AU2003200483B2 - Method and system for risk evaluation - Google Patents

Description

AUSTRALIA

Patents Act 1990 COMPLETE SPECIFICATION STANDARD PATENT Applicant(s): SAP AKTIENGESELLSCHAFT Invention Title: METHOD AND SYSTEM FOR RISK EVALUATION The following statement is a full description of this invention, including the best method of performing it known to me/us: 2002-013-EP METHOD AND SYSTEM FOR RISK EVALUATION Field of the Invention The present invention generally relates to electronic data processing, and more particularly relates to methods, computer program products and systems for evaluating risks, such as risks in strategic planning and other applications.

Background of the Invention Key-figures (also referred to as measures, hereinafter) are used by enterprises to monitor performance of their strategic processes. For example, a key-figure "number of visits to prospects" might have a causal relationship to the "number of new customer acquisitions," which can be used as a measure for a business development process. In the end, the "number of new customer acquisitions" has a direct impact on the "turnover" key-figure of the enterprise and becomes important for the financialresult.

Strategic planning usually includes a projection of how the enterprise expects these key-figures to develop in the future. Often, a financial goal is set and the causal relationships of the various key-figures are used to plan and control the corresponding processes that have an impact on financial results.

There is an ongoing need to evaluate uncertainties that come along with strategic planning.

Summary of the Invention The technical problem of lacking risk data in strategic management systems is solved by a method according to claim 1. Further embodiments of the invention are a 2002-013-EP risk evaluation system according to claim 12 and a computer program product according to claim 8.

By taking into account the impact of risks in a strategic management system, an embodiment of the present invention allows a user to better control the strategic management system for improving the quality of predictions made by the strategic management system.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description or may be learned by practice of the invention.

The aspects of the invention will be realized and attained by, means of the elements and combinations particularly pointed out in the appended claims. It is to be understood that the foregoing general description and the following detailed description is exemplary and explanatory only and is not restrictive of the invention as described.

Brief Description of the Drawings FIG. 1 illustrates a simplified block diagram of an exemplary computer system, which may be used to implement embodiments of the present invention; FIGS. 2A, 2B illustrate an example of a graphical user interface that is generated by a computer which is operated according to one embodiment of the present invention; FIG. 3 illustrates details of an implementation of a risk evaluation system according to one embodiment of the present invention; FIG. 4 illustrates details of one embodiment of calculating an object-measure value of an object by taking into account the impact of a risk; 2002-013-EP FIG. 5 illustrates further details of a memory in one embodiment of the risk evaluation system of the present invention; FIG. 6 illustrates an alternative embodiment of the present invention; FIG. 7 illustrates aggregation of objects in different score-cards used in one embodiment of the present invention; and FIGS. 8A, 8B illustrate steps of a risk evaluation method according to one embodiment of the present invention.

Detailed Description In accordance with an embodiment of the present invention, a risk evaluation system is provided that includes a memory storing an assignment structure. It further includes a processor that is programmed for assigning a risk to an object using the assignment structure. Examples of the object in a strategic enterprise management context are strategy, strategyelement, perspective, objective, target, initiative and measure. The object has an object measure-value. The object measure-value, as used hereinafter, represents a (latest) estimate of a value that relates to one or more specific values of the object. Specific values of the object can be plan values, actual values, variances, target values or other calculated values. A risk, as used hereinafter, is a representation of a possible event that creates uncertainty for an object measure-value. The impact of a risk on a specific object can be measured by a (risk) expectation-value.

Examples for the expectation-value are impact of new competitors on turnover, impact of demographic factors on insurance payments, impact of political crisis on oil price or any other factor whose impact on the 2002-013-EP object measure-value is uncertain. The processor executes program instructions for calculating the object measure-value by using the risk expectationvalue(s) In another embodiment of the object is a component of a score-card. A score-card, as used hereinafter, includes a plurality of objects, wherein the objects can have relationships that indicate interdependencies between objects. Examples of score-cards are "Balanced Score-Cards" or "Value Driver Trees" used in Strategic Enterprise Management to monitor the performance of enterprises, score-cards to monitor the performance of funds, score-cards to monitor reliability of various car brands or any other score-card to monitor values related to a specific field.

Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts. For convenience of explanation a list of references is provided prior to the claims.

FIG. 1 illustrates an exemplary computer system 999, which may be used to implement embodiments of the present invention. Computer system 999 includes computer 900 and optionally can have a plurality of further computers 901, 902 (or 90q, with Q any number).

In the case of multiple computers, computer 900 may be connected to further computers 901, 902 via computer network 990. Computer 900 comprises processor 910, memory 920, bus 930, and, optionally, input device 940 and output device 950 (I/O devices, user interface 960). As illustrated, the invention is present by computer program product 100 (CPP), program carrier 970 and program signal 980, collectively "program".

