the name or identification information of the work included in the relevant compliance process. Timeline T12 indicates the timing of the implementation of the corresponding work item. Evidence template T13 indicates evidence template 114, which is a template of the file that will serve as evidence 113 of the implementation of the corresponding work item. Evidence retention period T14 indicates the period during which the evidence 113 of the implementation of the corresponding work item should be retained.

[0021] Figure 2C shows the configuration of the compliance performance management table 112 according to Embodiment 1. The compliance performance management table 112 manages compliance performance with legal requirements. The compliance performance management table 112 has the following items: legal requirement 112a, legal requirement ID 112b, work ID 112c, work item 112d, implementation date and time 112e, implementer 112f, and evidence 112g.

[0022] Law 112a is the same as Law 111a in the Law Operation Management Table 111 (Figure 2A). Law Requirement ID 112b is the same as Law Requirement ID 111b in the Law Operation Management Table 111 (Figure 2A). Work ID 112c indicates the identification information of the work performance corresponding to the law requirement identified by Law Requirement ID 111b. Work Item 112d indicates the items and content of the work included in the work identified by Work ID 112c.

[0023] The execution date and time 112e indicates the completion date and time of all work items included in the work identified by work ID 112c. The performer 112f is the name of the performer of the work identified by work ID 112c. The evidence 112g is the identification information of the evidence 113 for the work identified by work ID 112c.

[0024] Returning to the explanation of Figure 1, Evidence 113 indicates the file name of the file that serves as evidence of the work performed to comply with legal requirements. Evidence template 114, although not shown in the illustration, is an evidence template that contains the necessary items and their contents for evidence, and is shown as evidence template T13 of legal compliance process template T1 (Figure 2B). Legal table 115, although not shown in the illustration, stores the legal articles and corresponding work (work items) in association.

[0025] The processor 12 is a processing unit such as a CPU (Central Processing Unit). The processor 12 works in cooperation with the memory 13 to execute programs and implement the event receiving unit 12a, the legal compliance support unit 12b, the periodic event management unit 12c, the evidence trail conformity determination unit 12d, the evidence trail presentation unit 12e, the evidence trail registration unit 12f, the evidence trail management support unit 12g, and the evidence trail information collection unit 12h. The programs that implement these processing units are stored in the storage unit 11 or loaded into the legal compliance support system 1 via a storage medium or network.

[0026] The event receiving unit 12a receives events requiring legal compliance output by the security compliance system 2 and requests the legal compliance support unit 12b to respond to the corresponding legal requirements. When the legal compliance support unit 12b receives a response request from the event receiving unit 12a or the periodic event management unit 12c, it issues a legal compliance work ID and notifies the user operating the user terminal 4 of the legal compliance work information (legal requirement ID, work items, necessary evidence, response deadline, etc.). The legal compliance support unit 12b also manages the progress of the legal compliance corresponding to the issued legal compliance work ID.

[0027] When a legal requirement for which the legal requirement category 111d in the legal application management table 111 is designated as "regular" reaches its notification deadline, the regular event management unit 12c requests the legal compliance support unit 12b to take action regarding the corresponding legal requirement.

[0028] The evidence trail conformity determination unit 12d compares the contents of the evidence trail 113 stored in the memory unit 11 with the evidence trail template 114. The evidence trail conformity determination unit 12d then uses AI or the like to determine which evidence trail template 114 the contents of the evidence trail 113 match or are similar to, that is, which legal requirements they fall under. The evidence trail conformity determination unit 12d then outputs the evidence trail 113 corresponding to the legal requirements as an evidence trail candidate to the user via the display screen of the user terminal 4. The evidence trail conformity determination unit 12d then obtains the date and time of implementation and the information of the implementer of the evidence trail 113 selected by the user from the evidence trail candidates, and registers this information, along with the link information of the evidence trail 113, in the response performance management table 112.

[0029] The evidence presentation unit 12e refers to the compliance performance management table 112, obtains a list of legal requirements and the evidence 113 of compliance with those requirements, and outputs the status of compliance with the legal requirements to the user via the display screen of the user terminal 4. The outputted compliance status includes the history of compliance for each legal requirement.

[0030] The evidence registration unit 12f stores the evidence 113 created by the user in the storage unit 11.

