DE102021211830A1 - Procedure for reviewing a complex regulatory situation - Google Patents

Abstract

The present invention relates to a method for checking a complex regulatory situation, comprising the following steps: - recording regulatory responses (RA) to regulatory questions (RF) from at least two individualized questionnaires (IF), correlating with individual regulatory situations, - comparing the recorded regulatory responses ( RA) with specific regulation specifications (RV) for each regulation question (RF), - determining specific fulfillment scores (SES) specifically for each individualized questionnaire (IF) on the basis of the comparison, - outputting the determined specific fulfillment scores (SES).

Description

The present invention relates to a method for checking a complex regulation situation, a computer program product for carrying out such a method and a checking system, also for carrying out such a method.

It is well known that there are complex regulatory situations for complex company situations. For example, internationally active companies can have different national companies in the respective countries, which develop and operate different software applications, IT processes, IT projects and associated infrastructures in the respective country. Such processes, projects and applications today have to meet different regulations depending on the type, country or region, but also depending on the type of company operating them. A possible example of a regulation in Germany is the so-called GDPR. However, other data protection regulations, security regulations, storage regulations or similar are also in force as individual regulations, which must be complied with depending on the type of application. As a result, companies that have complex corporate structures and are also active in several countries and work with different software applications have to comply with highly complex regulatory situations. In such cases, it must be ensured that every software application, in every country, from every operating company complies with the relevant regulations. These can vary from country to country, from company to company and from application to application. It is also not sufficient if a software application has been released for a regulatory situation once, since when the identical software application is used in another country, for example when users are extended from Europe to America, a completely new and at least partially different regulatory situation must be met. As a result, companies currently have to manually process these complex regulatory situations with a great deal of effort. It is therefore necessary for the relevant application managers and those responsible in the respective national companies to try manually to keep an overview of the existing software applications and to correlate them with the existing, but constantly changing, national and local regulatory situations. This leads to a considerable manual effort and also includes the risk that errors occur due to the purely manual processing or that individual areas are completely overlooked in the complex regulatory situation.

It is the object of the present invention to at least partially eliminate the problems described above. In particular, it is the object of the present invention to enable an automatic or at least semi-automatic evaluation and verification of a complex regulation situation in a cost-effective and simple manner.

The above object is achieved by a method having the features of claim 1, a computer program product having the features of claim 12 and a verification system having the features of claim 13. Further features and details of the invention result from the dependent claims, the description and the Drawings. Features and details that are described in connection with the method according to the invention also apply, of course, in connection with the computer program product according to the invention and the checking system according to the invention and vice versa, so that the disclosure of the individual aspects of the invention is or can always be referred to reciprocally.

• - Erfassen von Regulationsantworten auf Regulationsfragen aus wenigstens zwei individualisierten Fragebögen, korrelierend mit individuellen Regulationssituationen,
• - Vergleich der erfassten Regulationsantworten mit spezifischen Regulationsvorgaben für jede Regulationsfrage,
• - Bestimmen von spezifischen Erfüllungsscores, spezifisch für jeden individualisierten Fragebogen auf Basis des Vergleichs,
• - Ausgeben der bestimmten spezifischen Erfüllungsscores.

According to the invention, a method serves to check a complex regulation situation. To do this, such a procedure has the following steps:

• - Recording of regulation answers to regulation questions from at least two individualized questionnaires, correlating with individual regulation situations,
• - Comparison of the recorded regulation responses with specific regulation specifications for each regulation question,
• - Determination of specific fulfillment scores specific to each individualized questionnaire based on the comparison,
• - Outputting the determined specific fulfillment scores.

