text:
"Ah jeez…where's all this violence comin' from, man? Is it the video games? I bet it's the video games." ~ The Radioman, from Spec Ops: The Line
Mild spoilers for the game to follow, though nothing overtly pertinent to the plot. Still, if you haven't played yet and want to go in blind, here's the short version: this is an important game and you should go buy it.
Joseph Conrad's Heart of Darkness was published in 1902. It dealt with the brutality and confusion of colonial-era Africa.
In 1979, Francis Ford Coppola adapted the book in his film Apocalypse Now, which examined the senselessness of the Vietnam War.
The novel became a film, and the horrors were transposed into a new medium.
It's only fitting, then, that in 2012 this story would take place in the Middle East and be told in a video game.
There are many allusions throughout 2K's violent third-person cover-shooter to both Heart of Darkness and Apocalypse Now.
Captain Martin Walker shares his first name with Martin Sheen, the actor who plays Captain Benjamin Willard in the film. The mysterious Colonel Konrad in Spec Ops: The Line takes his name from Joseph Conrad, and of course bears a resemblance to Heart of Darkness antagonist, Kurtz (described as a painter and a genius in the book) as well as Colonel Kurtz from Apocalypse Now. The ubiquitous Radioman dogging your footsteps throughout the game bears an uncanny resemblance to Dennis Hopper's reporter from Apocalypse Now.
And yet, the game is no more a remake of either of these works than Apocalypse Now was a remake of Heart of Darkness. Coppola's film borrowed thematically from Conrad's book and then built its story around the skeletal frame of its plot, but it remained unique – a separate and fundamentally different piece of work. Partly this is because film can tell stories in ways that novels cannot, and vice versa.
Spec Ops: The Line is very much its own story as well, with its own twists and unique commentary on war and violence and what it means to be a hero, telling its story in ways that only a video game can.
The Good
I realized early on that this game was going to be good.
Graphics aren't everything, but the visuals are not only stunning, they're vibrantly colorful. Shooters these days are often brown and gray, sapped of color and detail. Spec Ops: The Line is not merely detailed, it's bright. The buried city of Dubai, adrift in an endless sandstorm, is in turns alive with brilliant blue skies and yellow sand, and awash in the lurid crimson of the dead.
Meanwhile, the actual game mechanics are extremely fluid. I've played quite a few third-person cover-shooters at this point, and to be quite honest I find most of them lacking. The Line's combination of squad-based tactics and run-and-gun vs. stealth options, combined with straightforward controls that were easy to learn and utilize, makes the gameplay itself gratifying, even as the story becomes increasingly dark…and weird.
It wasn't until probably about halfway through the game that I realized it was going to be great. I had no idea what to expect going in, and like many people expected your typical shot of adrenaline and testosterone.
A great shooter is hard to find. Few games carve out a space the way Half-Life 2 or BioShock did, or inspire me to actually finish playing the way the first Halo inspired.
Most shooters hew more closely to something like Call of Duty or Battlefield. Mindless plots and mindless killing. These things do have their place, of course, and I enjoy the skill required to actually do well in a shooter, especially in their entirely plot-free multiplayer modes. But the fact that this game isn't mindless isn't just a breath of fresh air.
By the time I'd finished the game, I'd realized something else: not only was it a great game, it was an important game.
The Line is important in the way we look, not just at violence in games or the horrors of war, but in what we expect out of our video games in the first place. What sort of writing have we come to expect? What sort of acting? What happens to these expectations when a developer comes out with a game that really raises the bar?
Most importantly, Spec Ops: The Line shows us how video games can tell stories in truly unique ways. There is a great deal about the game that's "cinematic" and while it has some very murky moral choice for you and your Captain Walker to make, it's largely a linear experience. But by immersing players into the game, by handing over these hard choices to the player, The Line is able to tell a story in a way that no other medium could.
While I can see how the game could easily be adapted to the Silver Screen, I don't think it would resonate in the same way it does with you pulling the trigger – both figuratively and literally.
Those moments of doubt and that sick feeling you get in your stomach when deciding how to proceed simply wouldn't exist in a film. Nor would those uncomfortable feelings be so closely juxtaposed to the many enjoyable moments of shooting through wave after wave of enemy soldiers.
That same sense of uneasiness is present throughout the game. The mysterious Radioman and his DJ routine, guiding enemies toward you in between loud rock-and-roll music; the beauty of the buried city of Dubai; the growing sense that something just isn't right – all of this creates a palpable sensation of distrust. As your narrator becomes increasingly unreliable, the world around you starts to feel paper-thin, almost illusory.
Your choices start to feel almost pointless – which is, of course, by design.
"The concept we currently have of player agency [in most video games] is that since I'm the player and I'm the hero and this world revolves around me, it has to react however I want it to react," lead writer Walt Williams told Ars Technica. "If I want to be the good guy, it has to back up my choice and let me be the good guy. And that's just not the way the world works. … We wanted the choices in the game to be realistic in that you walk into them and you don't know all the information. You simply know what's going on in front of you and you have an idea of what you can do… yeah it's going to go a particular way based on what you've done, but ultimately there's more information than you know."
Next Page: The Bad and The Ugly
- Page 1 / 2
- Continue


text:
Home Future StudentsCurrent StudentsFaculty & StaffPatientsAlumni
A-Z | Portals | Course Login | Web Mail
We hope you'll find the process of getting admitted to the university to be easy and convenient. Online application and information links give you what you need when you need it. We also have professional staff who want to assist you along the way.
Your pathway for admission to the university varies according to your educational goals and experiences. Here are the essential links to get in.
Are you preparing for college or ready to apply as a freshman, transfer, nursing or former CU Denver student?
Pre-college students - it's never too soon to prepare for college!
Freshmen - learn what to do if you're a first time college student
Transfer students - make your transfer to CU Denver smooth and successful
Nursing students - study nursing at the Anschutz Medical Campus
Former CU Denver students - requirements for readmission
CU Denver awards more graduate degrees than any other Colorado institution. Join us and bring your education and career to the next level.
Learn about our master's degree programs
There are seven highly ranked doctoral programs offered at the Denver Campus. Information about health-related doctoral degrees is available on our health programs page.
Admissions for our doctoral programs on the Denver Campus
Admissions for our doctoral programs on the Anschutz Medical Campus
Are you an aspiring nurse, doctor or researcher? Our health programs are among the most prestigious and selective in the country.
Search our health programs for a rewarding and challenging career
CU Denver provides orientation and special services to international and domestic students, scholars, faculty, staff and the greater Denver community.
Explore the services offered by the Office of International Affairs
Looking to sharpen your knowledge base or skill set? CU Denver has many resources for nondegree seeking students.
Learn more about enrolling as a nondegree student
© The Regents of the University of Colorado, a body corporate. All rights reserved.
All trademarks are registered property of the University. Used by permission only.

subset: commoncrawl


text:
Attention fellow Austinites!
Stop by this gluten-free fair tomorrow (Saturday, January 12) at Whole Foods Gateway from 12 p.m.-3 p.m.
The event is called Bootin' the Gluten and the details are below. Locate Special Diet will be there and many other local vendors. Make sure and ask the concierge for their gluten-free grocery list; which is updated frequently and different for each Whole Foods location. They make shopping gluten-free easy!
The Bootin' the Gluten Fair on Saturday will feature live music, product samples, store tours and more.
FREE goodie bags will be given to the first 100 customers!
From noon – 3pm, shoppers will enjoy Store-Wide Product Sampling of gluten free products in every department, and will be able to meet the vendors of their favorite gluten-free products, while enjoying live music on the patio by Vanessa Lively.
Other events include:
Noon – Bootin' the Gluten Store Tour, Learn about products in every department, space is limited, call 512-345-5003 to RSVP
Noon-2 pm – Kids Club games & activities on the patio
2pm – Bootin' the Gluten Gift Basket Drawing!
Disclaimer: Thanks for the <free> goodie bag, Whole Foods! They are a great organization, and I always support places or products that make it easier to live the gluten-free lifestyle. Make sure and stop by the event if you are in Austin!


text:
Does Exclusive Breastfeeding Matter? Yes.
We all need bacteria (also called flora) in our digestive tract to help our immune system work and get the most energy from our food, babies are the same! Your baby has a sterile gut until birth - that means her digestive tract is a blank slate.
A vaginally delivered baby gets exposed to mom's good bacteria during the birth process – thanks mom! A c-section baby will get his first dose of bacteria from the environment – microbes may come from the nurses and other babies in close proximity.