[0031] The audit trail management support unit 12g manages the audit trails 113 stored in the storage unit 11. Specifically, the audit trail management support unit 12g records logs (performer, date and time) related to the registration of data files of audit trails 113 to the storage unit 11, modification of data files, and deletion of data files. The audit trail management support unit 12g also protects information related to legal requirements with set retention periods and audit trails 113 from being deleted.

[0032] The evidence information collection unit 12h acquires metadata (log type, log file storage location, etc.) of the security measures implementation logs (access logs, operation logs, etc.) of the security response system 2 from the security response system 2 and stores it in the storage unit 11.

[0033] Memory 13 is a primary storage device that the processor 12 works with when executing a program. Communication interface 14 is a communication device for the legal compliance support system 1 to communicate with external devices such as the security response system 2 and the target system 3. Input / output interface 15 is an interface for the legal compliance support system 1 to input and output information to and from external devices such as the user terminal 4.

[0034] (List of periodic maintenance requirements related to Embodiment 1 4D1) Figure 3 shows the periodic response requirements list display 4D1 according to Embodiment 1. The data processing related to the display of the periodic response requirements list display 4D1 is performed by the processor 12. The periodic response requirements list display 4D1 is a screen that is displayed on the output section of the user terminal 4 when the periodic response tab 4D19 is selected by the user.

[0035] The Periodic Action Requirements List Display 4D1 presents a list of legal requirements that require periodic action during the operation of the target system 3, along with the deadline, progress, etc. The Periodic Action Requirements List Display 4D1 has display items for Law 4D11, Legal Requirement ID 4D12, Legal Requirement 4D13, Previous Action Date and Time 4D14, Action Deadline 4D15, and Progress 4D16. Law 4D11, Legal Requirement ID 4D12, Legal Requirement 4D13, and Action Deadline 4D15 are based on the Legal Compliance Management Table 111. The Previous Action Date and Time 4D14 is based on the Implementation Date and Time 112e corresponding to the previous action date and time of the relevant legal requirement in the Action Performance Management Table 112.

[0036] The deadline for action 4D15 is the date obtained by adding the "number of years" specified along with "periodic" in the legal requirement category 111d of the legal compliance management table 111 (Figure 2A) to the previous action date and time 4D14 (for example, "1 year" in the first row of the legal compliance management table 111). The progress 4D16 is entered by the legal compliance notification process (Figure 8) described later.

[0037] In the list of regularly scheduled response requirements (4D1), if the user selects legal requirement (4D13), the system transitions to the detailed response status display (4D2) (Figure 4). If the user selects the previous response date and time (4D14), the system transitions to the response history display (4D3) (Figure 5). Furthermore, if legal requirement ID (4D12) is selected, the system transitions to the list of equivalent / similar requirements (4D4) (Figure 6), where evidence of equivalent or similar laws can be viewed.

[0038] The list of periodic response requirements (4D1) is an example of information related to legal requirements and the evidence supporting those legal requirements, which is obtained based on the response performance management table (112) and presented to the user via the output unit.

[0039] (Detailed display of the response status related to Embodiment 1 4D2) Figure 4 shows the detailed response status display 4D2 according to Embodiment 1. The data processing related to the display of the detailed response status display 4D2 is performed by the processor 12. The detailed response status display 4D2 is a screen that is displayed on the output unit of the user terminal 4 when the user selects the previous response date and time 4D14 of the regular response requirement list display 4D1.

[0040] The detailed response status display 4D2 presents a list of the details of the response status (response deadline, work items, implementation date and time, evidence, etc.) to legal requirements that require periodic attention during the operation of the target system 3. The detailed response status display 4D2 includes the following items: timeline 4D21, response deadline 4D22, work items 4D23, required evidence 4D24, implementation date and time 4D25, and evidence 4D26.

