DE102021211829A1 - Method for creating an individualized questionnaire to check a regulatory situation - Google Patents

Abstract

The present invention relates to a method for creating an individualized questionnaire (IF) for checking a regulatory situation: - recording at least one country parameter (LP) correlating with countries relevant to the regulatory situation, - recording at least one application parameter (AP) correlating with software applications relevant to the regulatory situation - Selection of regulatory questions (RF) from a regulatory questionnaire (RFK) based on the recorded at least one country parameter (LP) and based on the recorded at least one application parameter (AP), - Compilation of the selected regulatory questions (RF) in an individualized questionnaire (IF),- outputting the individualized questionnaire (IF) to answer the selected regulation questions (RF).

Description

The present invention relates to a method for creating an individualized questionnaire for checking a regulation situation, an adaptation method for adapting a regulation questionnaire, a computer program product for carrying out the methods mentioned, and a creation system for creating an individualized questionnaire.

It is known that different regulations for software products exist in different countries. For example, a few years ago, the GDPR came into force as a regulatory ordinance in Germany. However, a country usually has a large number of different regulations in the form of laws or ordinances, which companies must take into account when developing and operating software applications, IT processes, IT projects and associated infrastructures. In large companies in particular, this leads to a great deal of effort to ensure that all software applications in all countries/regions and for all business units actually comply with the relevant regulations in the current version. On the one hand, this must be guaranteed by the company, on the other hand, this must also be checked regularly, since the software products and the regulatory framework can change. This is usually done manually. In other words, a corresponding audit is carried out in each company for each individual software product in order to check whether the respective software product sufficiently complies with the required standards in the respective regulatory situation. With complex business structures of international companies, a large number of different software applications and the presence in a large number of different countries, the complexity is maximized, so that a confusingly high effort has to be made to ensure that the relevant regulatory situation is actually observed.

It is the object of the present invention to eliminate the disadvantages described above in a cost-effective and simple manner. In particular, the object of the present invention is to be able to provide standardization and in particular partial automation or even complete automation for the process of checking the regulation situation in a cost-effective and simple manner.

The above object is achieved by a method having the features of claim 1, an adaptation method having the features of claim 11, a computer program product having the features of claim 13 and a creation system having the features of claim 14. Further features and details of the invention result from the dependent claims, the description and the drawings. Features and details that are described in connection with the method according to the invention naturally also apply in connection with the adaptation method according to the invention, the computer program product according to the invention and the creation system according to the invention, and vice versa, so that the disclosure of the individual aspects of the invention is always referred to mutually can be.

• - Erfassen wenigstens eines Länderparameters, korrelierend mit für die Regulationssituation relevanten Ländern,
• - Erfassen wenigstens eines Applikationsparameters, korrelierend mit der für die Regulationssituation relevanten Softwareapplikationen,
• - Auswahl von Regulationsfragen aus einem Regulations-Fragenkatalog auf Basis des erfassten wenigstens einen Länderparameters und auf Basis des erfassten wenigstens einen Applikationsparameters,
• - Zusammenstellen der ausgewählten Regulationsfragen in einem individualisierten Fragebogen,
• - Ausgeben des individualisierten Fragebogens zur Beantwortung der ausgewählten Regulationsfragen.

According to the invention, a method is now proposed in order to automate at least part of the checking of the regulation situation. The part to be automated is the creation of an individualized questionnaire in order to subsequently check the respective regulation situation using a method according to the invention. Such a procedure consists of the following steps:

• - Recording at least one country parameter, correlating with countries relevant for the regulatory situation,
• - Detection of at least one application parameter, correlating with the software application relevant to the regulation situation,
• - Selection of regulatory questions from a regulatory questionnaire based on the recorded at least one country parameter and on the basis of the recorded at least one application parameter,
• - compilation of the selected regulation questions in an individualized questionnaire,
• - Issuing the individualized questionnaire to answer the selected regulation questions.

The core idea according to the invention is that in a first step parameters are recorded which are specific to the respective regulation situation. These are at least country parameters and application parameters. In the simplest case, a country parameter is to be understood as the name of the respective country. For example, country parameters can correlate with the individual countries, i.e. Germany, the USA, India or the like. However, such country parameters can also be broken down even more finely, for example in Germany to individual federal states, if this makes differences in the respective federal state for regulatory situations.