In respect to computer 900, computer 901/902 is sometimes referred to as "remote computer", computer 2002-013-EP 901/902 is, for example, a server, a router, a peer device or other common network node, and typically comprises many ,or all of the elements described relative to computer 900. Hence, elements 100 and 910-980 in computer 900 collectively illustrate also corresponding elements 10q and 91q-98q (shown for q=0) in computers Computer 900 is, for example, a conventional personal computer a desktop and hand-held device, a multiprocessor computer, a pen computer, a microprocessor-based or programmable consumer electronics, a minicomputer, a mainframe computer, a personal mobile computing device, a mobile phone, a portable or stationary personal computer, a palmtop computer or the like.

Processor 910 is, for example, a central processing unit (CPU), a micro-controller unit (MCU), digital signal processor (DSP), or the like.

Memory 920 symbolizes elements that temporarily or permanently store data and instructions. Although memory 920 is conveniently illustrated as part of computer 900, memory function can also be implemented in network 990, in computers 901/902 and in processor 910 itself cache, register), or elsewhere.

Memory 920 can be a read only memory (ROM), a random access memory (RAM), or a memory with other access options. Memory 920 is physically implemented by computer-readable media, such as, for example: (a) magnetic media, such as a hard disk, a floppy disk, or other magnetic disk, a tape, a cassette tape; (b) optical media, such as optical disk (CD-ROM, digital versatile disk DVD); semiconductor media, such as DRAM, SRAM, EPROM, EEPROM, memory stick, or by any other media, such as paper.

2002-013-EP Optionally, memory 920 is distributed across different media. Portions of memory 920 can be removable or non-removable. For reading from media and for writing in media, computer 900 uses devices well known in the art such as, for example, disk drives, tape drives.

Memory 920 stores support modules such as, for example, a basic input output system (BIOS), an operating system a program library, a compiler, an interpreter, and a text- processing tool. Support modules are commercially available and can be installed on computer 900 by those of skill in the art. For simplicity, these modules are not illustrated.

CPP 100 comprises program instructions and optionally data that cause processor 910 to execute method steps of the present invention. Method steps are explained with more detail below. In other words, CPP 100 defines the operation of computer 900 and its interaction in network system 999. For example and without the intention to be limiting, CPP 100 can be available as, source code in any programming language, and as object code ("binary code") in a compiled form.

Persons of skill in the art can use CPP 100 in connection with any of the above support modules compiler, interpreter, operating system) Although CPP 100 is illustrated as being stored in memory 920, CPP 100 can be located elsewhere. CPP 100 can also be-embodied in carrier 970.

Carrier 970 is illustrated outside computer 900.

For communicating CPP 100 to computer 900, carrier 970 is conveniently inserted into input device .940.

Carrier 970 is implemented as any computer readable medium, such as a medium largely explained above (cf.

memory 920). Generally, carrier 970 is an article of manufacture comprising a computer readable medium 2002-013-EP having computer readable program code means embodied therein for executing the method of the present invention. Further, program signal 980 can also embody computer program 100. Signal 980 travels on network 990 to computer 900.

Having described CPP 100, program carrier 970, and program signal 980 in connection with computer 900 is convenient. Optionally, program carrier 971/972 (not shown) and program signal 981/982 embody computer program product (CPP) 101/102 to be executed by processor 911/912 (not shown) in computers 901/902, respectively.

Input device 940 symbolizes a device that provides data and instructions for processing by computer 900.

For example, device 940 is a keyboard, a pointing device mouse, trackball, cursor direction keys), microphone, joystick, game pad, scanner, disk drive.

Although the examples are devices with human interaction, device 940 can also operate without human interaction, such as, a wireless receiver with satellite dish or terrestrial antenna), a sensor a thermometer), a counter goods counter in a factory). Input device 940 can serve to read carrier 970.

Output device 950 symbolizes a device that presents instructions and data that have been processed. For example, a monitor or a display,, (cathode ray tube (CRT), flat panel display, liquid crystal display (LCD), speaker, printer, plotter, vibration alert device. Similar as above, output device 950 communicates with the user, but it canalsocommunicate with further computers.

Input device 940 and output device 950 can be combined to a single device; any device 940 and 950 can be provided optional.

2002-013-EP Bus 930 and network 990 provide logical and physical connections by conveying instruction and data signals. While connections inside computer 900 are conveniently referred to as "bus 930", connections between computers 900-902 are referred to as "network 990". Optionally, network 990 comprises gateways being computers that specialize in data transmission and protocol conversion.

Devices 940 and 950 are coupled to computer 900 by bus 930 (as illustrated) or by network 990 (optional) While the signals inside computer 900 are mostly electrical signals, the signals in network are electrical, magnetic, optical or wireless (radio) signals.