text:
Year of publication
- 2012 (3) (remove)
- Cellular models of aging (2012)
- Deceleration of fusion–fission cycles improves mitochondrial quality control during aging (2012)
- Mitochondrial dynamics and mitophagy play a key role in ensuring mitochondrial quality control. Impairment thereof was proposed to be causative to neurodegenerative diseases, diabetes, and cancer. Accumulation of mitochondrial dysfunction was further linked to aging. Here we applied a probabilistic modeling approach integrating our current knowledge on mitochondrial biology allowing us to simulate mitochondrial function and quality control during aging in silico. We demonstrate that cycles of fusion and fission and mitophagy indeed are essential for ensuring a high average quality of mitochondria, even under conditions in which random molecular damage is present. Prompted by earlier observations that mitochondrial fission itself can cause a partial drop in mitochondrial membrane potential, we tested the consequences of mitochondrial dynamics being harmful on its own. Next to directly impairing mitochondrial function, pre-existing molecular damage may be propagated and enhanced across the mitochondrial population by content mixing. In this situation, such an infection-like phenomenon impairs mitochondrial quality control progressively. However, when imposing an age-dependent deceleration of cycles of fusion and fission, we observe a delay in the loss of average quality of mitochondria. This provides a rational why fusion and fission rates are reduced during aging and why loss of a mitochondrial fission factor can extend life span in fungi. We propose the 'mitochondrial infectious damage adaptation' (MIDA) model according to which a deceleration of fusion–fission cycles reflects a systemic adaptation increasing life span.
- A differential genome-wide transcriptome analysis : impact of cellular copper on complex biological processes like aging and development (2012)
- The regulation of cellular copper homeostasis is crucial in biology. Impairments lead to severe dysfunctions and are known to affect aging and development. Previously, a loss-of-function mutation in the gene encoding the copper-sensing and copper-regulated transcription factor GRISEA of the filamentous fungus Podospora anserina was reported to lead to cellular copper depletion and a pleiotropic phenotype with hypopigmentation of the mycelium and the ascospores, affected fertility and increased lifespan by approximately 60% when compared to the wild type. This phenotype is linked to a switch from a copper-dependent standard to an alternative respiration leading to both a reduced generation of reactive oxygen species (ROS) and of adenosine triphosphate (ATP). We performed a genome-wide comparative transcriptome analysis of a wild-type strain and the copper-depleted grisea mutant. We unambiguously assigned 9,700 sequences of the transcriptome in both strains to the more than 10,600 predicted and annotated open reading frames of the P. anserina genome indicating 90% coverage of the transcriptome. 4,752 of the transcripts differed significantly in abundance with 1,156 transcripts differing at least 3-fold. Selected genes were investigated by qRT-PCR analyses. Apart from this general characterization we analyzed the data with special emphasis on molecular pathways related to the grisea mutation taking advantage of the available complete genomic sequence of P. anserina. This analysis verified but also corrected conclusions from earlier data obtained by single gene analysis, identified new candidates of factors as part of the cellular copper homeostasis system including target genes of transcription factor GRISEA, and provides a rich reference source of quantitative data for further in detail investigations. Overall, the present study demonstrates the importance of systems biology approaches also in cases were mutations in single genes are analyzed to explain the underlying mechanisms controlling complex biological processes like aging and development.


text:
Monday, January 14, 2013
The Fort Dorchester boys basketball team earned a big win Friday.
The Patriots defeated Wando 51-48 to improve to 4-2 on the season. The Warriors fell to 8-3.
The teams ended the first period in a 12-all tie and then Wando took a two-point advantage into the half. The Warriors extended the lead to six but the Patriots rallied, outscoring Wando 16-7 in the final period to notch the win.
Fort Dorchesters Eric Heyward led all scorers with 20 points while Baptiste Staggers added 10 for the Patriots.
The Fort girls lost 49-39 to drop to 1-5 on the season. The Fort only trailed 16-14 at the half, but Wando outscored the Fort 33-24 in the second half.
Wandos Tessa Akers led all scorers with 14 points as the Lady Warriors improved to 5-2.
Leah Robinson led the Lady Patriots with 10 points while Erika Martin added 9 and Erika Cobb added 8.
The Journal Scene is pleased to offer readers the enhanced ability to comment on stories. We expect our readers to engage in lively, yet civil discourse. We do not edit user submitted statements and we cannot promise that readers will not occasionally find offensive or inaccurate comments posted in the comments area. Responsibility for the statements posted lies with the person submitting the comment, not The Journal Scene.
If you find a comment that is objectionable, please click "report abuse" and we will review it for possible removal. Please be reminded, however, that in accordance with our Terms of Use and federal law, we are under no obligation to remove any third party comments posted on our website. Read our full terms and conditions.
© 2015 The Journal Scene an Evening Post Industries company. All Rights Reserved.
Registration on or use of this site constitutes acceptance of our Terms of Service, Privacy Policy and Parental Consent Form.


text:
I originally posted this as a reply but thought I'd add it as a new post as I think this may help a lot of people. - I'd like to add also that some people are taking asprin to help with BP I believe this risky - as it can cause Abrupto Placentia which is very serious (read up about this) Asprin is one of the found causes. As always take care ALL! (I'd like to add that in some cases I realize low dose therapy for help in preventing pree. symptoms may help - and in those who take it to help prevent blood clot.) - Vitamin E is a natural antithrombin to help prevent clots. - If you like ask your dr. about it for this purpose perhaps, if you perfer a more natural approach.
For basic overall health here's some of my personal suggestions in relation to pregnancy and bp as well:
The best thing you can do is make sure you have a perinatologist or atleast if you keep a regular OB seek also a 2nd opinion of a perinatologist OB dr. so you get the best dr. advice possible. Research Preeclampsia as best as possible, stop working if you are working (if you feel this is necessary to your health and if possible - push for it if need be) - try to get state disability payments tell your dr. you want it. Or if you are already not working that is good, - the least activity the better - check with your dr. about what physical activity might be beneficial for your bp. - if you don't agree, if activities make you feel worse, get a 2nd opinion.
I suggest a balanced diet of protiens like Chicken, Turkey, lean Beef, and Salmon. Fruits and Vegetables (raw is actually better for you) and calcium is very important milk, rice milk, and occasional soy milk, yogurt (add granola on top) and occassional cheese.
- On a further note anyone In the mood for Italian?? [;)] Wanted to add: Garlic (when crushed contains allicin (avail. in capsules too) ) is good for the heart and in preventing blood clots and lowering cholesterol/blood pressure, reduce risk of developing atherosclerosis (hardening of arteries), & also can kill organisms like bacteria and viruses; Oregano (spice on about every spice rack) is helpful in lowering blood pressure as well among other things like antibacterial actions and a digestive aid.(This info. taken from "Recipes from the Herbal Kitchen" by Prevention health books' Editors.) Check with you dr if these might be okay for you. -
Avoid refined sugars (don't overload on holiday treats), avoid as much as possible unnecessary artificial flavors or preservatives (check your ingredient labels for these especially: Phenanyline(in gum usually), aspartame (diet foods/no sugar added, and gum usually have this), MSG (Monosodium Glutimate usually in chips or frozen foods), BHT (a perservative usually in frozen foods and cereals), and Sodium Nitrite (usually in lunch/deli meats and hotdogs)). These are unnecessary toxins your body does not need.
Do not add extra salt to your food. Avoid high sodium foods - usually snack foods, processed or frozen foods. Avoid Frozen T.V. dinners as much as possible, and processed lunch meats or cheese - usually more sodium and additives than healthy prepared meals. - but do not avoid salt in foods entirely - as your body needs the sodium also.
Ask your Doctor first but I would add these vitamins to your daily prenatal vitamin regimin:
- Vitamin C 250 or 500mg (look for one with bioflaviniods)
- Vitamin E 200IU or 400 IU (ask for all natural vit.E Double check but I think it should be d-alpha derieved not dl-alpha)
- Calcium/Magnesium complex supplement
lacking these vitamins are possibly related to increase of bp and I suggest them - as they can help even if they may not prevent pree. completely.
{Here's my information on these vitamins}:
Vit.C:antioxident, helps build immune system, and promotes healing.
Calcium for instance helps:heart rhythm, promotes restful sleep, nerve muscle function, and normal blood pressure.
Magnesium:regulates heart rhythm and converts blood sugar.
Vitamin E: besides being an antioxidant,it's an antithrombin, it also decreases the oxygen requirements of muscles, helps prevent scar tissue production, and is a dilator of blood vessels (opening up new pathways in damaged circulation)- {info. taken from this book: "Instant Health The Nature Way": Dr.Shute says regarding Vit. E ..."key both to the prevention and treatment of all those conditions in which a lack of blood supply due to thickened or blocked blood vessels or a lack of oxygen is a factor.."
*Also for a healthy nervous system make sure you're getting adequate amounts of B vitamins and are not deficient - This is important as well and can be aquired in a balanced diet if not supplemented.
And don't forget your water intake - 8-10 glasses a day.
Remove as much stress from your life as possible (if you have any) - and if the stress continues seek to talk with a counselor or someone from church.
I suggest a yoga video you can use in your own home (make sure it is for pregnancy/relaxtion - no power yoga stuff) This is also good for relaxation techniques when you feel your bp rising.
If you don't have this book already I personally like What to Expect When your Expecting- I have a current version of the book, yet not all including myself reccomend it as being thorough in regards to PIH/Pree. It has information on many overall basic pregnancy info. it only contains brief discription of PIH/Pree. always research further for more info regarding Pree. as well -
This book does contain info on Complementary and Alternative Medicine (CAM) that may interest some thoughpage 246-
A chiropractor, or massage could be beneficial for pregnancy also but it definitely has to be in the right hands so look into these dr.s first that know the do's and don'ts of massage during pregnancy - as massage can trigger contractions if the abdomen (massage lightly only) or feet and ankles or webbing between the thumb and index finger are massaged and don't use aroma therpy oils - they could be too concentrated and harmful to your unborn baby. Be cautious or avoid herbal teas and herbal remedies during pregnancy and nursing - they are not sure of effects on babies and pregnancy.
Print out my suggestions if they help and ask your doctor or perinatalogist if they agree with them before you do anything.Sincerely, someone with a respect for homeopathic techniques combined with doctoral care; and taking care of my own health as well. God Bless, I will pray for you. Feel better! [:)]


