Risk management system and risk management method

Abstract

To enable efficient investigation and assessment of risks associated with the execution of business operations. [Solution] The risk management system stores risk-related information, which is information about risks that may arise in the operations performed within the organization. Based on the risk-related information, it generates training data. Using the training data, it trains a large-scale language model or a small-scale language model. It accepts prompt inputs that instruct the model to generate response information about risks that may arise in the operations, and outputs the response information generated by the large-scale language model or the small-scale language model upon input of the prompt. The training data consists of data in which elements that may influence the classification of risks, identified from the risk-related information, are used as explanatory variables, and labels to which the risk-related information is classified are used as the target variable.

Description

Technical Field

[0001] The present invention relates to a risk management system and a risk management method.

Background Art

[0002] Patent Document 1 describes a damage assumption information creation system for disaster countermeasures configured for the purpose of enhancing the disaster response ability of society. The damage assumption information creation system for disaster countermeasures has a damage assumption information creation support computer and a damage assumption information database. The damage assumption information database includes a basic information database registering information on assumed disaster types, disaster-affected areas, and training levels, a disaster information database registering assumed disaster information, a prefecture, city, town, and village name database, a social damage case database, a base name database, an in-house damage case database, a response case database, and a personal name database registering employee names. The damage assumption information creation support computer refers to each piece of information and creates damage assumption information including assumed disaster situation information, social damage situation information, base damage situation information, and the safety confirmation situation information of each employee.

[0003] Patent Document 2 describes a risk assessment analysis device configured for the purpose of supporting the analysis of risk preference, damage intensity and frequency, determination of the priority order for taking countermeasures, and the work until devising countermeasures. The risk assessment analysis device calculates the damage frequency and damage intensity for each risk item, plots each risk item on a two-dimensional graph to create a risk statistical map, calculates the business risk value based on the financial statements, calculates the insurance limit amount based on the financial statements, classifies the risk statistical map into a plurality of regions based on the comparison of the business risk value and the insurance limit amount and the comparison of the damage frequency, and determines the priority order for taking countermeasures for each risk item based on which region each risk item belongs to.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

[0005] In recent years, it has become increasingly important for organizations such as companies to investigate information regarding risks that may arise in the course of their operations and to appropriately assess those risks. This investigation requires comprehensively extracting information, such as past business cases, from a vast amount of data, including terms and conditions, internal operating procedures, and FAQ systems. Furthermore, the assessment requires continuously monitoring and reassessing risks that could negatively impact the organization, for example, by contacting relevant departments. This process, involving significant effort, judgment, and decision-making, requires considerable time and resources.

[0006] In the aforementioned Patent Document 1, the damage assessment information creation support computer requires a massive database of damage assessment information containing a wide range of data to create damage assessment information by referencing various pieces of information, and the database must be kept constantly updated. Furthermore, the technology described in Patent Document 1 is intended to enhance society's disaster response capabilities and is not intended to assess risks associated with the execution of operations in organizations such as companies.

[0007] Furthermore, Patent Document 2 calculates the frequency and intensity of damage for each risk item to create a risk statistics map, calculates the business risk value and retention limit based on financial statements, and classifies the risk statistics map into multiple areas based on a comparison of the magnitude of the business risk value and retention limit, as well as a comparison of the magnitude of damage frequency, to determine the priority of implementing countermeasures for each risk item. As a result, it is necessary to go through many work steps before determining the priority of implementing countermeasures for each risk item, which requires a great deal of effort and time.

[0008] This invention was made in view of the above background, and aims to provide a risk management system and a risk management method that enable efficient investigation and evaluation of risks associated with the performance of business. [Means for solving the problem]

[0009] One of the present inventions for achieving the above objective is a risk management system configured using an information processing device having a processor and a memory device, which stores risk-related information which is information about risks that may arise in the operations performed in an organization, generates learning data based on the risk-related information, trains a large-scale language model or a small-scale language model using the learning data, receives input of a prompt instructing the model to generate information about risks that may arise in the operations as response information, and outputs the response information generated by the large-scale language model or the small-scale language model in response to the input of the prompt.