Networking environments (as network 990) are commonplace in offices, enterprise-wide computer networks, intranets and the internet world wide web). The physical distance between a remote computer and computer 900 is not important. Network 990 can be a wired or a wireless network. To name a few network implementations, network 990 is, for example, a local area network (LAN), a wide area network (WAN), a public switched telephone network (PSTN); a Integrated Services Digital Network (ISDN), an infra-red (IR) link, a radio link, such as Universal Mobile Telecommunications System (UMTS), Global System for Mobile Communication (GSM), Code Division Multiple Access (CDMA), or satellite link.

Transmission protocols and data formats are known, for example, as transmission control protocol/internet protocol (TCP/IP), hyper text transfer protocol (HTTP), secure HTTP, wireless application protocol, unique resource locator (URL), a unique resource identifier (URI), hyper text markup language HTML, extensible markup language (XML), extensible hyper text markup 2002-013-EP language (XHTML), wireless application markup language (WML), Standard Generalized Markup Language (SGML) etc.

Interfaces coupled between the elements are also well known in the art. For simplicity, interfaces are not illustrated. An interface can be, for example, a serial port interface, a parallel port interface, a game port, a universal serial bus (USB) interface, an internal or external modem, a video adapter, or a sound card.

Computer and program are closely related. As used hereinafter, phrases, such as "the computer provides" and "the program provides", are convenient abbreviation to express actions by a computer that is controlled by a program.

FIGS. 2A, 2B illustrate an example of a graphical user interface (GUI) 955 that may be generated by a computer 900 (cf. FIG. 1) which is operated according to one embodiment of the present invention. For example, GUI 955 is visualized for a user via output device 950 (cf.

FIG. 1) at two different time points T1 (cf. FIG. 2A) and T2 (cf. FIG. 2B). T2 is after T1.

The following scenario will be referred to as an example in the detailed description of the present invention. However, the scenario is not meant to limit the scope of the invention.

At T1, GUI 955 includes layout-components 955-1 to 955-7. GUI 955 may be part of an application to plan and track objectives of an enterprise. In the example, GUI 955 shows a portion of a score-card. In this embodiment, layout-component 955-1 (objective) shows one objective of the enterprise: "OBJECTIVE: GROW CUSTOMER BASE". The enterprise can use multiple measures to planand track this objective. One measure that is assigned to the objective is shown in layout- 2002-013-EP component 955-2 (turnover): "TURNOVER IN EURO". An increase in turnover can be an indicator for customer base growth. Layout-components 955-3 (risk 1) and 955-4 (risk 2) show two risks that are assigned to turnover 955-2 because they may have impact on the enterprise's turnover: "RISK1: EXCHANGE RATE USD-EURO" and "RISK 2: NEW COMPETITOR". Fluctuations in currency exchange rates can heavily impact the turnover in the enterprise's home currency. New competitors entering the market can gain market share from the enterprise and also account for reduced turnover.

In this embodiment, layout-component 955-7 (table) is a table that includes cells to present values to and/or receive values from the user.

In the example of FIGS. 2A, 2B the first row of table 955-7 refers to the turnover in USD. Column A includes actual values. The actual value of the turnover in USD is "122" for a given period, such as the first two quarters of the business year). Column P includes the corresponding plan value, which is "125". Column T includes a target value for the turnover for the full business year). The column MV shows the (latest) measure-value "290" (also referred to as object-measure-value) for the corresponding target value "300" In the second row of table 955-7, column MV shows the impact of risk 1 on the target value "300". This indicates to the user that the impact of the currency exchange rate risk is currently assumed to reduce the target value "300" of the turnover by which leads to the measure-value "290" At T2, the situation has changed for the enterprise. For example, new competitors unexpectedly entered the market. The new competitors may use aggressive pricing to gain market share. The sales 2002-013-EP manager of the enterprise expects to lose customer orders to the new competitors. Therefore, the sales manager can make a probability analysis of the possible impact on turnover. The result of the probability analysis in column MV) corresponds to the impact of risk 2 on the target value. The computer recalculates the measure-value of the turnover by reducing the amount to "260" according to the risk 2 impact.

In the example of FIG. 2A, layout-component 955-6 (risk status) indicates the user that the sum of all risks assigned to the turnover exceeded a given threshold value Any other visual or audio representation of the risk status can be used (e.g.

bullets with different colours, icons, sound signals, etc.). At TI, the risk status 955-6 is still empty.

Preferably, the risk status of each measure is consolidated and results in a risk status (layout component 955-5) for target 955-1 itself. Therefore, at T2, risk status 955-5 is changed from empty to i, Any GUI supporting the features, of the present invention can be used. For example, the GUI can include further layout-components to represent score-cards, strategies, strategy, strategy-elements, perspectives, targets, objectives, risks, measures or any other layout-component that can be relevant for strategic enterprise management. The layout-components can have relationships defined by assignments, such as: perspective-to-score-card assignments, objective-toperspective assignments, measure-to-objective assignments, measure-to-target assignments and risk-tomeasure assignments. Any other assignment that supports strategic enterprise management may be defined. Values in table 955-7 can use other layout-components, such as 2002-013-EP input fields, output fields, rows, columns, etc. with appropriate navigation tools, such as scroll bars, data set selectors and drop-down menus.