text:
Quick Links
Shop All Jewelry
BBRC10006 In Stock
Wear your heart on your sleeve with this Braided Edge Vintage Heart Cuff Bracelet! The black enamel design of the flowers on the inside of each heart give depth to all hearts. The braided edges add a unique design to the cuff bracelet and the gold inlay around the hearts add to the design of each heart.
Eve's Addiction.com wants you to be a happy customer. We want you to be completely satisfied with the sterling silver jewelry that you receive from us, as we only sell high quality silver and cubic zirconia cz jewelry. We do understand that you may not like your purchase for some reason.
You may return or exchange your jewelry within 60 days of purchase if you are not satisfied with it. The jewelry must be returned in its original condition for a refund or exchange. Engraved, personalized, photo, monogram, name and initial, chocolate and clearance items are not returnable or exchangeable.


text:
A system for tracking compliance to risk management policies for a given enterprise that provides risk status feedback on hierarchical managerial levels. The system notifies users of potential problems with non-compliance of enterprise policies set on a high level of enterprise management, and prompts the users to take steps to achieve compliance. The enterprise policies are designed to protect the enterprise from various forms of risk associated with enterprise activities. Accordingly, minimizing risk across enterprise operations, subdivisions, projects and applications produces an overall benefit of reduced liability or exposure to liability for the entire enterprise. A compliance status is provided by business groups at all levels of the enterprise, and consolidated for each management level to which the risk status is promoted. Higher level managers can view summaries of risk management status for the business divisions, and select particular statuses to view compliance among various business groups under the manager's responsibility.
1. A compliance tracking system, comprising:
a first storage device containing a first dataset of data related to regulatory and enterprise procedural policy information;
a second dataset storage device containing a second dataset of data related to a state of an operation activity;
a processor coupled to said first and second datasets, and operable to access and manipulate data in said first and second datasets;
a user interface device coupled to said processor and operable to receive user input and provide instructions to said processor for accessing and manipulating said first and second datasets, wherein said user input is based on a compliance response structure comprising a set of role definitions including a plurality of respective responsibilities, wherein said responsibilities being related to respective portions of said state of said operation activity, and wherein said instructions being related to said responsibilities whereby a level of compliance is modified based upon a combination of said responsibilities and respective portions of said state of operation activity;
said processor being further operable to compare data contained in said first and second datasets and provide processor-generated indicia of compliance to said user interface device based on a result of said comparison;
first determination means for determining whether an operation activity is in compliance or non-compliance based on a comparison of the data contained in the first and second datasets;
second determination means for determining whether non-compliance is the result of a new policy or regulation or amendment to a policy or regulation;
risk assessment means for assessing risk and identifying risk factors associated with the state of the operation activity and the new policy or regulation or amendment to a policy or regulation;
third determination means for determining whether a risk acknowledgement has been approved, wherein risk acknowledgement approval comprises accepting the risk or developing or implementing a plan to achieve compliance; and
plan selection means for developing or implementing a plan to achieve compliance, wherein the plan is based on a sensitivity rating, an impact rating, a probability rating, and compensation and control procedures.
2. A compliance tracking system according to
said reporting engine processing device can operate on said indicia of compliance to produce a compilation of compliance indicia in a summary format.
3. A compliance tracking system according to
4. A compliance tracking system according to
said registration engine processing device being operable to accept requests for registration from said user interface device, provide a notification to at least another user interface device for approval of said registration request, and provide a notification to said user interface device indicative of approval or refusal of registration.
5. A compliance tracking system according to
6. A compliance tracking system according to
7. A compliance tracking system according to
a management structure having a plurality of management levels; and
said compilation of compliance indicia is accessible to a management level above at least another management level.
8. A compliance tracking system according to
9. A compliance tracking system according to
10. A compliance tracking system according to
said administration engine processing device is operable to at least one of input data received from said user interface device into said second dataset and provide authorized access to said processor through said user interface device.
11. A method for tracking status and providing status feedback using a computer, comprising:
accessing a set of rules in a database, the rules being related to an enterprise operation wherein said rules provide conformance standards for regulatory or enterprise procedural policies;
accessing a set of data related to compliance with said set of rules;
comparing, by a processing engine, said set of data against said set of rules to produce a compliance status;
providing a computer-generated indication of said compliance status to a user interface; and
accepting user input comprising instructions through said user interface whereby a condition of said set of data is modified, thereby improving said compliance status, wherein said user input is based on a compliance response structure comprising a set of role definitions including a plurality of respective responsibilities, wherein said responsibilities being related to respective portions of said state of said operation activity, and wherein said instructions being related to said responsibilities whereby a level of compliance is modified based upon a combination of said responsibilities and respective portions of said state of operation activity;
determining, by a processor engine, whether an enterprise operation is in compliance or non-compliance based on a comparison of the data contained in the first and second datasets;
determining, by a processor engine, whether non-compliance is the result of a new policy or regulation or amendment to a policy or regulation;
receiving at least one survey generating, deleting, modifying or revising data related to the enterprise operation; and
determining, by a processor engine, if a risk acknowledgement associated with the enterprise operation has been approved, wherein risk acknowledgement approval comprises accepting the risk or developing or implementing a plan to achieve compliance; and
developing or implementing, by a processor engine, a plan to achieve compliance, wherein the plan is based on a sensitivity rating, an impact rating, a probability rating, and compensation and control procedures.
12. A compliance tracking system, comprising:
a first storage device containing a first dataset of data related to regulatory and enterprise procedural policy information;
a second storage device containing a second dataset of data related to a state of an operation activity;
a processor coupled to said first and second datasets, and operable to access and manipulate data in said first and second datasets;
a user interface device coupled to said processor and operable to receive user input and provide instructions to said processing engine processor for accessing and manipulating said first and second datasets, wherein said instructions include answers to a questionnaire related to assessing a level of compliance and information related to at least one of a sensitivity and a criticality of said operation activity with respect to a level of compliance, wherein said user input is based on a compliance response structure comprising a set of role definitions including a plurality of respective responsibilities, wherein said responsibilities being related to respective portions of said state of said operation activity, and wherein said instructions being related to said responsibilities whereby a level of compliance is modified based upon a combination of said responsibilities and respective portions of said state of operation activity;
said processor being further operable to compare data contained in said first and second datasets and provide processor-generated indicia of compliance to said user interface device based on a result of said comparison, wherein said indicia of compliance pertains to a plurality of portions of said operation activity, and wherein said device further comprises a reporting engine processing device, and wherein said reporting engine processing device can operate on said indicia of compliance to produce a compilation of compliance indicia in a summary format;
a first determination processor or interface device for determining whether an operation activity is in compliance or non-compliance based on a comparison of the data contained in the first and second datasets;
a second determination processor or interface device for determining whether non-compliance is the result of a new policy or regulation or amendment to a policy or regulation;
a risk assessment processor or interface device for assessing risk and identifying risk factors associated with the state of the operation activity and the new policy or regulation or amendment to a policy or regulation;
a third determination processor or interface device for determining whether a risk acknowledgement has been approved, wherein risk acknowledgement approval comprises accepting the risk or developing or implementing a plan to achieve compliance; and
a plan selection processor or interface device for developing or implementing a plan to achieve compliance, wherein the plan is based on a sensitivity rating, an impact rating, a probability rating, and compensation and control procedures.
13. A compliance tracking system according to
a management structure having a plurality of management levels; and
said compilation of compliance indicia is accessible to a management level above at least another management level.
14. A compliance tracking system according to
15. A compliance tracking system according to
said administration engine processing device is operable to at least one of input data received from said user interface device into said second dataset and provide authorized access to said processor through said user interface device.
This application is based upon and claims benefit of U.S. Provisional Application 60/254,847, filed on Dec. 12, 2000, to which a claim of priority is hereby made.
1. Field of the Invention
The present invention relates to a system and method for managing global risk, and more particularly relates to a globally accessible system for evaluating variables related to risk associated with a given project or enterprise.
2. Related Prior Art
In any given enterprise it is often desirable to evaluate the risk associated with particular activities. Risk can be determined in a number of different ways, for instance based on possible positive and negative outcomes, and can be assigned various levels of importance for a given project.
For example, an enterprise may wish to evaluate its exposure with regard to regulatory compliance. Various individuals within the enterprise having responsibility related to regulatory compliance generally prefer to have a working knowledge of the procedures in place to produce compliance, and the status of various efforts to ensure compliance with regulatory requirements. Whenever a new task is undertaken in a given area related to regulatory compliance, the person or persons initiating the project for completing the task may be required to assess the risk involved with implementing a solution. The persons knowledgeable about the task and goals may be required to answer questions on a questionnaire or otherwise fill out a form to evaluate the risk associated with the particular task with respect to associated regulatory requirements and for reporting purposes. The task may be evaluated for risk associated with liability to the enterprise if a customer makes a claim related to regulatory sections with which the enterprise has not complied, for example. The individuals may be asked to rate various levels of risk from low to high, and provide other indicia related to ranking of risk factors.
Another aspect of risk management relates to procedures established by the enterprise, with accompanying directives by management to comply with the procedures. A given manager responsible for a particular department may wish to establish the level of risk associated with activities in the department, and may formulate some system for evaluating and reporting risks, that can be used by lower level managers, and project managers, for instance. For example, on a periodic basis, such as quarterly, the managers for a given department might be required to communicate to upper management the various risk factors and risk evaluations that are related to computer information systems operations. Such risk factors can include security, backup procedures and data retaining procedures, for example. The risk factor related information can be provided through various forms or questionnaires for evaluating risk and risk factors associated with projects for which they are responsible. These forms and questionnaires can be compiled into reports and other summary data to provide a department manager with a fairly good idea of the level of compliance with various enterprise procedures.
Typically, if a group within the department is not in compliance with the established procedures for the enterprise, this information can be so noted in the summary or compiled data presented to the department manager. In such a case, the department manager can establish plans to bring the group into compliance, and monitor the status of the group in progressing with the plan.
The impact of evaluating the risk for a given enterprise can have serious consequences with regard to the success, or profitability of the enterprise. For example, if an enterprise is found not to be in compliance with regulatory requirements, the enterprise may be susceptible to penalties such as large fines, lawsuits, or potentially intense scrutiny by regulatory agencies. In addition, if the enterprise has established procedures that are designed to protect the enterprise from liability, or otherwise assure that levels of risk within the enterprise are minimized, the enterprise can be exposed to tremendous liability if the procedures are not properly followed. Also, the enterprise may suffer further liability if it is unable to ascertain, or provide proof of compliance with established procedures, in the context of a lawsuit, for example. Moreover, the enterprise may suffer the loss of a competitive advantage if sensitive data is compromised, for example.
Accordingly, large enterprises that may be vulnerable to a number of different types of risk typically attempt to ascertain the level of exposure to given risks at various levels within the enterprise, and minimize the exposure to risk that the enterprise may potentially suffer. In addition, the enterprise may establish a reporting system in which the degree of compliance with established procedures or regulatory requirements is readily accessible. Finally, the enterprise may wish to establish a plan to bring various groups or departments into compliance with procedures or regulatory requirements, and track the progress of the plan as the group or department moves towards compliance.
In typical enterprises, these types of reports and statuses regarding compliance with procedures or regulatory requirements to avoid risk are often somewhat haphazard, and inconsistent. For example, some managers may find the requirement of filling out forms and answering questionnaires to be an inefficient use of time, and fail to effectively complete risk assessments. Furthermore, in a department where the manager fails to take note of the potential problems caused by failing to evaluate the risk associated with the department's activities, it is often the case that other members of the department will similarly fail to complete assessments associated with risk of activities within the department.
It is also the case that the tools of these risk assessment type systems are form intensive, and inconsistent between various enterprise locations, for example. It is also often difficult to track and maintain the data that can be obtained from forms related to assessment of risk. For example, forms containing information related to risk assessment must be gathered, and the information must be compiled, in order to be useful as a risk assessment tool. The transfer of paper documents within a large scale enterprise is often a difficult task, and can lead to issues involving document storage space.
Solutions to overcome the difficulties associated with paper based reporting systems for use with risk assessment often include the application of computer systems that are designed to permit a number of individuals responsible for risk assessment to enter data online. Once the data related to risk assessment is in electronic format, tasks such as data compilation, reporting and assessment can be accomplished with greatly reduced overhead and savings with regard to use of valuable resources. However, systems in which individuals enter information online related to risk assessment suffer from some of the same drawbacks as the paper based systems. For example, separate departments and locations within a given enterprise may develop their own online tools for inputting information related to risk assessment. Accordingly, it is difficult to consolidate information across departments or enterprise locations. This drawback in obtaining consistency across departments is highly noticeable when various groups, departments or locations within an enterprise continue to use a paper based risk assessment system, while other groups, departments or locations use a variety of online type systems. Consolidating information related to risk assessment in such an environment can require a tremendous amount of resources, and yet still achieve inconsistent results.
Additionally, if a group or department is not in compliance with a given protocol, devising a plan to bring the entity into compliance with a particular protocol can be problematic. Managing the progress status of any plan to achieve compliance can be troublesome and fraught with some of the same difficulties as accumulating risk assessment information in the first place. For example, the progress of the plan may be reported inconsistently, or suffer from the perception of being a low priority task. It is also difficult for department managers to obtain feedback regarding compliance with protocols, for example, in a timely manner. For example, if a given department must be in regulatory compliance within a specific date, it may be very difficult for the department manager to evaluate whether the department is on schedule for meeting the regulatory requirements.
Accordingly, a system for assessing risk on a widespread and consistent basis, that can also provide reporting, planning for compliance, assignment of responsibility and accountability and tracking of compliance plans is highly desirable. Such a system, and method for accomplishing the system, is provided by the system and method according to the present invention.