[0041] Timeline 4D21 is based on Timeline T12 of Legal Compliance Process Template ID 111f, which corresponds to Legal Requirement 4D13 selected from the List of Periodic Action Requirements 4D1. The Deadline 4D22 is based on the Deadline 4D15 of Legal Requirement 4D13 selected from the List of Periodic Action Requirements 4D1 and Timeline T12 (Figure 2B). In the example in Figure 4, the Deadline 4D22 corresponding to the “Expiration Date” in Timeline 4D21 corresponds to the Deadline 4D15 in the List of Periodic Action Requirements 4D1, so the Deadline 4D22 corresponding to the “Expiration Date” in Timeline 4D21 becomes “2024 / 07 / 01”, which is three months before the expiration date “2024 / 10 / 01”.

[0042] Work item 4D23 is based on work item T11 of legal compliance process template T1, which corresponds to legal compliance process template ID 111f, corresponding to legal requirement 4D13 selected from the list of periodic compliance requirements 4D1. Required evidence 4D24 is based on evidence template T13 of legal compliance process template T1, which corresponds to legal compliance process template ID 111f, corresponding to legal requirement 4D13 selected from the list of periodic compliance requirements 4D1.

[0043] When displaying the detailed response status 4D2, the evidence trails 113 stored in the memory unit 11 are analyzed, and evidence trails 113 that satisfy legal requirements are designated as evidence trail candidates. An evidence trail candidate that satisfies legal requirements is, for example, an evidence trail 113 that includes a certain number of required and optional items based on legal requirement 111c of the legal compliance management table 111, work item T11 of the legal compliance process template T1, evidence trail template T13, etc. If an evidence trail candidate 113 exists, a pull-down menu “▼” is displayed in the evidence trail 4D26. When the user selects an appropriate evidence trail from the evidence trail candidates and presses the registration button 4D29, the implementation date and time 4D25 and the evidence trail 4D26 are entered. The implementation date and time 4D25 is extracted and entered from within the evidence trail 113 file. AI or the like may be used to determine the evidence trail candidates and the implementation date and time.

[0044] (Correspondence history display 4D3 related to Embodiment 1) Figure 5 shows the correspondence history display 4D3 according to Embodiment 1. Data processing related to the display of the correspondence history display 4D3 is performed by the processor 12. The correspondence history display 4D3 is a screen that is displayed on the output section of the user terminal 4 when the user selects the legal requirements 4D13 of the periodic compliance requirements list display 4D1.

[0045] The correspondence history display 4D3 and related displays show a list of the correspondence history in relation to legal requirements (the status of compliance with legal requirements, chronologically by implementation date and time for each work ID, the work items at the selected implementation date and time, the implementation date and time for each work item, and the evidence). The correspondence history display 4D3 has display items for work ID 4D31 and implementation date and time 4D32.

[0046] The implementation date and time 4D32 is a chronological list of past implementation dates and times, based on the implementation date and time recorded in the evidence file 113 corresponding to the legal requirement ID 4D12 that corresponds to the previous implementation date and time 4D14 selected from the list of periodic response requirements display 4D1. The work ID 4D31 in the response history display 4D3 is the work identification information assigned to the work that is indicated to have been performed by the evidence file 113 that records the implementation dates and times listed chronologically in the implementation date and time 4D32.

[0047] When an execution date and time is selected from the execution date and time 4D32, the work execution details display 4D39 corresponding to the selected execution date and time is presented. The work execution details display 4D39 has the following items: work item 4D391, execution date and time 4D392, and evidence 4D393. Work item 4D391 is identified based on work item T11 of the legal compliance process template T1. Execution date and time 4D392 is extracted and entered from the evidence 113 file corresponding to the evidence template T13 that corresponds to work item 4D391. Evidence 4D393 is the file name of evidence 113 that corresponds to the evidence template T13 that corresponds to work item 4D391.

[0048] The response history display 4D3 is an example of information related to legal requirements and evidence corresponding to those legal requirements (response history) that is obtained based on the response performance management table 112 and presented to the user via the output unit.

[0049] (List of equivalent / similar requirements related to Embodiment 1 4D4) Figure 6 shows the equivalent / similar requirements list display 4D4 according to Embodiment 1. Data processing related to the display of the equivalent / similar requirements list display 4D4 is performed by the processor 12. The equivalent / similar requirements list display 4D4 is a screen displayed on the output unit of the user terminal 4 when the user selects the legal requirement ID 4D12 of the periodic response requirements list display 4D1.