The explanatory scenario refers to a business environment where one embodiment of the present invention is used to monitor the performance of an enterprise and facilitate decision making. Other scenarios relating to other environments, such as decision support in politics, conflict situations, buying/purchasing, medical treatment, etc., may be implemented by using alternative embodiments of the present invention.

FIG. 3 illustrates details of an implementation of a risk evaluation system according to one embodiment of the present invention. Hardware components of computer 900 (cf. FIGS. 2A, 2B) are illustrated by dashed lines/frames. Software components are illustrated by solid lines/frames.

As explained earlier in FIG. 1, input device 940 can be connected to memory 920 via bus 930.

Memory 920 stores at least one predefined risk 121 and at least one predefined object 111. Alternatively, risks and objects can be stored on different storage devices of computer system 999 (cf. FIG. Other possibilities of storage would be known to those skilled in the art'and thus arewithin the scope of the present invention. In one example, object 111 is a measure and has object measure-value 111-MV. In the example of FIGS. 2A, 2B, object measure-value 111-MV of object ill corresponds to the value in column MV of table 955-7 for turnover 955-2. Object 111 can also be a strategy, strategy-element, a perspective, an objective, a target; a measure or any other object that is used in strategic enterprise management. In other 2002-013-EP words, the present invention is not dependent on the meaning of any of the layout-components in FIGS. 2A, 2B.

When assigning 410 risk 121 to object 111, for example, memory 920 stores the assignment in a corresponding data structure, such as a relational database table, known by those skilled in the art. Risk 121 has at least one threat-level 121-TL. A threatlevel of a risk indicates how big the impact of the risk can be. The risk can have multiple threat-levels ranging, for example, from SMALL to BIG or from 0 to 4.

Referring back to the example of FIGS. 2A, 2B, the sales manager may enter via input device 940 a keyboard) probability 121-P of the at least one threatlevel 121-TL. In the example, probability 121-P refers to turnover measure 111. In case risk 121 has multiple threat-levels, the sales manager may enter a corresponding probability for each threat level, thus defining a probability distribution for the various threat-levels. After having received 420 probability 121-P of the at least one threat-level 121-TL, computer 900 calculates 430 object measure-value 111-MV by using probability 121-P of the at least one threat-level 121- TL and by using deviation-value 121-DV. Deviation-value 121-DV corresponds C1 to the at least one threat-level 121-TL and relates to object 111. Deviation-value 121-DV quantifies the impact of the corresponding threat-level 121-TL on the object measure-value 111-MV.

For example, deviation-value 121-DV has a value type, such as absolute number, absolute delta, percentage or percentage delta. In the example of FIG. 2A, target value "300" is reduced by risk 1 by an amount of Assuming that the reduction is caused by a single threat-level of risk 1, the corresponding deviationvalue would be: "290" as an absolute value, as an 2002-013-EP absolute delta, in percentage and in percentage delta. Preferably, deviation-value 121-DV is predefined in computer system 999 (cf. FIG. for example, in a customizing table of computer system 999.

Alternatively, a user, such as the sales manager, can define a deviation-value for each threat-level of a risk, when the risk is assigned to a specific object.

In one embodiment of the present invention, memory 920 receives probability 121-P via bus 930. In another embodiment, probability 121-P can be received from any computer or input device in computer system 999 (cf.

FIG. This includes also any computer that might be linked to computer 900 via the internet or any other network like WAN or LAN networks. Then, computer 900 re-calculates 430 object measure-value 111-MV by taking into account probability 121-P and deviation-value 121-DV. For example, an expectation-value can be calculated as a measure of risk impact for each risk.

Details of the re-calculation are explained in FIG. 3.

If multiple risks are assigned to an object, the impact of each risk on the object measure-value is taken into account when calculating the object-measurevalue. For example, the estimation-values of various risks assigned to the object can be added, averaged, weighted averaged or factored.

By making the impact of risks on measures apparent, the present invention allows the impact 'of risks on strategic measures of an enterprise to be considered in the strategic planning process of the enterprise.

FIG. 4 illustrates details of one embodiment of calculating 430 object-measure value 111-MV of object III by taking into account the impact of risk 121.

2002-013-EP Header 300-H of risk matrix 300 indicates that risk matrix 300 includes data to determine expectation value 121-EV of risk 121 (NEW COMPETITOR) that is assigned to object 111 (TURNOVER). In one embodiment of the invention the layout of risk matrix 300 can be part of a graphical user-interface for receiving risk data from a user. In the example of FIG. 4, risk matrix 300 has columns THREAT-LEVEL, DEVIATION-VALUE and

PROBABILITY.