It is an object of the present invention to overcome the drawbacks associated with the prior art.
Briefly stated, according to the present invention there is provided a system and method for determining compliance with enterprise policies and regulatory requirements as an auditing feature based on questionnaire responses that tracks steps to move towards compliance. One or more responsible parties for a given project are identified or appointed to be responsible for responding to compliance questionnaires. The parties fill in questionnaires designed to focus on various features of risk assessment for specific aspects of a given project. For example, the responsible parties for a project that includes features that require data storage and computer information system access would be asked to rate their disaster recovery readiness. The rating for disaster recovery readiness may depend upon such factors as whether information is stored off site on a regular basis, intervals in which system backups are made, robustness of computer recovery systems and so forth.
Once a questionnaire has been completed, the project can be given an overall rating of exposure to various forms of risk. Areas of risk can be acknowledged, prompting a sensitivity rating, such as severe, negligible and so forth. Once risk is acknowledged, a plan for reducing the risk or bringing the project into compliance can be formulated, and progress towards compliance can be tracked. Alternatively, an identified exposure to risk can be disclaimed through the system, which requires sign off by various higher level managers and administrators.
Once risk assessment is completed for various projects, a higher level manager can review exposure to risk on a broad perspective, and through a user interface, expand particular areas where high risk is identified as a problem. A risk category that is expanded reveals the different departments and/or projects and their associated risks or compliance statuses. The higher level manager can thus identify particular projects or activity areas where risk exposure exists.
The sensitivity of the risk factors can also be gauged and used to develop an overall risk rating. For example, a person responsible for assessing the risk related to a particular project is asked to rate the sensitivity of various hypothetical events such as competitive disclosure, financial loss or impact on perception of customers.
Requirements for compliance with regulatory demands and regulatory agencies are built into the risk management tool. Project managers and higher level managers can determine in a glance if a particular project is in compliance with regulatory guidelines. Higher level managers have broader access than lower level mangers to risk assessment information according to level of seniority. For example, a middle level manager can see all the risk assessment factors for each department/project that they manage, but can see no risk information beyond their allotted level. A high level manager can view all the information available to the mid level manager, in addition to any other manager or group for which the high level manager has responsibility. Accordingly, access to the system is provided on a secure basis that is reflective of the user's level of seniority.
The system also provides security features such as logon IDs and passwords. Access levels are assigned based on seniority or management status, and provide a mechanism for a secure review of risk exposure and compliance. Once data is entered into the system it cannot be modified unless the user has proper authorization. The system generates reports to inform persons or groups about their compliance status. A search tool is available for locating various businesses, compliance areas, risk status levels and so forth. The system can also be used for training users on risk management policies, how risks are evaluated and how paths to compliance can be determined.
The system according to the present invention thus provides immediate compliance verification, a calendar of events, allows shared best practices and corrective action plans and provides a mechanism for risk acknowledgement communicated to other members of a hierarchy. The system can be used in any hierarchical organization including such risk sensitive enterprises as military units, space missions and highly financed business endeavors.
Other features and advantages of the present invention will become apparent from the following description of the invention that refers to the accompanying drawings.
Referring now to
Database server 118 is aware of a number of business operations or projects for which a risk management assessment can be made. Business operation 102 is shown coupled to database server 118 as an example of a business operation or project that falls under the scope of risk management system 16. Business operation 102 has associated with it business operation information resources 100, which provide data for business operation and projects within business operation 102. In a given business operation, a number of projects may be active at any given time, as illustrated by a project 110. Project 110 has associated with it project information resources 112, that provide project related data and data management. Project 110 can also have a number of applications that support the project operations, as illustrated by a project application 123. Applicant information resources 124 are accessible by application 123 as a data resource for management of application information. The system of the present invention uses application 123 as the basis for tracking system information. For example, each application is defined under a business project, which is in turn defined under a business operation. Accordingly, changes to application 123 are tracked throughout the system, and are recorded in, for example, a log file. The system provides a search function to locate various applications, and includes functions to delete applications or change information related to application 123.
Risk management system 16 assesses risk related to each application 123, and provides summary risk information for components such as application 123, project 110, and business operation 102, for example. Application server 108 provides users 120 with status of the various risks associated with business operation 102, project 110 and applications 123. The information provided to users 120 about risk associated with various applications is accessed through database server 118. Application server 108 also provides an interface for access to risk management system 16 through a display viewable by users 120 once they access the system through communication server 104.
Referring now to
If user 120 wishes to obtain details about risk indications shown in status display 23, they can make a selection to navigate to business operation subdivision status 24, for example by choosing a business operation link. Subdivision status 24 is also accessible directly from home page 22 by users with lower seniority than the user authorized for status display 23. Subdivision status 24 provides risk assessment information summarized by subdivision level for a business operation. For example, a business operation may be broken into a number of departments, each of which may have a variety of projects and applications for which a cumulative risk assessment may be made. The cumulative risk assessments are displayed in subdivision status 24. A manager responsible for a given operational subdivision can view subdivision risk status information through authorized managerial access in a subdivision status display 25. Subdivision status display 25 is also viewable by executive users with access to status display 23. Accordingly, each executive or manager has access to all risk status information associated with their management level, as well as all lower business subdivisions for which they have responsibility.
If a user selects a particular subdivision of the operation from subdivision status 24, a display of all projects that are active in the selected subdivision is provided in a project status 26. As with the upper business divisions, a project manager is given appropriate authorization to view project risk status in a project status display 27. Users with access to status displays 23 and 25 also have access to project status display 27. If the user selects a particular project displayed within project status 26, a number of applications associated with the selected project are displayed in an application status 28. Users responsible for particular applications can view an application status display 29 associated with applications for which they have been granted authorization. Individuals that have been assigned roles with respect to particular applications are displayed in an application role display 30. The roles involved with a particular application include an information owner, a project manager and so forth. An information owner has the responsibilities of being aware of applicable control policies, assessment of application security and implementation of maintenance, availability and integrity processes, for example. They are knowledgeable about application confidentiality issues, other assigned role members, and can grant authority for application access. Application status 28 also provides information related to particular applications such as the application platform and location.
Each application has associated with it a number of policies for handling technology and information as provided on an enterprise basis. An example of an information policy provides the requirements for disaster recovery preparedness, including business continuity. The policy may require a plan accessible to a crisis team for recovery, for instance, with the plan being placed in a repository and periodically updated and tested. The level of compliance with the policies associated with a given application provides the associated level of risk for the application. For example, if a policy provides for the privacy of information for certain sensitive applications, a small degree of compliance with the policy may create a large amount of risk. As policies are created, updated or deleted, affected applications must be reevaluated for risk assessments pertinent to the policy changes.
The policies involved with an application selected from application status 28 are shown in a policy status 31. Policy status 31 provides a summary view of the policies associated with the selected application, and the present status of the policies with regard to risk assessment is shown in a policy status display 32. For each policy, a given application can be in compliance or not in compliance, as discussed in more detail below. If a given application is not in compliance with a policy, an indication is provided in policy status display 32. The users responsible for assessing risk of non-compliant applications, as designated in application role display 30, are required to provide a risk acknowledgement for the policy, as indicated in a policy risk acknowledgement 33. The responsible user is asked in policy risk acknowledgement 33 to provide a path for obtaining compliance, or to obtain approval and acknowledgement of the issues associated with continuing non-compliance. A discussion of the factors involved in completing risk acknowledgement for a given policy is provided in greater detail below.
Referring now to
Among the risk factors that are displayed is an indication of compliance with federal regulations or requirements. The user can select a regulatory risk status associated with a given business operation from business operation status 42. Once the user selects a regulatory status related to a particular business operation, a regulator compliance display 41 is provided for viewing. Each subdivision in regulatory compliance display 41 has several risk assessment components, for which summary indications of levels of risk are displayed. Each subdivision has a technology compliance status 34, a business compliance status 35 and a corrective action status 36. Each status 34-36 indicates levels of compliance with risk management policies, in addition to the corrective action status for a given subdivision. The status indicators can be selected for further detailed examination of the status and its derivation. For example, selecting technology compliance status 34 produces a technology question/response display 38.
If a given business operation is in compliance with federal regulations, the regulatory indicator displayed in business operation status 42 reflects a positive status as a compilation of responses to risk questionnaires. The risk questionnaires can be viewed as shown by technology question/response display 38, a business question/response display 39 and corrective action plan status 40. Displays 38, 39 show questions related to assessing risk for given activities within a particular subdivision and business operation that affect the state of compliance with federal regulatory requirements. The responses to the questions posed in displays 38, 39 are yes/no type questions, for example, with attendant comments discussing the response. For example, a positive risk assessment can be obtained even if a risk assessment question is answered in the negative, and the comment section describes procedures put in place to obtain compliance. When the risk management assessor reviews the questionnaire, she can assign a status of compliant, non-compliant or "warning" for the particular subdivision. Accordingly, a technology or business display 38, 39 having negative responses for compliance, together with compliance plans deemed inappropriate by a reviewer, results in a non-compliant indication for a subdivision.
Selecting corrective action status 36 produces corrective action plan status 40, which outlines a path for obtaining compliance with regulatory requirements. If a risk management review results in the decision that the corrective action plan is inadequate, the compliance indicator for the particular subdivision will indicate non-compliance. If the corrective action plan is acceptable after risk management review, the compliance status for the subdivision indicates compliance with regulatory requirements.
It should be apparent that while various breakouts of organization structures are shown and described according to the present invention, many types of organizational structures are possible. The present invention works equally well, for example, if an organization is arranged as a partnership or limited liability corporation. In addition, an organization structure that is "flat," or with only very few levels of managerial structures can benefit from the present invention. It should also be apparent that while the regulatory requirements discussed above are based on federal regulations, any type of regulatory or other agency requirements can be used as compliance goals.
Technology and business questionnaires that make up and result from displays 38, 39 are also time/date stamped with the author of the questionnaire responses noted. Information related to the author of the response is also available, such as the business division and operation to which they belong, and contact information. For each of the business operations, the executive or manager in charge of the business operation is able to display regulatory compliance status for the business operation on a summary level, as indicated with a business operation status display 43. Status display 43 is limited to access by the particular executive or manager responsible for the business operation for which the risk status is provided. The executive or manager for the business operation is authorized to view status display 43 by virtue of providing the appropriate logon information when accessing the system initially.
Similarly, a subdivision executive or manager can view only the regulatory compliance risk status for their particular subdivision through a regulatory status display 37. Regulatory status display 37 provides a compilation of risk compliant statuses for the various projects and applications associated with the subdivision for which the manager or executive has responsibility. Similarly, business operation status display 43 provides a compilation of risk compliant status for a business operation that includes all subdivisions within the business operation. Accordingly, an executive or manager with authorization to access status display 43 also has access to risk status view 37, associated with particular subdivisions under the business operation.
Referring now to
Pertinent applicable business and technology control policies are obtained and applied comparatively to determine whether the criteria for the control policies is met by the state of the compliance information associated with the application in step 52. Any risk acknowledgement information, including approved responses and status of compliance plans, is also obtained in step 52. The critical business aspects and sensitivity related to various portions of the application are obtained and applied in step 53. Criticality ratings for the various risk related aspects of the application are discussed in more detail below. The sensitivity of an application is also discussed in determining how much risk to assign various applications, and when non-compliance is escalated to a higher managerial level.
In step 54, a self-assessment questionnaire response is obtained, consisting of a series of questions that must be answered with appropriate responses to produce compliance. It should be apparent that the assessment can be conducted interactively online, for example, but is not to be considered so limited. For example, the assessment can be accomplished through the use of paper forms, or a combination of paper and electronic media. After the assessment, the process then proceeds to a decision step 55 in which a determination is made as to whether the application in question has been assessed for risk compliance. If an assessment has not been completed, the process branches from decision step 55 to a pending approval indicator 56. Pending approval indicator 56 indicates that further entry is required for one or more inputs, or that the application has not passed completely through the assessment and approval process. If an assessment has been made, decision step 55 branches to a comparison step 57, in which the status of compliance is determined based on applicable control policies and self-assessment of application sensitivity and criticality.
In decision step 58 a determination is made on whether the application is in compliance, either by meeting all the requirements of the applicable control policies in the various risk assessments, or by having an approved process or plan in place to achieve compliance. If the application is compliant, decision step 58 branches to compliant indicator step 59. Compliant indicator step 59 provides a visual indication that is displayed to the user to show that the particular application is in compliance with the guidelines established by the control policies.
If the application is not in compliance as determined in decision step 58, the process branches to decision step 60, where a determination is made on whether the institution of a new policy has prevented a particular application from being in compliance. If a new policy, or an amendment to an existing policy, has prevented compliance, the process branches to incomplete step 61, in which a visual indicator identifying the risk assessment as incomplete is displayed to the user. The process continues after incomplete step 61 to input step 65, in which the user can be prompted for additional input, or completion of policy questions that remain unanswered. Once the input or answers to policy questions are obtained, the process for determining the state of health with regard to risk assessment can be initiated from the beginning to obtain a further compliance indication result.