[0050] The equivalent / similar requirements list display 4D4 includes a list display 4D41, a selected legal requirements display 4D42, and a compliance status detailed display 4D43.

[0051] List display 4D41 includes standard law 4D411, law 4D412, legal requirement ID 4D413, legal requirement 4D414, and equivalent / similar 4D415.

[0052] List Display 4D41 displays a list of laws and regulations that correspond to the legal requirements obtained from the Legal Application Management Table 111 as equivalent to or similar to the legal requirement ID 4D113 of the selected law (standard law (records where the standard law in Figure 6 is marked with "●")) from the Periodic Response Requirements List Display 4D1. Equivalent legal requirements are those that can be considered identical because they have a certain number of matching items when compared to the work item T11 corresponding to the standard law (see Legal Response Process Template T1), and the similarity of the format of the corresponding evidence template is above a certain level. Similar legal requirements are those that are not identical because work item T11 differs in some parts, but can be considered similar because they have a certain number of matching items, and the format of the corresponding evidence template is not identical, but the similarity is above a certain level. In other words, the identity and similarity of legal requirements are determined according to the degree of agreement of the items in the evidence.

[0053] List Display 4D41 displays the name of the law, the law requirement ID, and the law requirement itself, as Law 4D412, Law Requirement ID 4D413, and Law Requirement 4D414, respectively, for the laws and regulations that correspond to the legal requirements obtained from the Law and Regulation Management Table 111. In addition, the Similar / Equivalent 4D415 of List Display 4D41 displays "Equivalent" if the obtained legal requirements are equivalent, and "Similar" if they are similar.

[0054] When equivalent or similar legal requirements are selected from the list display 4D41, the selected law, legal requirement ID, and legal requirement are displayed in the selected legal requirement display 4D42. In addition, the most recent compliance status details display 4D43 corresponding to the selected law, legal requirement ID, and legal requirement is displayed. The compliance status details display 4D43 is the same as the work execution details display 4D39 (Figure 5) of the compliance history display 4D3.

[0055] The list of equivalent / similar requirements (4D4) is an example of information related to legal requirements and corresponding evidence that is obtained based on the compliance performance management table (112) and presented to the user via the output unit.

[0056] (Main processing related to Embodiment 1) Figure 7 is a flowchart showing the main processing according to Embodiment 1. The periodic response main processing is executed at regular intervals.

[0057] First, in step S11, the legal compliance support unit 12b presents to the user, via the display screen of the user terminal 4, a list of laws and regulations that can be supported and are registered in the legal table 115. When presenting the list, the legal compliance support unit 12b presents it in a way that allows the user to distinguish between laws and regulations that are currently being addressed and those that are not yet addressed. The legal compliance support unit 12b may also import information on laws and regulations not registered in the legal table 115 from an external source.

[0058] Next, in step S12, the legal compliance support unit 12b retrieves information on the laws selected by the user from the presentation in step S11 from the legal table 115, and registers the law 111a, legal requirement ID 111b, legal requirement 111c, legal requirement category 111d, and legal compliance process template ID 111f for each legal requirement in the legal operation management table 111. The legal compliance support unit 12b also registers the work item T11, timeline T12, evidence template T13, and evidence retention period T14 corresponding to legal compliance process template ID 111f in the legal compliance process template T1.

[0059] Furthermore, Law 111a and Law Requirement ID 111b are generated mechanically according to prescribed rules. In addition, Law Requirement Classification 111d, Work Item T11, and Evidence Template T13 are registered semi-automatically, involving human or AI judgment followed by human verification.

[0060] Next, in step S13, the legal compliance support unit 12b refers to the legal table 115 and presents the initial work items (initial response) and necessary evidence 113 for each legal requirement.

[0061] Next, in step S14, the legal compliance support unit 12b determines whether to implement initial response. If the legal compliance support unit 12b decides to implement initial response (step S14 YES), it moves the process to step S15. On the other hand, if the legal compliance support unit 12b decides not to implement initial response (step S14 NO), it returns the process to step S13. "Implementing initial response" refers to the case where one of the legal requirements 4D13 in the list of periodic response requirements display 4D1 is selected for displaying the response status details display 4D2.