For convenience of explanation, risk 121 has threat levels 121-TL (SMALL), 121-TL1 (MEDIUM) and 121- TL2 (BIG). Risk 121 can have any number of threatlevels with any value. A deviation-value is assigned to each threat level in column DEVIATION-VALUE with regards to the object measure-value 111-VM of object 111. In the exampled, the deviation-values have the value type (VT) percentage delta. Deviation-values 121-DV 121-DV1 and 121-DV2 correspond to the threat-values SMALL, MEDIUM and BIG, respectively. In column PROBABILITY, probabilities 121-P 121-Pl and 121-P2 risk matrix 300. In other words, according to risk matrix 300 the probability of threat-level SMALL that the achievable turnover is 8% less than the original target-value cf. FIG. 2B) is assumed to be 60% due to new competitors. The further rows of table matrix 300 for threat-levels MEDIUM and BIG are to be read the same way. Therefore, table-matrix 300 describes a probability distribution of the various deviation values thatcorrespond to the various threat-levels. In an alternative embodiment probabilities can also be received as non-percentage values that are automatically normalized by computer 900.

In the example, computer 900 determines expectation-value 121-EV by multiplying 432, 434, 435 2002-013-EP each probability 121-P 121-P1 121-P2 with the corresponding deviation-value 121-DV 121-DV1 121-DV2 respectively and by adding 436 the results of the corresponding RESULTS vector. In the example, expectation-value 121-EV equals -10% (of the target value), which corresponds to the risk 2 impact of in FIG. 2B.

computer 900 then adds the risk 2 impact to 'the measure-value "290" (cf. FIG. 2A) resulting in the recalculated measure-value "260" (cf. FIG. 2B).

FIG. 5 illustrates further details of memory 920 in one embodiment of the risk evaluation system of the present invention.

In one embodiment of the present invention, object 111 is a component of score-card 110. Score-card 110 can have further objects, such as measures, objectives, perspectives, targets or any other object relevant to strategic enterprise management. In one example, further object 112 is an objective. Objects in scorecard 110 can have hierarchical relationships with each other. In the example, object 111 (measure) is a child of further object 112 (objective). This is indicated by parent-child relation 150. Other combinations for relationships are possible, such as perspective-toscore-card relationships, objective-to-perspective relationships, measure-to-objective relationships, measure-to-objective relationships and risk-to-measure relationships. Any other relationship that supports strategic enterprise management may be defined. As known by those skilled in the art, hierarchical relationships can be stored in a hierarchy data structure. One embodiment of the hierarchy data structure can be a database table having parent-child data sets. Another embodiment can be a markup language 2002-013-EP file, such as an XML or XHTML file, where a tag hierarchy reflects the hierarchical relationships. For example, a tag representing further object 112 (parent) has a further tag representing object 111 (child).

Each object 111, 112 has its object measure-value 111-MV, 112-MV, respectively. In the example, risks 121, 123 are assigned Al, A2 to object 111 and result in the corresponding expectation-values 121-EV, 123-EV.

Risk 123 is also assigned A3 to further object 112 resulting in corresponding expectation-value 123-EV'.

Referring back to the scenario of FIGS. 2A, 2B, the sales manager is more likely in a position to estimate a probability distribution of multiple threat levels of the risk of NEW COMPETITORS than to estimate the expectation value that results from the probability distribution.

Preferably, risk 121 is a component of riskcatalogue 120. Risk-catalogue 120 can store further risks 122, 123. Each risk in risk-catalogue can be assigned to each object in score care 110 and each object can have each risk assigned to it.

Optionally, each object 111, 112 has a risk status 111-RS, 112-RS, respectively. The risk status of ,an object provides an aggregate view on the total impact of all risks assigned to the object. For example, risk status 111-RS of object 111 takes into account risk expectation-values 121-EV, 123-EV. In the- example of FIGS. 2A, 2B, a visualization of risk status 111-RS is presented to the user via layout-component 955-6. For example, in one implementation of an embodiment of the present invention risk status 111-RS is calculated 440 by comparing the total impact of risks assigned to object 111 with a predefined threshold value. In another implementation, risk status 111-RS is calculated 440 by using predefined rules. The 2002-013-EP predefined threshold values or rules are stored in rule-set 190. For example, rules in rule-set 190 can be dynamic by varying the threshold value depending on a certain base value, such as plan value, actual value or target value (cf. FIGS. 2A, 2B) or any other value that is relevant for the object and might be calculated by using the aforementioned values. Rule-set 190 can also include rules that describe the impact of risk-status 111-RS on further risk-status 112-RS of further object 112. Computer 900 calculates 450 further risk-status 112-RS by taking into account risk status 11-R.