A method according to the invention allows the checking steps of a complex regulation situation to be automated or at least partially automated. Such a method is based in particular on another method which creates individualized questionnaires in an automated or semi-automated manner. However, manual creation of such questionnaires is also conceivable as a starting point for the present invention. As explained in the introduction, there are highly complex regulatory situations for companies, with the complexity being based in particular on the variation of three crucial parameters. It refers to Country parameters, application parameters and company form parameters. These three parameters have an influence on the respective individual regulatory situation. This will be explained in more detail below using an example. If a company wants to operate a software application for processing data and for communicating with end customers with the corresponding user data, this is a software application with a large number of defined application parameters. If this software application is to be operated by a company in a country, then this involves a company form, for example a stock corporation or a GmbH, and thus one or more company form parameters. Last but not least, the company, for example in Germany, is provided with one or more country parameters, for example the company country. Here it is already easy to see that with the same type of company and the same software application, a different country parameter, for example use and operation in the USA, leads to a different individual regulatory situation. As has already been indicated, at least one individualized questionnaire can be created in a preceding method on the basis of these input parameters in the form of country parameters, application parameters and/or company form parameters for each individual regulatory situation. Individualized questionnaires contain regulation questions, which then allow a check to be made with regard to the fulfillment of the respective individual regulation situation during the evaluation. Such a regulatory question can be, for example: "Is the stored user data located within the European Union?". This question is particularly relevant in this case

Yes/No question that can be easily answered. The result, i.e. which comparison should be carried out with which regulation specification, naturally depends on the respective individualized questionnaire.

A large number of individualized questionnaires for all software applications, all companies and all countries are now created with this preceding procedure, so that at least one individualized questionnaire is also available for each individualized regulation situation.

From this starting point for a method according to the invention, the regulatory responses can now be recorded in an automated, partially automated or manual manner. For example, these individualized questionnaires can be provided with regulatory responses and in this way, by scanning methods or the like, made available for recording by a method according to the invention. However, it is also possible for a method according to the invention to run web-based, so that a user of this method enters the regulatory answers to the regulatory questions on his or her terminal device and thus the possibility of recording on and/or from this terminal device exists. This allows the individualized questionnaires to be displayed on the end device and answered by the respective user, who can also be designated as the person responsible for the individual regulation situation.

Once the regulatory responses have been captured, the method of the invention can compare the captured regulatory responses to specific regulatory requirements for each regulatory question. Depending on the regulation question and also depending on the regulation answers, this can involve qualitative and/or quantitative comparisons. For example, in response to the yes/no regulatory question asked above, the regulatory requirement can be that the data stored in this individual regulatory situation must be stored within the European Union. The regulation answer recorded can be compared with this regulation specification, so that if the answer is "yes", it can be assumed that this regulation specification has been fulfilled and if the regulation answer is "no", it can be assumed that this regulation specification has not been met. Of course, it is already clear here that the regulation requirements for one and the same regulation question can turn out differently in the different individualized questionnaires. If, for example, the individualized questionnaire for this software application is designed for Europe, the regulation specification means that the data is stored in the EU. However, the same software application in the individual regulatory situation in the USA requires, for example, the storage of the data in the USA as a regulatory requirement. Here it is already easy to see that even complex situations can have conflicting regulatory requirements that cannot be resolved or can only be resolved with great difficulty. The individually recorded regulation answers are compared with correspondingly individually specific regulation specifications for each regulation question, and on the basis of this comparison specific fulfillment scores are determined for the individualized questionnaires. In other words, it becomes possible to determine the degree to which the individualized questionnaire fulfills the regulatory requirements in a specific way. For example, if not a single specific regulation requirement is met, the specific fulfillment score is 0%. If all regulation specifications are fulfilled according to the regulation responses recorded, the corresponding specific fulfillment score is 100%. Usually the real determined spec fish compliance score lies between these two extreme values. In the final step, the determined specific fulfillment scores are output.