[0062] In step S15, the legal compliance support unit 12b executes periodic legal compliance support processing to assist with legal compliance that occurs periodically. For example, the legal compliance support unit 12b registers the initial response selected by the user and links to the necessary evidence 113 in the response performance management table 112. The evidence 113 is also stored in the storage unit 11. For legal requirements for which the initial response has been completed, an initial response completion flag is set in the response performance management table 112. Details of the periodic legal compliance support processing will be described later with reference to Figure 9.

[0063] (Notification process for compliance with laws and regulations related to Embodiment 1) Figure 8 is a flowchart illustrating the legal compliance notification process according to Embodiment 1. The legal compliance notification process notifies of legal compliance issues that occur periodically at regular intervals. The periodic event management unit 12c is executed at regular intervals and, at predetermined intervals such as once a day, refers to the legal compliance management table 111 to check the status of compliance with legal requirements that require periodic attention. If the compliance is within the predetermined period or exceeds the deadline, it sends a notification to the user.

[0064] First, in step S21, the periodic event management unit 12c refers to the legal compliance management table 111 and confirms the deadline for compliance with the periodic compliance requirements. Next, in step S22, the periodic event management unit 12c determines whether the current date and time exceeds the compliance deadline confirmed in step S21. If the compliance deadline has been exceeded (step S22 YES), the periodic event management unit 12c moves the process to step S23; otherwise, it moves the process to step S25.

[0065] In step S23, the periodic event management unit 12c sets the progress 4D16 of the periodic compliance requirements list display 4D1 to "× Delayed" for the relevant legal requirements. Next, in step S24, the periodic event management unit 12c notifies the user of the delay set in step S23.

[0066] Meanwhile, in step S25, the periodic event management unit 12c determines whether the response deadline is within the predetermined period. If the response deadline is within the predetermined period (step S25YES), the periodic event management unit 12c moves the process to step S26; if it is not within the predetermined period (step S25NO), it moves the process to step S28.

[0067] In step S26, the periodic event management unit 12c sets the progress 4D16 of the periodic compliance requirements list display 4D1 to "△ In the near future" for the relevant legal requirement. Next, in step S27, the periodic event management unit 12c notifies the user of a reminder for the "in the near future" set in step S23. On the other hand, in step S28, the periodic event management unit 12c sets the progress 4D16 of the periodic compliance requirements list display 4D1 to "〇 Normal" for the relevant legal requirement.

[0068] The list of periodic response requirements display 4D1 may also include an item for "Implementation Status" of the response. The "Implementation Status" includes "Started" and "Not Started" of the response, as well as "Implementation Notification" which means that the implementation of the response has been notified to the relevant parties, and "Automatic" which means that the implementation of the response is set to be carried out automatically.

[0069] (Support processing for compliance with laws and regulations related to Embodiment 1) Figure 9 is a flowchart showing the legal compliance support process according to Embodiment 1.

[0070] First, in step S15a, the legal compliance support unit 12b displays a detailed response status display 4D2 corresponding to the legal requirement selected by the user from the list of periodic response requirements display 4D1. Next, in step S15b, the legal compliance support unit 12b determines whether to display evidence candidates in response to user operation. If the legal compliance support unit 12b decides to display evidence candidates (step S15b YES), it moves the process to step S15c; otherwise, it moves the process to step S15g.

[0071] In step S15c, the legal compliance support unit 12b displays the evidence 113, which is not registered in the compliance performance management table 112, as an evidence candidate in the compliance status detail display 4D2. Next, the legal compliance support unit 12b determines from the display in step S15c whether an evidence candidate has been selected. If an evidence candidate has been selected (step S15dYES), the legal compliance support unit 12b moves the process to step S15e; otherwise, it moves the process to step S15e.

[0072] In step S15e, the legal compliance support unit 12b determines whether the user manually registers the evidence. If the user manually registers the evidence, the legal compliance support unit 12b moves the process to step S15f; if the user does not register the evidence, it terminates the periodic legal compliance support process.

[0073] In step S15f, the legal compliance support unit 12b registers and updates the compliance record (work ID 112c, work item 112d, implementation date and time 112e, implementer 112f, evidence 112g) for the relevant legal requirements in the compliance record management table 112 for the selected evidence 113 (if step S15d is YES) or the manually entered evidence 113 (if step S15e is YES).