If a new policy or amendment to a current policy has not been made, as determined in decision step 60, the process continues with decision step 62, which determines whether a risk acknowledgement has been approved. Risk acknowledgement approval is needed when the strictures of a control policy have not been met and the risk is either deemed to be acceptable because of various issues of practicality, or a plan to achieve compliance has been formulated or is in progress. A risk management assessor reviews areas of non-compliance and the associated risk acknowledgements to provide approval if appropriate. If a risk acknowledgement is not appropriate for approval, decision step 62 branches to indicator step 63 in which an indication of critical lack of compliance is annunciated. Indicator step 63 provides a visual display to the user to inform them that they are (1) not in compliance and (2) have a non-approved risk acknowledgement. If a risk acknowledgement has been made and approved by a risk management assessor, decision step 62 branches to a warning indicator step 64. Warning indicator step 64 provides the user with a visual display showing that a risk exists because of non-compliance with one or more control policies, but the risk is either deemed acceptable for one or more reasons, or an approved plan is in place to achieve compliance.
It should be apparent that while the user is presented with a visual indication of risk status as a result of the process shown in
Referring now to
If it is determined in decision step 71 that a particular control policy is applicable to the given application, decision step 71 branches to proceed to decision step 73, in which a determination of compliance with applicable control policies is made. As discussed above, compliance with control policies takes into account application activities and assessments, as well as application sensitivity. If the application complies with the various applicable control policies, decision step 73 branches to result step 74, in which an indication of control policy compliance is set. This risk status indication set in result step 74 may be promoted to higher levels of management if the application, project, subdivision, etc. is identified as highly critical or highly sensitive, as discussed more fully below.
If the result of decision step 73 is that various aspects of the application do not comply with control policies, decision step 73 branches to proceed to decision step 75. This path through the flow diagram shown in
Accordingly, in decision step 75 the user is allowed to select whether another compliant process should be considered. If the user wants to consider another available compliance process, also referred to as a best practice, decision step 75 branches to result step 76, in which the user can obtain a copy of the available compliance process. The copy of the compliance process is used in a process for risk acknowledgement and providing a plan to achieve compliance with the appropriate control policy. If the user chooses to adopt the processes available in result step 76, the compliance process continues to decision step 73, in which the application is again checked for compliance.
If the user chooses not to use available compliance processes to achieve compliance, decision step 75 branches to a series of risk acknowledgement related processes beginning with an application information step 77. Step 77 begins the process of risk acknowledgement by accepting information about the application including such items as the owner of the application or information, the business operation, the control policy that is the subject of the risk acknowledgement and so forth. Once all the background information related to the application and the noncompliance is gathered, the process proceeds to a step 78 in which the application and aspect of the application related to the control policy is rated for sensitivity. A sensitivity rating can be obtained from an aggregation of several sensitivity rating assessments. For example, the user can rate the application, or aspect of the application related to the control policy as: highly sensitive, sensitive, internal public and not applicable.
After providing a sensitivity rating in step 78, the process proceeds to an impact rating in step 79. The impact rating relates to potential outcomes for various types of abrogations of the control policy. For example, possible impact ratings include, on a scale from high impact to low impact: catastrophic; severe; moderate; and low. Following the impact rating, the process continues to step 80, in which the user is asked to rate the occurrence probability of a risk related event impacting the application related to non-compliance with the associated control policy. Selections for probability can be, for example: high; medium; and low. Once the rating factors in steps 78, 79 and 80 are entered, the procedure continues with step 81.
In step 81, the user is asked to justify the reasons for risk acknowledgement and enter information that can be transferred to a risk management assessor for review. The process then continues to step 82 in which the user is asked to input information related to compensation and control procedures that can reduce the risk of non-compliance with the control policy. Again, this information is input in a format that can be transferred to a risk management assessor for review. The process then continues with step 83, in which the user is asked to input information related to implementation of a plan to bring the application into compliance with the particular control policy. As with steps 81 and 82, the user inputs information in a format that can be transferred to a risk management assessor for review.
Once a user enters all of the information related to risk acknowledgement in steps 77-83, the risk acknowledgement information is submitted for review and approval in step 84. While the risk acknowledgement information is pending approval in step 84, any user accessing the risk status is presented with a visual indicator of the risk acknowledgement status to indicate that approval is still pending, and the approval period has not yet expired.
While the risk acknowledgement information is pending approval, a risk management assessor can review the risk acknowledgement information in decision step 85 and decide whether to approve the risk acknowledgement. Decision step 85 also represents a default decision that occurs if the period during which approval is pending expires, indicating that no approval has been granted. Accordingly, decision step 85 branches to step 86 if approval has been granted, and branches to step 87 if approval is not granted for the risk acknowledgement information. In step 86, a warning indicator displayed to the user indicates approval of the risk acknowledgement information. A warning indication informs the user that the application is not in compliance with control policies, but that an approved risk acknowledgement response is in place. Step 87 also provides a visual indication to the user, in this case indicating that the application is not in compliance with one or more control policies, and no approved corrective action plan is in place. Accordingly, the indicator produced in step 87 is considered a critical indicator for the level of risk associated with non-compliance in the particular application. Once a risk acknowledgement response is in place, the user can renew the response if a time limit is set for compliance, for instance, and an assessor approves the risk acknowledgement renewal. In addition, once a risk acknowledgement is approved, a notification is sent to all other members assigned to roles associated with the particular application. Other notifications to the members having a role in the risk assessment process can include a thirty day warning prior to expiration of a risk acknowledgement approval period, and a warning that a corrective action plan is due to expire.
The processes shown and described in
Referring now to
Section 93 permits the user to select an entry for potential impact of activities associated with non-compliance of the identified control policy. Potential impact entries selectable by the user include: catastrophic, severe, moderate and low. Section 94 allows the user to select a likely probability of occurrence for risk related events. For example, if an event occurred that the identified control policy is formulated to prevent, and this particular application is likely to incur the same type of risk events, the probability might be ranked high. Selections available for the user to rank the probability of occurrence are high, medium and low.
The remaining sections of form 99 are open entry style sections that allow the user to enter information that is generally applicable to risk acknowledge. For example, in section 95 the user is asked to input a statement describing the reasons for the risk acknowledgement. In section 96, the user can enter information describing controls and procedures that can compensate for non-compliance, or reduce the resulting risk from non-compliance. In section 97, the user is requested to discuss the background of the potential impact of non-compliance for the application or information. Section 98 allows the user to input a description of an implementation plan that is structured to achieve compliance with policy controls applicable to the information or application.
Referring now to
Once all the entries in the chart have been completed, the user can submit the form for use with the risk status process. For example, a highly sensitive application, as determined through chart 129, which is not in compliance with one or more control policies, is assigned a risk factor indication of critical. The critical risk factor indication may supersede the controls in place for risk acknowledgement, if the application is indicated as being extremely sensitive in several areas, for example.
Referring now to
In decision step 132, a determination is made about whether the application has been rated highly sensitive in combination with non-compliance of one or more control policies. If a compliance status indicator shows critical, or indicates non-compliance, or if an application is rated as being sensitive and it has a risk status associated with it indicating a warning, then decision step 132 branches to promotion step 134. In step 134 the relevant risk statuses are promoted to the next managerial level. A manager of a business subdivision, for example, can view a risk status display composed of a compilation of risk statuses for various projects and applications associated with the business subdivision that is within his managerial purview. Accordingly, when a risk status is promoted to a managerial level, such as the level associated with a subdivision manager, step 134 serves to present appropriate statuses for the various projects and applications associated with the subdivision.
Referring now to
Referring for a moment to
Referring now to
Referring for a moment to
Column 147 shows the status of risk acknowledgement for the various business subdivisions. As illustrated in chart 125, the first two entries of column 147 indicate yes and no, respectively, for risk acknowledgement. The first entry is paired with an indication of non-compliance in columns 144, 145, meaning that a lower level business operation lacks compliance and does not have a satisfactory corrective action plan or risk acknowledgement. The second entry in columns 146, 147 is paired with an indication of in progress, meaning that a lower level business operation has a non-compliant application, but has compensating corrective action in place, even though the risk acknowledgement is negative.
Referring again to
Tabs 157 permit the user to select an application for update or review of the risk status. A user can request to add, modify or delete an application, and accordingly change the associated risk status. Selection of a particular application for review allows the user to see all the applicable policies for that application, and the status indicators regarding the policy compliance. For example, each policy associated with an application is listed, and each entry in the list has an indicator that provides an assessment status at a glance, such as compliant, non-compliant, pending, not applicable, and so forth. The listed policies can be selected to review responses to policy questions and ratings for application sensitivity and criticality. If a policy is added, changed or deleted, the affected user or person assigned a risk related role with respect to the application receives a notification. The user can then access the policy directly to review the changes and respond to new risk rating criteria.
If an application has an outside vendor related component, for example if a third party furnishes a portion of the application functionality, any risks related to the outside vendor can be incorporated into the system. For example, if the vendor breaches a contract term, discloses confidential material, or provides inadequate support for the supplied components, these factors can be incorporated into an application risk assessment and rated according to severity. In addition, if an outside vendor wishes to take part in the risk assessment, they can receive feedback on the effectiveness of a corrective action plan, or receive specifications for achieving policy compliance, for example. It should be apparent that many other types of vendor interaction are contemplated by the present invention, with the main focus being coordination of risk assessment and corrective action plans.
Referring to
Referring now to
Referring now to
In information entry step 166, the user enters details about the new application, such as the application name, the project manager, the information owner and so forth. The process then proceeds to assignment step 167, in which roles for the application are assigned to various individuals. The assignment of a role within the scope of the new application provides the assignee with certain responsibilities related to tracking and managing risk criteria. Once the appropriate roles are assigned, the process proceeds to application questionnaire step 168. In step 168, the information owner or project manager answers a series of questions related to the application. The information owner or project manager then submits the completed questionnaire in electronic format, and the process continues to notification step 170.
Notification step 170 provides notification to all individuals assigned to roles for responsibilities in the new application. The persons that are notified in notification step 170 are automatically provided authorized access to the risk management system associated with the new application. The notification received in notification step 170 instructs the individuals on how to login through login step 160 and select application editing step 163. Once the individuals with roles and responsibilities related to the application enter editing step 163, they are prompted to choose the application for which they have been assigned responsibility or a role in step 171. Once the users selects the application for which they have a role or a responsibility, the process continues with step 172, in which the user identifies themselves according to their role with respect to the chosen application. For example, the user may select one or more roles to which they have been assigned for responsibility during the creation of the application in the risk management system. The user may have more than one role, such as, for example, security administrator and project manager.
Once the user selects the role with which they have been identified for the application, the process continues with step 173 in which the user is presented with questionnaires related to their respective roles. The questionnaires provided in step 173 are preferably partially completed with existing information available for the application. The user need only complete questionnaire sections that are still blank or that require further response. With the completion of the questionnaire, the user submits the responses and the process continues with step 174. In step 174, the project manager and/or information owner is notified that the questionnaire for a particular role has been completed. Upon notification, the process moves to step 175, in which the project manager or information owner can review the responses submitted in the role questionnaires. Once the questionnaires are reviewed, the process continues with step 176, in which the collected and reviewed questionnaires are submitted to the risk management system for review and approval. In step 177, a risk management assessor reviews the complete application, including the information provided by the information owner/project manager and the responses provided by the individuals assigned to the various roles.
Once the risk management assessor has reviewed all the aspects of the application, they can take appropriate action that results in the setting of indicator statuses denoting compliance with control policies and risk acknowledgement in step 178. At this point, the application has been entered into the risk management system, and individuals responsible for various aspects of maintaining compliance with control policies can access and update the system, as described above.
Among the information entered in step 168, for example, are hardware requirements, hardware locations and vendors, associated applications, software licenses, software vendors and so forth. The initiator of the new application also responds to questions such as whether the application will run on a mainframe, mini-computer or local network, whether the information related to the application will be stored on a LAN, if disaster recovery is needed, and whether any business plans should be updated.
When the entire process for the new application has been completed, such as in step 177, time frames for compliance are set so that the compliance status indicators that are shown as pending will, after the compliance time frames, be set to appropriate indications of status, in step 178. For example, if the initial application is not in compliance with one or more control policies, the status indicators related to compliance with the particular control policies will show that a compliance status is pending. After the time frame for response expires, if no action has been taken with regard to obtaining compliance for the non-compliant aspects of the application, the related status indicators will show a critical indication that will be promoted to the next managerial level, as discussed above.
Referring now to
System administrators and risk management administrators review the request for access to the system in step 183 to provide a multi-level approval structure. Administrators can search for a user profile and create, modify or delete user profiles in the system. User profiles may contain a number of pieces of information related to access of the system, such as a business ID, an accounting center, e-mail addresses, title and job grade, and so forth. Once the appropriate approvals have been granted, the user is notified in step 184. The user is provided with a logon ID, and an initial password. Once notified, the user can login as shown in step 185, using the login ID provided and the initial password. Once the user gains access to the system using the logon ID and password provided, the system prompts the user to provide a new password of the user's choosing. According to various security protocols, the user is preferably informed of password conventions such as, for example, use of a mix of alphanumeric characters and non obvious combinations, such as passwords resembling logon IDs. Once the user is admitted to the system in step 185, the user is provided with a number of administrative tracking features, such as connection time, logon time outs, periods of inactivity and so forth.
Changes to the user account can be made through the same process shown in
Although the present invention has been described in relation to particular embodiments thereof, many other variations and modifications and other uses will become apparent to those skilled in the art. It is preferred, therefore, that the present invention be limited not by the specific disclosure herein, but only by the appended claims.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image