[0010] Further issues disclosed in this application, and methods for solving them, will be made clear in the section on embodiments for carrying out the invention and in the drawings. [Effects of the Invention]

[0011] According to the present invention, it is possible to efficiently investigate and evaluate risks associated with the performance of business operations. [Brief explanation of the drawing]

[0012] [Figure 1] This diagram shows the general configuration of the risk management system. [Figure 2] This is an example of a hardware configuration for an information processing device used in the configuration of risk management devices and user devices. [Figure 3A] This diagram shows the main functions of a risk management device. [Figure 3B] This diagram shows the main functions of the user device. [Figure 4A] This is an example of various types of information. [Figure 4B] This is an example of various types of information. [Figure 5] This is an example of a prompt. [Figure 6] This is an example of response information. [Figure 7A] This is an example of response information (risk assessment map). [Figure 7B] This is an example of the information stored in the risk assessment result (occurrence frequency). [Figure 7C] This is an example of the information stored in the risk calculation result (damage scale). [Figure 7D] This is an example of the information stored in the risk countermeasure (countermeasure priority list). [Figure 7E] This is an example of the information stored in the countermeasure implementation status. [Figure 8] This is a flowchart for explaining the risk management information providing process.

Mode for Carrying Out the Invention

[0013] Hereinafter, embodiments will be described with reference to the drawings. In the following description, the character "S" attached before the reference numerals means a processing step.

[0014] FIG. 1 shows a schematic configuration of an information processing system (hereinafter referred to as "risk management system 1") described as an embodiment of the present invention. The risk management system 1 is used, for example, in an organization such as a company or a government agency.

[0015] As shown in the figure, the risk management system 1 includes a risk management device 100 and one or more user devices 200. The risk management device 100 operates, for example, on a substrate such as a system center, a data center, or a cloud system on the Internet. The user device 200 exists, for example, in each department of the organization.

[0016] The risk management device 100 and the user device 200 are connected via a communication network 5. The communication network 5 can be, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, various public communication networks, or a dedicated line.

[0017] The risk management device 100 receives a question (hereinafter referred to as "prompt") from the user device 200 regarding risks to be considered when performing business operations, inputs the received prompt into the model 113 described later, generates response information to the prompt, and transmits the generated response information to the user device 200.

[0018] Both the risk management device 100 and the user device 200 are configured using information processing equipment (computers).

[0019] Figure 2 shows an example of the hardware configuration of an information processing device used in the configuration of the risk management device 100 and the user device 200. The risk management device 100 and the user device 200 are configured using one or more information processing devices 10 having the configuration shown in the figure. Examples of information processing devices include personal computers, various server devices, smartphones, tablets, office computers, general-purpose computers (mainframes), etc.

[0020] The information processing device 10 comprises a processor 11, a main memory 12 (memory), an auxiliary storage device 13 (external storage device), an input device 14, an output device 15, and a communication device 16. These are connected via a bus line or communication cable, enabling bidirectional communication.

[0021] The information processing device 10 may be implemented, in whole or in part, using virtual information processing resources provided using virtualization technology, process space isolation technology, etc., such as a virtual server provided by a cloud system.

[0022] The processor 11 is composed of, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), an AI (Artificial Intelligence) chip, and the like.

[0023] The main memory 12 is a device used by the processor 11 when executing a program, and includes, for example, ROM (Read Only Memory), RAM (Random Access Memory), and non-volatile memory (NVRAM (Non-Volatile RAM)).

[0024] Furthermore, the various functions implemented in the risk management device 100 and the user device 200 are realized by the processor 11 reading programs and data stored in the auxiliary storage device 13 into the main memory device 12 and executing them.

[0025] The auxiliary storage device 13 is a device for storing programs and data, and consists of various storage systems such as SSDs (Solid State Drives), hard disk drives, optical storage devices (CDs (Compact Discs), DVDs (Digital Versatile Discs), etc.), NAS (Network Attached Storage), IC cards, SD cards, and non-temporary storage devices such as optical storage media, and non-temporary storage areas of cloud servers.

[0026] The input device 14 is an interface that accepts information input from an external source, and can be, for example, a keyboard, mouse, touch panel, card reader, pen-input tablet, or voice input device.

[0027] The output device 15 is an interface that outputs various information such as processing progress and processing results to the outside. The output device 15 is, for example, a display device that visualizes the above information (LCD monitor, LCD (Liquid Crystal Display), graphics card, etc.), a device that converts the above information into sound (speaker, etc.), or a device that converts the above information into text (printer, etc.).

[0028] For example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

[0029] The input device 14 and the output device 15 constitute a user interface that enables interactive processing with the user (receiving information, providing information, etc.).

[0030] The communication device 16 is a device that enables communication with other devices. The communication device 16 is a wired or wireless communication interface that enables communication with other devices via the communication network 5, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, etc.

[0031] The information processing device 10 may have, for example, an operating system, a file system, a DBMS (Database Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc. installed on it.

[0032] <Risk Management Device> Figure 3A shows the main functions of the risk management device 100. As shown in the figure, the risk management device 100 includes the following functions: a storage unit 110, an information acquisition and management unit 125, a learning data generation unit 130, a learning processing unit 135, a prompt receiving unit 140, a response information generation unit 145, and a response information provision unit 150.