[0074] On the other hand, in step S15g, the legal compliance support unit 12b determines whether to terminate the display of the compliance status details display 4D2. If the display of the compliance status details display 4D2 is terminated (step S15gYES), the legal compliance support unit 12b terminates the legal compliance support process, and if the display of the compliance status details display 4D2 is continued (step S15gNO), it returns to step S15b.

[0075] (Effects of Embodiment 1) According to Embodiment 1, during periods when regular legal compliance is required in the activities of companies, etc., the system reduces the burden on users by indicating the implementation deadline, specific compliance tasks, and necessary evidence. Furthermore, by managing legal requirements, compliance tasks, and evidence in an associated manner, the burden of audit compliance can be reduced.

[0076] [Embodiment 2] Embodiment 2 describes an example of managing evidence of legal compliance actions taken when an event occurs. The main process in Embodiment 2 is the same as the main process in Embodiment 1 (Figure 7), and the legal compliance support process in Embodiment 2 (step S15) is the same as the legal compliance support process in Embodiment 1 (Figure 9). In Embodiment 2, only the legal compliance notification process differs from Embodiment 1.

[0077] (Event response requirements list display 4D5 related to Embodiment 2) Figure 10 shows the event response requirements list display 4D5 according to Embodiment 2. The data processing related to the display of the event response requirements list display 4D5 is performed by the processor 12. The event response requirements list display 4D5 is a screen that is displayed on the output section of the user terminal 4 when the user selects the event response tab 4D59.

[0078] The Event Response Requirements List Display 4D5 notifies the user via the output unit of any legal compliance requirements triggered by notifications from external systems based on the occurrence of an event.

[0079] The Event Response Requirements List Display 4D5 presents a list of legal requirements that require action, based on events output from the Security Response System 2. The Event Response Requirements List Display 4D5 includes the following items: Law 4D51, Legal Requirement ID 4D52, Legal Requirement 4D53, Occurrence Status 4D54, Action Deadline 4D55, and Progress 4D56. Law 4D51, Legal Requirement ID 4D52, Legal Requirement 4D53, Action Deadline 4D55, and Progress 4D56 are the same as Law 4D11, Legal Requirement ID 4D12, Legal Requirement 4D13, Action Deadline 4D15, and Progress 4D16 in the Periodic Response Requirements List Display 4D1 (Figure 3). Occurrence Status 4D54 is entered by the Event Response Support Processing (Figure 11) described later. Action Deadline 4D55 and Progress 4D56 are entered only for records where Occurrence Status 4D54 is "In Progress".

[0080] The Event Response Requirements List Display 4D5 is an example of information related to legal requirements and corresponding evidence that is obtained based on the Response Performance Management Table 112 and presented to the user via the output unit.

[0081] (Event response support processing related to Embodiment 2) Figure 11 is a flowchart illustrating the event response support process according to Embodiment 2. The event response support process is executed whenever an event requiring legal compliance occurs.

[0082] First, in step S41, when the event receiving unit 12a receives notification of an event requiring legal compliance, it updates the event occurrence status 4D55 for that legal requirement in the event compliance requirement list display 4D5 to "occurring". Next, in step S11, the legal compliance support unit 12b notifies the user of the occurrence of an event requiring legal compliance (occurrence status 4D55 is "occurring").

[0083] (Effects of Embodiment 2) According to Embodiment 2, when legal compliance is required in the course of business activities, the deadline for implementation, specific response tasks, and necessary evidence can be shown, thereby reducing the burden on users.

[0084] [Embodiment 3] In Embodiment 3, the status of compliance with legal requirements for the selected laws and regulations is displayed in a list, regardless of whether it is a periodic response (Embodiment 1) or an event-based response (Embodiment 2).

[0085] (List of corresponding evidence related to Embodiment 3 4D6) Figure 12 shows the corresponding evidence list display 4D6 according to Embodiment 3. The data processing related to the display of the corresponding evidence list display 4D6 is performed by the processor 12. The corresponding evidence list display 4D6 is a screen that is displayed on the output unit of the user terminal 4 when the user selects the periodic response tab 4D69.

[0086] The corresponding evidence list display 4D6 includes the corresponding list display 4D61 and the evidence display 4D62.