text:
A closer look reveals the exceptional character and quality of this finely woven fabric. An intricate mix of multicolor twist yarns creates a soft, muted pattern designed to complement everything from traditional trousers to casual khakis. Meticulously tailored with our Signature details and Bemberg╜ lining and center vent. Dry clean. Imported.
Additional Sizes:
Color : Select Swatch Below
$10.00 additional
Do you have questions about this product?
Get answers from real customers and in-house experts.
Know the answer? Answer this question
1 answer
Do you have a question about this product?
On all online orders$50 or more◊
For Assistance Contact us Toll Free Anytime at 1-800-285-2265
California Transparency In Supply Chains Disclosure
1-800-285-2265 ©Jos. A. Bank Clothiers, Inc.


text:
Cal Carpenter is an adjunct faculty member in the Lesley Graduate School of Education.
Cal Carpenter
Professional Title: Adjunct Professor
Areas of Academic Focus and Expertise: Educational applications of technology
Area of Work and Concentration at Lesley: Technology in Education
Representative List of Recent Courses Taught: ECOMP 6016: Teaching and Learning with Digital Media; ECOMP 6008: The World Wide Web as an Educational Resource; ECOMP 5022: Technology and Social Studies; ECOMP 8000: Advanced Professional Seminar in Technology
Education: EdD, Nova-Southeastern University (Computing and Information Technology)
Representative List of Recent Publications / Exhibitions: Carpenter, C. L. (1992, April). Plugging in to the information age. The Computing Teacher, 38-39.Carpenter, C. L. (1996). Online ethics: What's a teacher to do? Leading and Learning With Technology, 23(6), 39-41.
Dr. Carpenter holds degrees from the University of Massachusetts, B.A. (History), M.Ed. (English) and Nova-Southeastern University, Ed.D. (Computing and Information Technology). Professional memberships include: the Massachusetts Council for the Social Studies (MCSS), the National Council for the Social Studies (NCSS), Massachusetts Computer-Using Educators (MassCUE), and the International Society for Technology in Education (ISTE).
Dr. Carpenter is a 35-year veteran of Medford (MA) Public Schools, primarily teaching social studies at the middle school level. As a private consultant, he has worked for the WGBH Teacher Center, The Massachusetts Elementary School Principal's Association (MESPA), Pierian Springs Software, Inc., and Tufts University and the University of Massachusetts where he also maintained status as adjunct faculty. Before retiring from public education, Dr. Carpenter was the Curriculum Director of Social Studies, K-12.
In 2004, he successfully co-authored a competitive U.S. Department of Education Teaching American History Grant; one of 122 funded projects across the country and served as Project Director. Since 1989, he has taught technology courses at the Lesley University.
All PreK-12 Graduate Education Programs
PhD Programs
School-Based Residency Programs
Online Education Programs
Off-Campus Programs
Professional Development
Faculty Profiles
Alumni/Students in the News
Graduate School of Education Home
Field Placement
Academic Advising
Academic Policies
Expected Program Outcomes
Blog: Technology Trends in the Classroom
Request more information
Schedule a campus visit