Preferably, when calculating 450 further risk-status 112-RS, the total impact of risks 123-EV') assigned to further object 112 is also considered.

The risk status of an object provides an aggregate view on the impact of all risks assigned to the object.

By using relationships between various objects, the risk status of one object can impact the risk status of a further object, when the further object is a parent of the object. This provides a consistent overview of the impact of all risks on all objects within scorecard 110.

FIG. 6 illustrates an alternative embodiment of the present invention. A score-card 110, such as a balanced score-card (BSC), is provided by a strategic enterprise management component 710, such as the SEM BSC solution of SAP AG, and a risk catalogue 120 (RC) is provided by a risk management component, such as the SEM Risk Builder of SAP AG. For example, values of BSC objects can be derived 731 from business data 130 (BD) stored in a data warehouse 730, such as the Business Information Warehouse (BW) of SAP AG. The values of the BSC objects can be stored 713 in the data warehouse 730. By combining 712 a strategic enterprise management 2002-013-EP component 710 with a risk management component 720, the user is provided with a solution to better evaluate uncertainties related to risks that have impact on plan values for any object, such as strategy elements, perspectives, objectives, targets, measures, etc.

FIG. 7 illustrates aggregation of objects 111, 111' into similar object 111'' used in one embodiment of the present invention, wherein the objects 111, 111' and the similar object 111'' can belong to different scorecards 110, 110', 110'', respectively.

In one implementation, computer 900 (cf. FIG 1) provides multiple score-cards 110, 110', 110'' in memory 920. In another implementation, the score-cards 110, 110', 110'' can be distributed over multiple storage devices of computer system 999. For example, the functionality of score-cards 110', 110'' is substantially equivalent to the functionality of scorecard 110. In another implementation, the different score-cards can be stored in different storage locations of computer system 999 (cf. FIG. 1).

For example, each score-card 110, 110', 110'' stores at least one object 111, 111', ill'', respectively. Objects 111, 111', 111" are similar.

Similar, as used hereinafter, means that the objects are of the- same type strategy, strategy-element, perspective, objective, target, measure) and refer to the same instance of this type measure turnover).

Each object 111, ill', 111'' has a corresponding object measure-value 111-MV,,-MV', ll-MV''.

In one embodiment of the present invention, computer 900 aggregates 470 estimation-values of objects 111, 111' object measure-value 111-MV and indexed object measure-value 111-MV') into corresponding object measure-values of similar object 2002-013-EP 111'' corresponding object measure-value 111by using rule-set 190. That is, estimation-values of objects 111, 111' are processed according to rules defined in rule-set 190 and the result is written to the corresponding object measure-value of object 111'' For example, corresponding object measure-value Il- MV'' in score-card 110'' is the result of adding object measure-value 111-MV and indexed first 111-MV' of score-cards 110, 110'. Another rule of rule-set 190 may calculate corresponding object measure-value il-MV'' as the average or weighted average of object measurevalue 111-MV and indexed object measure-value 111-MV'.

A person e skilled in the art candefined further rules of rule-set 190 as they are requiredby an enterprise for strategic enterprise management. Multiple estimation-values can be aggregated in aggregation step 470 substantially simultaneously.

By aggregating objects of different score-cards into an object of another score-card, one embodiment of the present invention allows a manager to get a consolidated view of the strategic plan of an enterprise from a single score-card score-card 111").

FIGS. 8A, 8B illustrate steps of a risk evaluation method 400 according to one embodiment of the present invention. Method 400 may be executed by a computer, such as computer 900 (cf. FIG. 1) running CPP 100. In one embodiment of the present invention, CPP 100 has a plurality of instructions that cause processor 910 (cf.

FIG. 1) of computer 900 to execute the steps of method 400. CPP 100 can be stored on data carrier 970 (cf.

FIG. 1) or carried by signal 980 (cf. FIG. 1).

Method 400 includes (cf. FIG. 8A) the steps assigning 410, receiving 420 and calculating 430.

2002-013-EP Optionally, as illustrated by dashed frames, method 400 may further include steps providing 440 and aggregating 450. The calculating step 430, optionally includes (cf.

FIG. 8B) the further steps multiplying deviation-value 432, multiplying further deviation-value 434, adding 436 and adjusting 438.

In the assigning step 410, risk 121 (cf. FIG. 3) is assigned to object 111 (cf. FIG. Assignments can be defined by those skilled in the art using, for example, assignment structures, such as an assignment database table or hierarchical data structures as used in markup language documents XML-files, XHTMLfiles, etc.). In one implementation, risk 121 and object 111 are predefined. In another implementation, risk 121 and object 11 may be created in the assigning step. Object 111 can be selected from the group- of strategy, strategy-element, measure, objective, target, or any other object that is meaningful in strategic enterprise management.

Object 111 has object measure-value 111-MV (cf.