[0087] The correspondence list display 4D61 presents a list of laws and regulations selected by the user and the corresponding work IDs. The correspondence list display 4D61 has the following display items: Law 4D611, Law requirement ID 4D612, Law requirement 4D613, Last action date and time 4D614, Progress 4D616, and Work ID 4D616.

[0088] Law 4D611, Legal Requirement ID 4D612, Legal Requirement 4D613, Last Action Date and Time 4D614, and Progress 4D615 are obtained in the same way as the Periodic Action Requirement List Display 4D1 (Figure 3) of Embodiment 1 when the legal requirement requires periodic action. Law 4D611, Legal Requirement ID 4D612, and Legal Requirement 4D613 are obtained in the same way as the Event Action Requirement List Display 4D5 (Figure 10) of Embodiment 2 when the legal requirement requires action when an event occurs. For the Task ID 4D616, refer to the Action Performance Management Table 112 (Figure 2C), and the corresponding Task ID 112c is entered for each Law 4D611 and Legal Requirement ID 4D612.

[0089] When task ID 4D616 is selected, the corresponding evidence display 4D62 is displayed. Evidence display 4D62 has the following fields: task item 4D621, execution date and time 4D622, and evidence 4D623. Task item 4D621 is entered as task item 112d from the response performance management table 112 (Figure 2C). Execution date and time 4D622 is entered as execution date and time 112e from the response performance management table 112. Evidence 4D623 is entered as evidence 112g from the response performance management table 112.

[0090] Furthermore, in the case of a third-party audit where the user is a third party other than an insider of the organization, the third-party audit indicator 4D68a is pressed and highlighted, the evidence 4D623 is hidden or locked, and viewing of the evidence 113 file becomes impossible. On the other hand, in the case of an internal audit where the user is an insider of the organization, the internal audit indicator 4D68b is pressed and highlighted, the evidence 4D623 is displayed, and viewing of the evidence 113 file becomes possible.

[0091] In other words, the corresponding evidence list display 4D6 controls the disclosure and non-disclosure of the content of the evidence via the output unit. Furthermore, when the third-party audit display 4D68a is pressed in the corresponding evidence list display 4D6, it is determined whether or not the content of the evidence contains sensitive information. If it is determined that the content of the evidence contains sensitive information, the sensitive information is masked (not disclosed) in the output of the output unit, and if it is determined that the content of the evidence does not contain sensitive information, the sensitive information is disclosed in the output of the output unit. The control of disclosure and non-disclosure of the content of the evidence is not limited to pressing and depressing the third-party audit display 4D68a and internal audit display 4D68b, but may also be based on the permission control of the logged-in user according to the permission list.

[0092] The corresponding evidence list display 4D6 is an example of information related to legal requirements and corresponding evidence, which is obtained based on the compliance performance management table 112 and presented to the user via the output unit.

[0093] (Evidence list display processing according to Embodiment 3) Figure 13 is a flowchart showing the evidence list display process according to Embodiment 3.

[0094] First, in step S51, the evidence presentation unit 12e refers to the response performance management table 112 (Figure 2C) and obtains information on the response performance and evidence related to the selected legal requirements. Next, in step S52, the evidence presentation unit 12e determines whether the presentation is to a third party (third-party audit indicator 4D68a is inverted). If the presentation is to a third party (step S52 YES), the evidence presentation unit 12e moves to step S53, and if the presentation is to an insider (internal audit indicator 4D68b is inverted) (step S52 NO), it moves to step S54.

[0095] In step S53, the evidence presentation unit 12e displays the evidence display 4D62 with restrictions on access to specific information, such as prohibiting viewing of the evidence 113. On the other hand, in step S54, the evidence presentation unit 12e displays the evidence display 4D62 without restrictions on access to specific information, such as prohibiting viewing of the evidence 113.

[0096] (Effects of Embodiment 3) According to Embodiment 3, it is possible to easily demonstrate to third parties that the process for complying with laws and regulations has been properly implemented and that appropriate evidence has been properly maintained.

