Vendor Risk Management System Inconsistency Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Entities face challenges in integrating computing systems with computer-implemented functionality from vendors, leading to risks such as data breaches and malware, due to inadequate risk assessment and management processes.

Innovation Solution

A vendor risk management system that uses assessment datasets from multiple entities to identify inconsistencies in vendor responses, generating a modified risk rating and performing actions to mitigate risks, such as disabling APIs or sending notifications, through a combination of rules-based and machine-learning models.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If computer-implemented functionality from vendors is integrated with entity computing systems, then functionality and service capabilities are improved, but security risks and vulnerability to malicious attacks increase

Engineering Contradiction:

Improveservice capabilityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary risk assessments and due diligence evaluations before integrating vendor functionality. Assessment datasets are collected and analyzed in advance to identify potential security risks, allowing entities to make informed decisions about vendor integration while mitigating future security threats.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system continuously monitors vendor responses and assessment data, comparing actual vendor behavior against assessed risk levels. When inconsistencies or deviations are detected, the system generates alerts and takes corrective actions such as disabling APIs or isolating computing entities, creating a closed-loop feedback mechanism for ongoing risk management.

Inventive Principle:

Principle #23Feedback

2Reliability

If comprehensive risk assessment processes are implemented, then security and reliability are improved, but system complexity and assessment time increase

Engineering Contradiction:

ImprovesecurityVSAvoidassessment process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The risk assessment process is divided into distinct modular components: data collection modules that gather assessment datasets from multiple entities, analysis modules that process vendor responses, comparison modules that identify inconsistencies, and action modules that implement risk mitigation. This segmentation makes the complex assessment process more manageable and scalable.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system collects and analyzes assessment datasets from multiple entities that have already performed due diligence on the same vendor. By copying and comparing assessment data across entities, the system leverages collective intelligence to improve risk assessment accuracy without requiring each entity to independently conduct exhaustive assessments.

Inventive Principle:

Principle #26Copying

3Measurement precision

If multiple assessment datasets from multiple entities are analyzed, then risk identification accuracy is improved, but data processing time and computational resources increase

Engineering Contradiction:

Improverisk identification accuracyVSAvoiddata processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system merges assessment datasets from multiple entities into a consolidated analysis framework. By combining data from multiple sources and performing joint analysis, the system achieves more accurate risk identification through cross-validation and pattern recognition that would be difficult to achieve with single-entity assessments alone.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The system implements incremental processing of assessment datasets, analyzing data in stages rather than requiring complete processing of all datasets simultaneously. This allows the system to achieve sufficient risk identification accuracy with partial analysis, reducing overall processing time while maintaining effective risk detection capabilities.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11816224B2Assessing and managing computational risk involved with integrating third party computing functionality within a computing system

Publication Date: 2023.11.14 ONETRUST LLC

AI summary

In general, various aspects of the present disclosure provide methods, apparatuses, systems, computing devices, computing entities, and/or the like for addressing a modified risk rating identifying a risk to an entity of having computer-implemented functionality provided by a vendor integrated with a computing system of the entity. In accordance various aspects, a method is provided that comprises: receiving a first assessment dataset for computer-implemented functionality; detecting an inconsistency between a value of an attribute for the computer-implemented functionality specified in the first assessment dataset and a corresponding value of the attribute specified in a second assessment dataset for the computer-implemented functionality; modifying a risk rating that identifies a risk to the entity of having the computer-implemented functionality integrated with the computing system to generate a modified risk rating based on the inconsistency; and in response, performing an action with respect to the computing system to address the modified risk rating.