In the context of the present invention, application parameters are all parameters which the software application has and which are related to the regulation situation. One possibility for an application parameter is, for example, the type of data that is to be used in the software application. However, such information can also be understood as application parameters, which is used for using the data, for evaluating the data or for displaying the data. It is thus possible that, just as for each country, two or more application parameters can also be recorded for each software application.

The detection according to the invention can take place, for example, using a detection aid. If the method is web-based, for example, a user of a method according to the invention can manually enter the country parameters and the application parameters in an input mask for the subsequent recording. However, it is also possible to actively tap for the recording, for example the country parameters via the IP address used or the application parameters by reading out a corresponding software description.

As soon as the recording steps of a method according to the invention have been carried out, a structural basis for the regulatory situation to be checked is available on the basis of the compilation of the country parameters and the application parameters. The country parameters and the application parameters therefore contain the information as to which regulatory situations are relevant in which countries and for which application. It is therefore now possible to select individual regulatory questions from a regulatory questionnaire based on the recorded country parameters and the recorded application parameters. As will be explained later, the regulatory questionnaire can have each regulatory question stored in such a way that it has a correlation to country and application parameters relevant to it. To make it easier to understand, a brief example is given below. For example, it may be relevant for compliance with the GDPR in Germany whether personal data is stored or not. A corresponding regulation question would therefore be: “Are personal data stored in the software product?”. This regulatory question is relevant in the GDPR, so that “Germany” as a country parameter correlates with this question. If this question is also relevant in other countries, other country parameters, for example the USA or India, can of course also be stored for the same regulation question in the regulation questionnaire. In addition, it is also relevant whether the software application actually stores such personal data or is related to it. If a software application is not aimed at users, then the question should not be asked. It can also be checked to what extent the origin of the users in different countries leads to different ratings. For example, US citizen data needs to be handled differently in the US than the same data in the EU. It can therefore make sense to store the application parameter "user reference" in addition to this regulation question in the regulation questionnaire. If "Germany" is selected as the country parameter in the entry step and "User reference" as the application parameter, then this regulation question is selected for the individualized questionnaire in the selection step.

As soon as the regulation questions have been selected on the basis of all recorded country parameters and application parameters, they are compiled in an individualized questionnaire and then issued. Since the method according to the invention advantageously runs on a web platform, the compilation is also web-based and the output is, for example, on the screen of a user device. Subsequently, the recording of answers to the individualized questionnaire can also be carried out web-based in a follow-up procedure. It is also possible for feedback to be provided between the answer steps and the individualized questionnaire.

The core idea according to the invention is now to create an interface between the manual description of the current regulation situation and an automated and, above all, standardized creation of an individualized questionnaire. As has already been explained, the recording steps can be carried out by manual input by one or more users, but also in an automated or partially automated manner. The decisive advantage of the present invention is that now, independently of the actual regulation situation, a uniform method according to the invention can be used for all different, highly complex regulation situations. The end result is that the individualized questionnaire is standardized and automatically includes the query of all necessary details even in complex regulatory situations for a large number of countries and for a large number of software applications, so that now in comparison to known solutions and the manual procedure according to the State of the art, which can be answered with a high level of security and in a standardized manner. As has also already been mentioned, the evaluation in a subsequent step can be automated or at least partially automated through the standardized design of a nevertheless individualized questionnaire.

In addition to the simplified recording of highly complex regulatory situations, this leads to increased security, since it is ensured that no relevant regulatory question is forgotten, since the selection of the regulatory questions is automated based on the recorded parameters.

There can be advantages if, in a method according to the invention, at least one company form parameter is additionally recorded, correlating with company forms relevant to the regulation situation, the recorded at least one company form parameter being taken into account in the selection of the regulation questions. This means that an additional dimension of the complexity of the regulatory situation becomes comprehensible. A different standard can be relevant for different forms of society. For example, in Germany GmbH companies have different legal bases than stock corporations or companies under civil law. The same applies, of course, to other countries. Here it is already easy to see how the individual parameters can influence each other. For example, company form parameters may depend on the respective country parameter, since there are different company forms in Anglo-Saxon countries than is the case in Germany, for example. The integration of an additional parameter in the form of the company form parameter leads to a further possibility of making the questionnaire available automatically in an individualized form as specifically as possible.