The specific compliance scores determined and output now represent the verification results of the individual individual regulation situations. If this is desired or required, they can also be compared with compliance limit values. This can also be part of the method according to the invention, but can also be done manually afterwards. Such a comparison makes it possible to ensure that a desired degree of fulfillment for the respective individual regulatory situation is actually achieved. This can, for example, be of essential importance for a review or an audit of the respective company or group of companies. For example, the specification can be that within the European Union all companies with the software applications operated there must achieve a compliance score of at least 90% for all company forms. While the previous purely manual solutions required a great deal of effort in order to coordinate and compile the individual answers at all, a method according to the invention not only automates the correlation with the regulation specifications, but also simplifies this evaluation step, since a very simple and clear comparison can be made with the specific compliance scores for these requirements.

As has already been explained, the method according to the invention preferably runs web-based, for example on a server and a corresponding web platform. The individual users, for example the inputting users for recording the regulation responses, but also the users of the verification result after the output of the specific specific compliance scores, can access the input interface and/or the output interface of the method according to the invention on their input devices.

There can be advantages if, in a method according to the invention, the regulatory responses are recorded in a binary form, in particular as “yes” or “no”. In addition to the fact that a simple answer can be given by the responsible person during the recording, the subsequent comparison step is also significantly simplified, so that less computing effort is required for the comparison. An unambiguous and in particular purely qualitative statement is also possible with the comparison result, ie whether the regulation specification is fulfilled by the binary unambiguous answer or not. There is no room for interpretation in this embodiment, so that the security in the interpretation of the specific fulfillment scores determined and output can be further increased.

It is also advantageous if, in a method according to the invention, the comparison of the recorded regulation responses is carried out at least partially qualitatively. This can be carried out in addition to or as an alternative to the quantitative detection that will be explained later. In its simplest form, qualitative detection is the binary detection described above in the formation of yes/no answers. Here, too, interpretation-free processing with a computationally reduced comparison step is possible.

In addition or as an alternative to the qualitative evaluation, it is also possible for the comparison of the recorded regulation responses to be carried out at least partially quantitatively in the method according to the invention. For example, there can be numerical values in the recording, which are then compared quantitatively with quantitative specific regulation specifications. This can, for example, be the degree, in the form of the number of bits, of the encryption of data and entail a quantitative evaluation when recording and comparing. It is also already evident here that a combination of quantitative and qualitative comparisons is also possible, in particular for different regulation questions and correspondingly different regulation answers.

It is also advantageous if, in a method according to the invention, an overall fulfillment score for a group of individualized questionnaires and/or all individualized questionnaires is determined and output on the basis of the comparison, in particular on the basis of the determined specific fulfillment scores. In addition to specific information, this makes it possible to create and output overall information, which can be evaluated in addition to individual fulfillment. The group of individualized questionnaires can have a thematic reference, for example. In this way, an overall fulfillment score for all companies in a country, all software applications in a company or the like can be grouped and output additional information. It is also possible to issue the overall fulfillment score company-wide and thus possible for all individualized questionnaires. A combination of subgroups and all individualized questionnaires is also fundamentally conceivable here.

• - Vergleich der Regulationsantworten,
• - Kombination der Regulationsantworten,
• - Verifikation der Regulationsantworten.

Further advantages can be achieved if, in a method according to the invention, at least one of the following steps is carried out when at least two regulatory responses for a regulatory question are recorded, in particular in two different individualized questionnaires:

• - comparison of regulatory responses,
• - combination of regulatory responses,
• - Verification of the regulatory responses.

The above list is a non-exhaustive list. It is possible that for one and the same software application one and the same regulation question is relevant for different countries, and thus in different individual regulation situations, so that this regulation question is also contained in two different individualized questionnaires and has to be answered by different responsible persons. As mentioned in the example in the opening description, the respective regulatory response can be the same if, for example, a central server is specified as the storage location within the European Union for user data in a software application. It is now possible, when entering regulation responses for this software application from France and Germany, for these two separately given regulation responses to be recorded separately from one another and then compared. If these two regulatory responses match, a stronger weighting with higher confidence in this regulatory response can be used. It is also possible in this way to verify regulation responses and to identify incorrect regulation responses or improbable regulation responses as such. The combination of regulatory responses, especially if they are quantitative, is fundamentally possible here.