text:
Data protection that strengthensyour business
No credit card required.
"Your company is great. We have used two other 'name brand' companies before yours and had horrible luck. My clients love my ShareFile site, and when my clients are happy I'm happy! Thank you again."
- Michael Rubin, Electric Crayon Digital Printing (March 2013)
ShareFile makes it easy for you to securely store and share your confidential business files — and safely access them from anywhere on any device. ShareFile safeguards your files with state-of-the-art encryption protocols and datacenters equipped to protect against data loss, even in emergencies. Configurable controls let you choose who can access files and folders, set alerts and notifications of activity, and even set expiration dates on sensitive files. And our mobile apps ensure you can access your files from any device, anytime — without compromising security.
All communications and data sharing between ShareFile and the user are encrypted using either Secure Socket Layer (SSL) or Transport Layer Security (TLS) encryption protocols and up to AES 256-bit encryption. Your files are also protected while at rest on our servers with AES 256-bit encryption.
Our servers reside in SSAE 16 accredited datacenters with features including hurricane-rated roofs and multiple redundant power sources. All data is automatically updated to servers in separate locations. We perform regular backups on all data, including off-site data backups, to protect against almost all disaster scenarios.
ShareFile mobile apps allow you to securely and instantly access your files from any device. Track account activity, set expiration policies for files saved in the app, and remotely lock or wipe data from a lost or stolen device — quickly and easily.
With ShareFile user settings, you can control who accesses your data. Give employees and clients access to only the files you want them to see and receive alerts when someone downloads a file. File versioning lets you track file changes and access older versions of files as needed. Workflow audit trails, configurable permissions including multi-factor authentication, and intuitive reporting tools provide even more granular control.
Try ShareFilefree for 30 days.
Citrix and ShareFile are trademarks of Citrix Systems, Inc. or a subsidiary thereof, registered in the U.S. Patent and Trademark Office and other countries. All other trademarks are the property of their respective owners.