[0033] Of the above functions, the memory unit 110 stores the following information (data): risk-related information 111, learning data 112, model 113, prompt 114, and response information 115.

[0034] The information acquisition and management unit 125 acquires information about risks that may arise in business operations (for example, information about risk investigation and assessment) to be used for training the model 113, and manages the acquired information as risk-related information 111 in the storage unit 110.

[0035] The Information Acquisition and Management Unit 125 acquires, for example, internal business regulations (e.g., company regulations, emergency disaster regulations, etc.), internal notices and notification documents (e.g., internal notices / office notices, etc.), past risk cases within the organization (e.g., records of responses to risk occurrences, analysis results, etc.), risk cases that have occurred in other organizations (other companies, etc.) (e.g., case studies, white papers, etc.), and data describing risk response manuals managed within the organization (e.g., document data written in a prescribed format, etc.), and manages the acquired information as risk-related information 111 in the storage unit 110.

[0036] The learning data generation unit 130 classifies and organizes the risk-related information 111 and identifies elements from the risk-related information 111 that may influence the classification of risks (for example, the content of the document, the date and time the risk occurred, the scope of the risk's impact, detailed information on the response to the risk, etc.) as explanatory variables. The learning data generation unit 130 then generates learning data by setting the classification target label as the target variable (labeling) for the explanatory variables, and manages the generated learning data as learning data 112 in the storage unit 110.

[0037] The mapping of the dependent variable to the explanatory variables is performed, for example, through user interaction via a user interface. The assignment (labeling) of the dependent variable to the explanatory variables is performed, for example, using tools such as annotation tools. Furthermore, the training data generation unit 130 performs data preprocessing (cleaning (noise reduction), normalization, etc.) as needed when generating training data. The training data generation unit 130 also appropriately performs tokenization required for natural language processing (NLM) when generating training data.

[0038] The learning processing unit 135 trains the model 113 using the training data 112. The model 113 is, for example, a large language model (LLM) or a small language model (SLM). When training the model 113, the learning processing unit 135 uses, for example, a pre-trained model ("GPT-4" (registered trademark), "BERT" (registered trademark), "LLaMA" (registered trademark), etc.). The learning processing unit 135 also fine-tunes the model 113, which has been pre-trained using a predetermined dataset, using a different dataset. Furthermore, the learning processing unit 135 verifies the risk classification accuracy of the trained model 113 using test data.

[0039] The prompt receiving unit 140 receives prompts sent from the user device 200 and manages the received prompts as prompts 114 in the storage unit 110.

[0040] The response information generation unit 145 inputs the prompt 114 to the model 113, and manages the output of the model 113 as response information 115 in the storage unit 110.

[0041] The response information provision unit 150 transmits the contents of the response information 115 to the user device 200.

[0042] <User device> Figure 3B shows the main functions of the user device 200. As shown in the figure, the user device 200 includes the functions of a storage unit 210, a prompt receiving unit 225, a prompt transmitting unit 230, a response information receiving unit 235, and a response information output unit 240.

[0043] Of the above functions, the memory unit 110 stores the following information (data): risk-related information 111, learning data 112, model 113, prompt 114, and response information 115.

[0044] The prompt receiving unit 225 receives prompt input from the user via the user interface and manages the received prompt as prompt 211 in the storage unit 210.

[0045] The prompt transmission unit 230 transmits the prompt 211 to the risk management device 100 via the communication network 5.

[0046] The response information receiving unit 235 receives response information sent from the risk management device 100 via the communication network 5, and manages the received response information as response information 212 in the storage unit 210.

[0047] The response information output unit 240 provides the content of the response information 212 to the user via the output device 15. The response information output unit 240 displays the content of the response information 212 on a display device, which is the output device 15, for example.

[0048] <Example Data> Figure 4A shows an example of a "Disaster Response Manual for Information Processing Equipment in Emergency Situations" managed by a company, which is an example of risk-related information 111. The example of risk-related information 111 includes information such as "systems and organizational management methods for responding to risks," "emergency response and recovery methods when a risk occurs," and "measures taken during normal times."

[0049] Figure 4B shows an example of a "Disaster Response Regulations for Emergencies" managed by a company, which is another example of risk-related information 111. The risk-related information 111 exemplified here includes information such as "Methods for Establishing a Disaster Prevention System," "Methods for Responding to and Restoring from Disasters," and "Matters to be Prepared for in Advance."

