Abstract: According to one embodiment, a system includes a processor and an interface. The processor determines an entity, a plurality of process groupings associated with the entity, a plurality of processes associated with the entity, a plurality of risks associated with the entity, and a plurality of controls associated with the entity. For each of the controls, the processor calculates one or more weighted control scores for the control. For each of the risks, the processor calculates an inherent risk score for the risk and a residual risk score for the risk. For each of the processes, the processor calculates a residual risk score for the process. The interface communicates for display, for each of the process groupings, an image representing the process grouping. The interface further communicates for display, for each of the processes, an image representing the process and an indication of the residual risk score for the process.

Abstract: According to one embodiment, a system includes a processor and an interface. The processor determines a plurality of processes associated with an entity, a plurality of risks associated with the entity, and a plurality of controls associated with the entity. For each of the controls, the processor calculates one or more weighted control scores for the control. For each of the risks, the processor calculates an inherent risk score and a residual risk score. For each of the processes, the processor calculates a residual risk score for the process and determines a process weight associated with the process. The processor further calculates a residual risk score for the entity based on each of the residual risk scores of the processes and each of the process weights associated with the processes. The interface communicates for display an indication of the residual risk score for the entity.