FIG. In a preferred implementation, object 111 is a component of score-card 110 (cf. FIG. 4) and risk 121 is a component of risk-catalogue 120 (cf. FIG. 4).

In the receiving 420 step, probability 121-P of the at least one threat-level 121-TL is received.

Probability 121-P refers to object 111. For example, a user can enter probability 121-P in risk matrix 300 (cf. FIG. 4) via an input-device, such as input-device 940 (cf. FIG. In another embodiment of the present invention, probability 121-P can be received from a computer computer 901, 902 cf. FIG. 1).

In the calculating 430 step, object measure-value 111-MV is calculated by using probability i21-P of the at least one threat-level .121-TL and by using deviation-value 121-DV. Deviation-value 121-DV 2002-013-EP corresponds Cl to the at least one threat-level 121-TL and relates to object 111. Preferably, deviation-value 121-DV has a value type (VT) selected from the group of absolute number, absolute delta, percentage and percentage delta. Preferably, deviation-value 121-DV is predefined in a data structure, such as a customizing table in a database. Alternatively, deviation-value 121-DV can be entered by a user, for example, when ,assigning risk 121 to object 111 or when entering probability 121-P.

FIG. 8B illustrates steps 432 to 438 being performed for calculating 430 object measure-value 111-MV in case of risk 121 having multiple threatlevels.

In the multiplying deviation-value step 432, deviation-value 121-DV is multiplied with probability 121-P.

In the multiplying further deviation-value step 434, at least further deviation-value 121-DV1 of further threat-level 121-TLl of risk 121 is multiplied with corresponding further probability 121-PI.

In the adding results step 436, the results of the multiplying steps 432, 434 are added. This results in expectation-value 121-EV of risk 121 with regards to object 111. In other words, expectation-value 121-EV refers to a value of object 111. Referring back to the example of FIG. 2B, the value of the object can be the plan value, actual value, target-value or measure-value or any other value that is calculated from these values.

In the adjusting step 438, object measure-value 111-MV is adjusted with expectation-value 121-EV. For example, if expectation-value 121-EV has value type delta percentage and equals -10% and refers to the 2002-013-EP target-value of object 111, then object-measure value 111-MV is reduced by 10% of the target-value.

In case of multiple risks being assigned to one object and each of the risks results in a corresponding expectation-value, a mathematical operation can be applied to the various risk expectation-values when adjusting the corresponding object measure-value.

Examples of the mathematical operation can be: adding, subtracting, dividing, multiplying, averaging, weighted averaging, linear regression or others that may be meaningful for a person skilled in the art.

Turning back to FIG. 8A, in the optional providing step 440, computer 900 provides at least further scorecard 110', wherein further score-card 110' is substantially equivalent to score-card 110. Score-card 110' has similar object 111', which is similar to object 111.

In the optional aggregating step 450, object measure-value 111-MV is aggregated into corresponding object measure-value 111-MV of similar object 111' according to rules of rule-set 190.

2002-013-EP Reference Description 100 Computer program product 110, 110', 110" Score-cards 120 Risk-catalogue 111, 111', 111, Objects 112 121, 122, 123 Risks xxx-MV Measure-value of an object xxx-RS Risk status of an object 190 Rule-set Ax Assignment risk-object 150 Assignment object-object 400 Method 4xx Method steps 955 Graphical user interface 955-x Layout components 999 Computer system 900, 901, 902 Computers 910, 911, 912 Processors 920, 921, 922 Memories 930 Bus 940 Input device 950 Output device 960 User interface 970 Program carrier (computer readable device) 2002-013-EP

Claims (9)