Further advantages can be achieved if, in a method according to the invention, the results of the comparison are weighted for at least one regulatory response when determining the specific compliance scores. Such a weighting can, for example, form a basis for the accuracy of the specific fulfillment score. Such a weighting can also take into account the trustworthiness of the respective regulation response, as explained in the preceding paragraph. It is also possible to weight the regulation response differently if the regulation response is a zero value, ie a missing regulation response as the detection result.

In addition, it is advantageous if, in a method according to the invention, based on the comparison of the regulation question with empty regulation answers, these are recorded as gaps and output in addition to the specific fulfillment scores. Again, this can be done quantitatively or qualitatively. A reference to the respective fulfillment score is also possible. An output takes place in particular when the fulfillment score is below a certain limit, that is to say, for example, is too low, so that an indication can be given as to which regulation questions have not yet been provided with a regulation answer at all. On this basis, it is also possible to output action instructions which, in addition to the specific fulfillment scores, show where regulation answers are still missing and/or where an adjustment of the application is necessary.

It is also advantageous if, in a method according to the invention, the steps of comparison, determination and/or output take place at the same time as the detection. In particular, when a manual input is recorded on a user's terminal device, the steps of comparison, determination and output can be carried out at the same time, so that the specific fulfillment score developing in real time is displayed to the respective user after the output . He therefore recognizes the effects of his current input, since this input is recorded and processed directly. The effect of the response recording is therefore directly visible and thus increases user acceptance.

In a method according to the preceding paragraph, it is advantageous if the sequence of the regulatory responses to be detected is adjusted during the detection on the basis of the comparison and determination steps. This makes it possible to highlight which data is still missing in the form of regulation responses, particularly when individual missing regulation responses have a high weighting. This makes it possible to exceed the desired necessary limit of a specific fulfillment score with a reduced number of regulatory responses that are still missing. In other words, the order in which the individualized questionnaires are recorded and processed can be adapted to the existing evaluation and verification situation in real time. This is only possible if individual steps can be carried out simultaneously, preferably in real time, due to the automated design of a method according to the invention.

It is also advantageous if, in a method based on the Steps of comparing and determining the individualized questionnaires are adjusted. In addition to simply changing the order of existing regulation questions, if/then links can also be integrated into this adjustment. For example, it is possible to provide different regulation questions with dependencies in the individual questionnaire, which are activated or deactivated during the recording of the regulation answers. If, for example, the answer to the sample question about the location of the storage of user data is given as the European Union, it may no longer be necessary to specify the type of encryption of the data storage, depending on the regulatory situation. If storage outside the European Union is specified, it may be decisive in the assessment of the regulatory requirement in the comparison step for compliance with a corresponding regulatory situation whether the encryption meets a certain minimum standard. This if/then link can be integrated into this automated evaluation of the process and thus also adapt the recording steps in an individualized way flexibly and in real time.

The present invention also relates to a computer program product, comprising instructions which, when the program is executed by a computer, cause the latter to execute a method according to the invention. A computer program product according to the invention thus brings with it the same advantages as have been explained in detail with reference to a method according to the invention.

In addition, the subject matter of the present invention is a checking system for checking a complex regulation situation. Such a checking system has a recording module for recording regulation answers to regulation questions from at least two individualized questionnaires, correlating with individual regulation situations. In addition, a comparison module is provided for comparing the recorded regulation responses with specific regulation specifications for each regulation question. The verification system also includes a determination module for determining specific compliance scores specific to each individualized questionnaire based on the comparison. Finally, an output module is provided for outputting the specific fulfillment scores determined. The detection module, the comparison module, the determination module and/or the output module is designed to carry out a method according to the invention, so that the checking system brings with it the same advantages as have been explained in detail with reference to a method according to the invention. Such a verification system is in particular integrated into a communication network, so that it can use a web platform as a basis. The individual modules are preferably integrated centrally in a server, with local method steps being able to be carried out, for example on input devices and/or output devices as user terminals. It is crucial that the individual modules are designed for automatic or semi-automatic execution.