text:
So we're onto the second installment of the Essential Outerwear series, and today, the spotlight is on the field jacket, or sometimes more broadly called, the utility coat.
So what in the world is a field jacket? Well I'mma get descriptive on you: field jackets are jackets that are inspired by a type of outerwear design worn by soldiers during World War II, usually characterized by a rugged look made of waxed cotton or some sort of synthetic, donning multiple pockets, and generally in an olive green or khaki color, just like the military men wore it. To see a couple classic field jackets, check out the M65 or M43.
I love field jackets and utility coats, and they've become quite popular in recent years. I swear every other person on the street is wearing some sort of olive green canvas jacket, whether guy or girl, old or young. Good news is that this ubiquity has made this jacket a very seamless one to wear in any situation. You can be in casual sweats, and a field jacket won't look out of place. I've also seen the other end of the spectrum where finance folks from London are layering their Barbour jackets over their pinstripe suits. I might add that it's not a bad look.
If you're going to get one, I would recommend getting a field jacket/utility coat in a neutral color. Think olive green, khaki, navy blue, black, gray. They look best when they're a bit distressed or wrinkled, and they should fit well at the shoulder, but it's not 100% necessary for them to fit too snug. For example, the Barbour Bedale is one of my favorite field jackets, and it's actually cut in a more classic form to help make sure your movement is unrestricted while you're hunting that deer, or grappling a bear.
These jackets can also act as great rain coats. If it's made of waxed cotton, it's actually meant to be worn in the rain, as the wax keeps the jacket protected from any rain damage. I will have to warn you though, they usually aren't as warm as wool or puffer coats, and hopefully you didn't expect them to be. They work well in the winter time, but not in below zero degree weather.
Here are two of my field jackets, one being more classically field-like (the Barbour one), and the other being a little out of the box (the Banana Republic one). I like them both a lot though:
I love the corduroy detailing on this particular jacket. Wear these jackets with a scarf if your neck gets cold. Looks great in my opinion. Here is the most common color that you'll find a field jacket in. Olive green. This one has no lack of detailing either. Leather on the collar. This is actually the jacket that Bond wore in the main battle scene of Skyfall. Couldn't resist getting it for myself as a result.
Sweater: J.Crew | Scarf (blue): Todd Snyder x Gap | Scarf (black): Prada
Jeans: Rag & Bone | Jacket (blue) : Banana Republic | Jacket (black): Barbour
Now, I normally say you should spend the extra dollar in getting a piece, but honestly, with field jackets, you can find some great ones for a little less at your mass retailers like Gap or Uniqlo. Penfield also makes some less expensive ones (though they're going to be more than what you find at Gap or Uniqlo).
In the case that you do want to spend the extra dollar, I'd say look for jackets from Barbour, Filson, or Pendleton, GANT, or Jack Spade, in that order. Nordstrom has a great filter where they show only utility coats, so I'd check that out as well.
Either way, a field jacket / utility coat is a great piece that you'll own for quite some time, perhaps even for the rest of your life. I recommend getting one sooner rather than later, and wear it throughout the entire year. Love the ones I have, and I don't regret a single cent in those purchases.


text:
- TSH- level should be between .3 and 3.0
- Free T4-storage thyroid hormone (the "cake mix"--needs to be activated or baked ie turned into T3) level should be ABOVE the 50% of normal (if range is 1-10 level should be 5)
- Free T3- actual thyroid hormone that can be used by body. Level should be ABOVE 75% of normal range (if normal is 1-10 then you should be 7.5 or above)
- Thyroid Antibodies - proteins that attack the thyroid gland
- Reverse T3 - measuring sidelined T3 that is unavailable to body
- Ferritin - stored form of iron (normal range is 20-100 but optimal is 60 or 80 if you need to lose weight)
- Vitamin D - normal range is 20-100 but want to see 60 0r 80 for women who want to lose weight. Get blood level to determine supplementation for this critical hormone. Some doctors suggest 5,000 a day for people whose blood levels are low. There is a once a week prescription of 50,000 IU for people who levels don't respond to daily supplementation. Ask your doctor about this. Watch CBS News Watch about the importance of vitamin D.
[2] Mary Shomon, "Hormone Balance after 40", The New York Open Center, January 14, 2011.


text:
Stripe Racerback Tank
Style # 216611
Give your style a summery sportif-chic pop with this sexy bebe racer tank, featuring lightweight stretch and bold-hued stripes. Try yours with a going-out skirt and a pair of embellished heels.
- 92% nylon, 8% spandex
- Center back to hem: 23" (58 cm)
- Hand wash according to care label
- Made in USA with imported materials
- Model is 5'9" and is wearing a US size S
Rated 5 out of 5�by 1 reviewer.
Rated 5 out of 5�by choley shopper My favortie casual/dress-up top right now! Goes great with jeans and black skirt or dress pant January 20, 2014
1-1 of 1