1. 2002-013-EP Claims 1. A method (400) for risk evaluation comprising the steps: assigning (410) a risk (121) to an object (111), wherein the object (111) has an object measure- value (111-MV) and the risk (121) has at least one threat-level (121-TL); receiving (420) a probability (121-P) of the at least one threat-level (121-TL), wherein the probability (121-P) refers to the object (111); and calculating (430) the object measure-value (111-MV) by using the probability (121-P) of the at least one threat-level (121-TL) and by using a deviation-value (121-DV) that corresponds (Cl) to the at least one threat-level (121-TL) and relates to the object (111).
2. 2. The method (400) of claim 1, wherein the deviation- value (121-DV) has a value type (VT) selected from the group of absolute number, absolute delta, percentage and percentage delta. 2002-013-EP
3. 3. The method (400) of claim 1 or 2, wherein the calculating step (430) further comprises the steps: multiplying (432) the deviation-value (121-DV) with the probability (121-P); multiplying (434) at least a further deviation- value (121-DV1) of a further threat-level (121-TL1) of the risk (121) with a corresponding further probability (121-P1); adding (436) the results of the multiplying steps (432, 434) resulting in an expectation-value (121-EV) of the risk (121) with regards to the object 111-MV; and adjusting (438) the object measure-value (111-MV) with the expectation-value (121-EV).
4. 4. The method (400) of any of the claims 1 to 3, wherein the object (111) is a component of a score- card (110).
5. 5. The method (400) of claim 4, comprising the further steps: providing (440) at least a further score-card wherein the further score-card (110'') is substantially equivalent to the score-card (110) and has a similar object which is similar to the object (111) of the score- card (110); and aggregating (450) the object measure-value (111-MV) into a corresponding object measure-value (111-MV'') of the similar object 2002-013-EP
6. 6. The method (400) of any of the claims 1 to wherein the object (111) is selected from the group of strategy, strategy-element, perspective, objective, target and measure.
7. 7. The method (400) of any of the claims 1 to 6, wherein the risk (121) is a component of a risk- catalogue (120).
8. 8. A computer program product (100) comprising a plurality of instructions for risk evaluation; the computer program product (100), when loaded into a memory (920) of a computer (900), causing at least one processor (910) of the computer (900) to execute the following steps: assigning (410) a risk (121) to an object (111), wherein the object (111) has an object measure- value (111-MV) and the risk (121) has at least one threat-level (121-TL); receiving (420) a probability (121-P) of the at least one threat-level (121-TL), wherein the probability (121-P) refers to the object (111); and calculating (430) the object measure-value (111-MV) by using the probability (121-P) of the at least one threat-level (121-TL) and by using a deviation-value (121-DV) that corresponds (Cl) to the at least one threat-level (121-TL) and relates to the object (111). 2002-013-EP
9. 9. The computer program product (100) of claim 8 comprising further instructions for executing the steps: multiplying (432) the deviation-value (121-DV) with the probability (121-P); multiplying (434) at least a further deviation- value (121-DV1) of a further threat-level (121-TL1) of the risk (121) with a corresponding further probability (121-P1); adding (436) the results of the multiplying steps (432, 434) resulting in an expectation-value (121-EV) of the risk (121) with regards to the object 111-MV; and adjusting (438) the object measure-value (111-MV) with the expectation-value (121-EV). The computer program product (100) of claims 8 or 9, wherein the object (111) is a component of a score-card (110). 11. The computer program product (100) of claim comprising further instructions for executing the steps: providing (440) at least a further score-card wherein the further score-card (110'') is substantially equivalent to the score-card (110) and has a similar object which is similar to the object (111) of the score- card (110); and aggregating (450) the object measure-value (111-MV) into a corresponding object measure-value (111-MV'') of the similar object 2002-013-EP 12. A risk evaluation system (999) comprising: at least one memory (920) for storing an object (111), a risk (121) and an assignment structure; at least one processor (910) for executing program instructions for assigning (410) the risk (121) to the object (111) using the assignment structure, wherein the object (111) has an object measure-value (111-MV) and the risk (121) has at least one threat-level (121-TL); a bus (930) for receiving (420) a probability (121-P) of the at least one threat-level (121-TL), wherein the probability (121-P) refers to the object (111); and the at least one processor (910) for executing program instructions for calculating (430) the object measure-value (111-MV) by using the probability (121-P) of the at least one threat- level (121-TL) and by using a deviation-value (121-DV) that corresponds (Cl) to the at least one threat-level (121-TL) and relates to the object (111). 2002-013-EP 13. The system (999) of claim 12, wherein for calculating (430) the object measure-value (111-MV) the at least one processor (910) executes program instructions to: multiply (432) the deviation-value (121-DV) with the probability (121-P); multiply (434) at least a further deviation-value (121-DV1) of a further threat-level (121-TL1) of the risk (121) with a corresponding further probability (121-P1); add (436) the results of the multiplying steps (432, 434) resulting in an expectation-value (121-EV) of the risk (121) with regards to the object 111-MV; and adjust (438) the object measure-value (111-MV) with the expectation-value (121-EV). 14. The system (999) of claims 12 or 13, wherein the object (111) is a component of a score-card (110) stored by the at least one memory (920). The system (999) of any of the claims 12 to 14, wherein the at least one memory (920) stores at least a further score-card wherein the further score-card is substantially equivalent to the score-card (110) and has a similar object which is similar to the object (111) of the score-card (110); and wherein the at least one processor (910) executes program instructions to aggregate (450) the object measure- value (111-MV) into a corresponding object measure- value (111-MV'') of the similar object 32 16. The system (999) of any of the claims 12 of wherein the risk (121) is a component of a risk- catalogue (120) stored by the at least one memory (920) 17. A method for risk evaluation, substantially as herein described with reference to the accompanying drawings. 18. A computer program product, substantially as herein described with reference to the accompany drawings. 19. A risk evaluation system, substantially as herein described with reference to the accompanying drawings. Dated this 13th day of February 2003 SAP AKTIENGESELLSCHAFT By their Patent Attorneys GRIFFITH HACK