[0050] Figure 5 shows an example of prompts 114 and 211. As shown in the figure, the example prompt states: "Around 4:42 PM on August 8, 2024, an earthquake with a maximum seismic intensity of 6- occurred off the coast of Miyazaki Prefecture in the Hyuga Sea. Please recreate the risk management maps for each department, taking into account our company's past response cases."

[0051] Figure 6 shows an example of response information 115,212. As shown in the figure, the example response information includes the following: "Network equipment departments should pay attention to aftershocks and check for any equipment malfunctions while keeping an eye on additional information from the Japan Meteorological Agency," "Digital Innovation Headquarters should check for any cyberattack systems and incidents affecting networks that target disaster situations," and "Disaster relief teams should check stockpiles and confirm whether there are any impacts on the logistics routes for emergency response supplies."

[0052] Figures 7A to 7E show examples of response information 115,212, and are examples of "risk assessment maps" managed within an organization. The example risk assessment map 700 consists of multiple records, each containing the following items: risk subcategory 710, risk minor category 720, risk case 730, risk assessment result (frequency of occurrence) 740, risk calculation result (scale of damage) 750, risk countermeasures (priority list of countermeasures) 760, and status of implementation of countermeasures 770.

[0053] Of the items listed above, Risk Category 710 contains subcategories of risk (business strategy, sales / market, economy, human resources system, society, etc.).

[0054] Risk subcategory 720 stores subcategories of risk (failure of new business / capital investment, corporate acquisition / merger / acquisition, etc.).

[0055] Risk Case 730 stores risk cases corresponding to the medium and minor categories of risk.

[0056] The Risk Assessment Result (Frequency) 740 stores the risk assessment corresponding to a risk case (in this example, the frequency of risk occurrence). Figure 7B shows an example of the information stored in Risk Assessment Result (Frequency) 740.

[0057] The Risk Calculation Result (Damage Scale) 750 stores the risk calculation result (in this example, the damage scale). Figure 7C shows an example of the information stored in Risk Calculation Result (Damage Scale) 750.

[0058] The Risk Response Measures (Priority List of Countermeasures) 760 stores countermeasures for risks (in this example, the priority list of countermeasures). Figure 7D shows an example of the information stored in the Risk Response Measures (Priority List of Countermeasures) 760.

[0059] The "Implementation Status of Countermeasures 770" section stores information regarding the implementation of countermeasures against risks. Figure 7E shows an example of the information stored in the "Implementation Status of Countermeasures 770" section.

[0060] <Example of processing> Figure 8 is a flowchart illustrating the process performed by the risk management device 100 (hereinafter referred to as "risk management information provision process S800"). The risk management information provision process S800 will be explained below in conjunction with the figure.

[0061] First, in the learning phase, the learning data generation unit 130 generates learning data 112 based on the risk-related information 111 acquired by the information acquisition and management unit 125 (S811).

[0062] Next, the learning processing unit 135 trains the model 113 using the training data 112 (S812).

[0063] On the other hand, in the usage phase, the prompt receiving unit 140 first receives a prompt 114 from the user via the user device 200 (S821). The user creates a prompt, for example, when a new event, issue, or incident occurs, and inputs it into the user device 200.

[0064] Next, the response information generation unit 145 inputs the content of the received prompt 114 into the model 113 and generates response information 115 (S822).

[0065] Next, the response information provision unit 150 transmits information to the user device 200 via the communication network 5 based on the response information 115 (S823). The user device 200 receives the content of the response information sent from the risk management device 100 and provides the content of the received response information 212 to the user via the output device 15. The user can efficiently conduct risk investigations and reassessments using the provided response information 212.

[0066] <Summary> As described above, the risk management system 1 of this embodiment stores risk-related information, which is information about risks that may arise in the operations performed by the organization; generates training data based on the risk-related information; trains a large-scale language model or a small-scale language model using the training data; accepts prompt inputs instructing the model to generate response information about risks that may arise in the operations; and outputs the response information generated by the large-scale language model or small-scale language model upon input of the prompts, providing it to the user. Therefore, the user can efficiently investigate and evaluate risks associated with the execution of operations.

[0067] Furthermore, the risk management system 1 of this embodiment uses elements that may influence the classification of risks, identified from risk-related information, as explanatory variables, and data in which labels that represent the classification destinations of risk-related information are associated with the explanatory variables as training data for training the model 113. The above response information is information that associates at least one of the following with each classification destination: information on risk cases, information on risk assessment, information on countermeasures against risks, and information on the implementation of countermeasures against risks. This makes it possible to provide users with response information (e.g., a risk assessment map 700) that is useful when investigating and assessing risks, and can be used, for example, for BCP (Business Continuity Planning) measures.