• 1 eine Ausführungsform eines vorgelagerten Verfahrens zur Erstellung eines individuellen Fragebogens,
• 2 ein mögliches Beispiel für individuelle Fragebögen,
• 3 ein Ablauf eines erfindungsgemäßen Verfahrens,
• 4 ein weiterer Ablauf eines erfindungsgemäßen Verfahrens,
• 5 eine Möglichkeit eines Erfassungsschrittes,
• 6 eine weitere Möglichkeit eines Erfassungsschrittes.

Further advantages, features and details of the invention result from the following description, in which exemplary embodiments of the invention are described in detail with reference to the drawings. The features mentioned in the claims and in the description can each be essential to the invention individually or in any combination. They show schematically:

• 1 an embodiment of an upstream method for creating an individual questionnaire,
• 2 a possible example for individual questionnaires,
• 3 a sequence of a method according to the invention,
• 4 another sequence of a method according to the invention,
• 5 a possibility of a capture step,
• 6 another possibility of a detection step.

1 shows schematically how an individualized questionnaire IF can be set up in a preceding method via the collection of country parameters LP, application parameters AP and company form parameters GP. This contains a large number of regulation questions RF, which reflect the correspondingly individualized regulation situation. An example of such an individualized questionnaire IF is shown in 2 . The individual regulation questions RF are in the form of yes/no questions (y/n). They are also combined with the relevant country parameter LP, application parameter AP and company form parameter GP. A responsibility value VW is also assigned to ensure which user is responsible for entering the regulation response RA. Here, an additional splitting into three individualized questionnaires IF can take place, which correspond to different countries and thus also different ones chen responsible as a responsibility value can be assigned to VW.

In the 3 a sequence of a method according to the invention is shown schematically. The verification system 10 is commissioned to carry out the method using the example of two different individual questionnaires IF. On a web platform, users can log in with their respective end device and call up the questionnaire IF customized for them. In this embodiment of the 3 now use two different users terminals to access the verification system 10. The first user receives the upper individual questionnaire IF customized for him, while the other user receives the lower customized questionnaire IF. Both can provide the regulation questions RF with regulation answers RA on their terminals. This makes it possible to capture these input regulation responses RA at this capture interface using the capture module 20 of the verification system 10 . The recorded regulation responses RA are passed on to a comparison module 30, which now has a defined regulation specification RV specific to the respective individual questionnaire IF for each individualized questionnaire and thus for each recorded regulation response RA for each regulation question RF, and carries out a comparison. This can be quantitative or qualitative and brings with it a comparison result, so that a specific fulfillment score SES can then be formed for each individualized questionnaire IF on the basis of the large number of comparison results. This takes place in the determination module 40. In the example of FIG 3 a specific fulfillment score SES is thus determined for two individualized questionnaires IF specifically for each of these two individualized questionnaires IF and finally output by the output module 50 . The output can again be sent to the end devices of the users, so that each user receives his specific fulfillment score SES specifically for his individualized questionnaire IF.

The 4 shows a development of the embodiment of FIG 3 . However, a combination of the individual specific fulfillment scores SES is now also carried out here. These are combined into an overall fulfillment score GES, so that a statement can also be made as to what the overall fulfillment situation looks like in addition to the individual fulfillment situation. The specific fulfillment scores SES therefore provide feedback on the specific fulfillment of the individual regulation situation, while the total fulfillment score GES provides information on the degree of fulfillment of the complex overall regulation situation.