[0097] Although several embodiments have been described above, these are merely illustrative examples for explaining the present invention and are not intended to limit the scope of the present invention to these embodiments only. The present invention can also be implemented in various other forms, such as forms in which some of the components of the above embodiments are omitted, forms in which at least some of the components are replaced, forms in which components are added, and forms in which some or all of the embodiments are combined. [Explanation of symbols]

[0098] 1: Legal compliance support system, 4: User terminal, 11: Storage unit, 12: Processor, 13: Memory, 111: Legal compliance management table, 112: Compliance performance management table, 113: Evidence

Claims

1. A legal compliance support system that assists in complying with laws and regulations, The aforementioned legal compliance support system includes a processor and a storage unit that stores evidence indicating that compliance with the aforementioned laws and regulations has been completed. The aforementioned processor, Legal compliance management information is managed by associating legal requirements that define the matters to be implemented in response to the aforementioned laws and regulations with evidence information related to the evidence necessary to demonstrate that the response to said legal requirements has been completed. The system analyzes the evidence stored in the memory unit and presents the evidence that satisfies the legal requirements to the user as evidence candidate via the output unit. The user receives the evidence selected from the candidate evidence, The legal requirements that the aforementioned evidence satisfies and the evidence selected by the user from the candidate evidence are associated and registered in the compliance performance management information. A legal compliance support system characterized by the following features.

2. A legal compliance support system according to claim 1, The aforementioned processor, Based on the aforementioned compliance performance management information, the system acquires the aforementioned legal requirements and the information relating to the evidence corresponding to those legal requirements, and presents them to the user via the output unit. A legal compliance support system characterized by the following features.

3. A legal compliance support system according to claim 1, The aforementioned processor, The aforementioned legal compliance management information manages the deadline for complying with the aforementioned legal requirements, Based on the aforementioned legal compliance management information, the system provides the user with a notification regarding the deadline for compliance via the output unit. A legal compliance support system characterized by the following features.

4. A legal compliance support system according to claim 1, The aforementioned processor, The system retrieves the history of the actions taken in accordance with the legal requirements from the aforementioned action performance management information and presents it to the user via the output unit. A legal compliance support system characterized by the following features.

5. A legal compliance support system according to claim 1, The aforementioned processor, The system retrieves information relating to laws and regulations that match or are similar to the legal requirements from the aforementioned legal compliance management information, retrieves the history of the corresponding actions for the laws and regulations related to the retrieved information from the aforementioned action performance management information, and presents it to the user via the output unit. A legal compliance support system characterized by the following features.

6. A legal compliance support system according to claim 3, The aforementioned processor, At regular intervals, the system provides the user with a notification regarding the deadline for compliance based on the legal compliance management information via the output unit. A legal compliance support system characterized by the following features.

7. A legal compliance support system according to claim 1, The aforementioned processor, The system notifies the user via the output unit that they must comply with the aforementioned laws and regulations, triggered by a notification from an external system based on the occurrence of an event. A legal compliance support system characterized by the following features.

8. A legal compliance support system according to claim 1, The aforementioned processor, Controls the disclosure and non-disclosure of the contents of the evidence via the output unit. A legal compliance support system characterized by the following features.

9. A legal compliance support system according to claim 8, The aforementioned processor, Determine whether the content of the aforementioned evidence includes sensitive information. If it is determined that the content of the evidence includes the sensitive information, the output of the output unit will not disclose the sensitive information. A legal compliance support system characterized by the following features.

10. A method of supporting compliance with laws and regulations that is implemented by a legal compliance support system that assists in complying with laws and regulations, The aforementioned legal compliance support system includes a processor and a storage unit that stores evidence indicating that compliance with the aforementioned laws and regulations has been completed. The aforementioned processor, Legal compliance management information is managed by associating legal requirements that define the matters to be implemented in response to the aforementioned laws and regulations with evidence information related to the evidence necessary to demonstrate that the response to said legal requirements has been completed. The system analyzes the evidence stored in the memory unit and presents the evidence that satisfies the legal requirements to the user as evidence candidate via the output unit. The user receives the evidence selected from the candidate evidence, The legal requirements that the aforementioned evidence satisfies and the evidence selected by the user from the candidate evidence are associated and registered in the compliance performance management information. A method for supporting compliance with laws and regulations, characterized by having each of the following processes.

Images