[0068] The risk-related information mentioned above includes, for example, internal operational regulations, internal circulars or notices, past risk cases within the organization, risk cases in other organizations, and risk response manuals managed within the organization. Risk Management System 1 can efficiently generate training data using readily available information managed within such organizations.

[0069] In risk management within an organization, it is necessary to identify risks that affect business activities. Furthermore, it is necessary to quickly investigate and evaluate newly occurring, unprecedented, and irregular events. Since risk identification is multifaceted, it is essential to ensure comprehensiveness and avoid omissions or duplication. Failure to adequately anticipate and cover risks can lead to serious consequences. Additionally, risk identification and sensitivity have subjective aspects, making it difficult in some cases. Furthermore, risks need to be visualized, and risk-related information needs to be shared within the organization and with other organizations. The risk management system 1 of this embodiment can be effectively utilized to solve these problems.

[0070] The embodiments of the present invention have been described in detail above, but this description is for the purpose of facilitating understanding of the present invention and does not limit it. The present invention can be modified and improved without departing from its spirit, and of course, equivalents thereof are included in the present invention. For example, the above embodiments have been described in detail for the purpose of explaining the present invention in an easy-to-understand manner and are not necessarily limited to those having all the configurations described. Furthermore, it is possible to add, delete, or replace some of the configurations of the above embodiments with other configurations. [Explanation of Symbols]

[0071] 1 Risk Management System, 5 Communication Network, 10 Information Processing Device, 11 Processor, 12 Main Memory, 13 Auxiliary Memory, 14 Input Device, 15 Output Device, 16 Communication Device, 100 Risk Management Device, 110 Storage Unit, 111 Risk-Related Information, 112 Learning Data, 113 Model, 114 Prompt, 115 Response Information, 125 Information Acquisition Management Unit, 130 Learning Data Generation Unit, 135 Learning Processing Unit, 140 Prompt Reception Unit, 145 Response Information Generation Unit, 150 Response Information Provision Unit, 200 User Device, 210 Storage Unit, 211 Prompt, 212 Response Information, 225 Prompt Reception Unit, 230 Prompt Transmission Unit, 235 Response Information Reception Unit, 240 Response Information Output Unit, S800 Risk Management Information Provision Processing

Claims

1. It is configured using an information processing device having a processor and a memory device, The organization stores risk-related information, which is information about risks that may arise in the operations performed within the organization. Based on the aforementioned risk-related information, training data is generated. Using the aforementioned training data, a large-scale language model or a small-scale language model is trained. The system accepts prompt input instructing it to generate response information regarding potential risks in the course of operations. By inputting the aforementioned prompt, the response information generated by the large-scale language model or the small-scale language model is output. Risk management system.

2. A risk management system according to claim 1, The aforementioned training data consists of data in which the explanatory variables are factors that may influence the classification of the risk, identified from the risk-related information, and the dependent variable is the label to which the risk-related information is classified. Risk management system.

3. A risk management system according to claim 2, The response information is information that associates each of the classification categories with at least one of the following: information regarding risk examples, information regarding risk assessment, information regarding countermeasures against risks, and information regarding the implementation of countermeasures against risks. Risk management system.

4. A risk management system according to any one of claims 1 to 3, The aforementioned risk-related information is at least one of the following: the organization's internal operational regulations, internal circulars or notices, past risk incidents within the organization, risk incidents occurring in other organizations, and risk response manuals managed within the organization. Risk management system.

5. An information processing device having a processor and a memory device, A step of storing risk-related information, which is information about risks that may arise in the operations performed within the organization. A step of generating learning data based on the aforementioned risk-related information, A step of training a large-scale language model or a small-scale language model using the aforementioned training data, A step of receiving input from a prompt instructing the system to generate response information regarding risks that may arise in the course of operations, and A step of outputting the response information generated by the large-scale language model or the small-scale language model by inputting the aforementioned prompt, A risk management method that implements this.

6. A risk management method according to claim 5, The aforementioned training data consists of data in which the explanatory variables are factors that may influence the classification of the risk, identified from the risk-related information, and the dependent variable is the label to which the risk-related information is classified. Risk management methods.

7. A risk management method according to claim 6, The response information is information that associates each of the classification categories with at least one of the following: information regarding risk examples, information regarding risk assessment, information regarding countermeasures against risks, and information regarding the implementation of countermeasures against risks. Risk management methods.

8. A risk management method according to any one of claims 5 to 7, The aforementioned risk-related information is at least one of the following: the organization's internal operational regulations, internal circulars or notices, past risk incidents within the organization, risk incidents occurring in other organizations, and risk response manuals managed within the organization. Risk management methods.

Images