The 5 and 6 show another variant of how these can be treated without a regulation response RA in the case of purely binary regulation responses RF. For example, when filling out a situation can arise in which a user cannot give a regulation answer RA to a regulation question RF. This can be according to 5 then be defined as a defect FS. Nevertheless, it is possible to determine and output a specific fulfillment score SES on the basis of the given regulation responses RA. However, in addition according to the 6 . A lack of a regulation response RA in the form of a vacancy FS means a worse situation than non-fulfilment of the same regulation question.

The above explanation of the embodiments describes the present invention exclusively in the context of examples. It goes without saying that individual features of the embodiments can be freely combined with one another, insofar as this makes technical sense, without departing from the scope of the present invention.

Reference List

10

verification system

20

acquisition module

30

comparison module

40

determination module

50

output module

RF

regulation issue

RA

regulatory response

RV

regulatory requirement

FS

void

IF

individualized questionnaire

gp

weight parameter

SES

specific fulfillment score

TOTAL

Overall Fulfillment Score

LP

country parameters

AP

application parameters

gp

company form parameters

VW

accountability value

Claims (13)

A method for reviewing a complex regulatory situation, comprising the following steps: - Recording of regulation answers (RA) to regulation questions (RF) from at least two individualized questionnaires (IF), correlating with individual regulation situations, - Comparison of the recorded regulation answers (RA) with specific regulation specifications (RV) for each regulation question (RF), - Determination of specific fulfillment scores (SES) specific to each individualized questionnaire (IF) based on the comparison, - Outputting the determined Specific Fulfillment Scores (SES). procedure after claim 1 , characterized in that the regulation responses (RA) are recorded in a binary form, in particular as “YES” or “NO”. Method according to one of the preceding claims, characterized in that the comparison of the recorded regulation responses (RA) is carried out at least partially qualitatively. Method according to one of the preceding claims, characterized in that the comparison of the recorded regulation responses (RA) is carried out at least partially quantitatively. Method according to one of the preceding claims, characterized in that on the basis of the comparison, in particular on the basis of the specific fulfillment scores (SES) determined, an overall fulfillment score (GES) for a group of individualized questionnaires (IF) and/or all individualized questionnaires ( IF) is determined and output. Method according to one of the preceding claims, characterized in that when at least two regulatory responses (RA) are recorded for a regulatory question (RF), in particular in two different individualized questionnaires (IF), at least one of the following steps is carried out: - Comparison of the regulatory responses (RA) - Combination of the regulation responses (RA) - Verification of the regulation responses (RA) Method according to one of the preceding claims, characterized in that when determining the specific fulfillment scores (SES), the results of the comparison are weighted for at least one regulatory response (RA). Method according to one of the preceding claims, characterized in that on the basis of the comparison of the regulation questions (RF) with empty regulation answers (RF) these are recorded as gaps (FS) and output in addition to the specific fulfillment scores (SES). Method according to one of the preceding claims, characterized in that the steps of comparison, determination and/or output take place at the same time as the detection. procedure after claim 9 , characterized in that the order of the regulatory responses (RA) to be detected is adjusted during the detection on the basis of the steps of comparison and determination. Procedure according to one of claims 9 or 10 , characterized in that based on the steps of comparison and determination, the individualized questionnaires (IF) are adjusted. Computer program product, comprising instructions which, when the program is executed by a computer, cause the computer to carry out a method with the characteristics of one of Claims 1 until 11 to execute. Checking system (10) for checking a complex regulation situation, having a recording module (20) for recording regulation answers (RA) to regulation questions (RF) from at least two individualized questionnaires (IF), correlating with individual regulation situations, a comparison module (30) for comparison the recorded regulation responses (RA) with specific regulation specifications (RV) for each regulation question (RF), a determination module (40) for determining specific fulfillment scores (ES) specifically for each individualized questionnaire (IF) on the basis of the comparison and an output module (50) for outputting the specific specific fulfillment scores (SES), wherein the detection module (20), the comparison module (30), the determination module (40) and / or the output module (50) for performing a method with the features of one of Claims 1 until 11 is trained.

Images