It is also advantageous if, in a method according to the invention, the regulatory questionnaire has at least one country parameter and/or one application parameter, in particular also a company form parameter, for each regulatory question. In other words, the individual parameters have "tags" that explain the individual regulatory questions in more detail. During the selection step, this allows a simple comparison to be made as to which regulatory question is stored for which country parameters, which application parameters and/or which company form parameters. In this way, the regulation questionnaire can serve as a basis for comparison for the selection of all regulation questions by means of a simple and, above all, automated comparison step. Of course, individual regulation questions can also have two or more different parameters of the same or different type. In principle, two or more parameter values for a specific parameter are also conceivable here. For example, the use of personal data in Germany, in the USA, but also in India can be relevant as a country parameter as an application parameter, so that this regulation question has stored these three different countries as country parameters.

It is also advantageous if, in a method according to the invention, the selected regulation questions are checked for double selection and regulation questions selected twice are not compiled in the individualized questionnaire and/or are deleted from the individualized questionnaire. In order to ensure that the individualized questionnaire is as lean as possible, double naming of regulation questions is avoided in this embodiment. It is irrelevant whether the selection is made sequentially for each parameter one after the other or in parallel. In principle, when processing each regulation question sequentially, it can be checked whether it has already been selected for another parameter in a sequentially preceding step, so that a double selection can be ruled out. If the selection is made in parallel, this avoidance of duplication can also be applied to the individualized questionnaire that has already been compiled, so that regulation questions that have been included twice in the compiled individualized questionnaire are again reduced to a single one of these regulation questions.

It is also advantageous if, in a method according to the invention, the regulatory questions in the regulatory questionnaire are in the form of yes/no questions. This further reduces the effort involved in answering following a method according to the invention. This ensures that no ambiguities arise when the questions are subsequently answered. It can also be ensured that possible inaccuracies in the selection for different countries and/or different software applications can be effectively avoided. This compilation and design of the regulation questions as yes/no questions can be done manually when the method is being worked out, but also in an automated or partially automated manner on the basis of detectable regulation situations. The evaluation, in particular in an automated manner, for the answered regulation questions is also further supported by the yes/no formation of the regulation questions.

It is also advantageous if, in a method according to the invention, the individualized questionnaire has the selected regulatory questions together with the recorded country parameter, the recorded application parameter and/or a recorded company parameter. This makes it possible to further increase the transparency in the individualized questionnaire, so that in particular it is also possible to display these parameters when the individualized questionnaire is output. The references of the respective regulation question to the respective parameter are thus visible to a user of the method and it is also possible to clearly display avoided duplication in the form of an existing overlap for different parameters in one and the same regulation question.

It can also bring advantages if, in a method according to the invention, a responsibility value is determined on the basis of the recorded country parameter, the recorded application parameter and/or a recorded company form parameter for at least one selected regulation question, in particular for all selected regulation questions, and is added to the individualized questionnaire. An accountability value is a value that assigns responsibility. For example, in a company, the responsibility value can define a person, a correspondingly responsible department or a responsible company for answering this regulation question. It is of course also possible for two or more different responsibility values to be made available for one and the same regulation question. This makes it possible to highlight for the subsequent answering step at which position and by which company, department and/or person the answer for the regulation question selected and integrated into the individualized questionnaire must be given. In this case, the recording of two or more regulation responses to one and the same regulation question can also be permitted if two or more responsibility values are specified accordingly.

It is also advantageous if, in a method according to the invention, a specific, individualized questionnaire is compiled and output for at least one country parameter, for at least one application parameter and/or for at least one company parameter. In other words, it becomes possible to compile and issue a specific individualized questionnaire for the respective country, for the respective software application and/or for the respective company. In particular, this is combined with the responsibility value according to the previous paragraph. It is therefore possible to further specify the individualized questionnaire and, in particular, to split it up into sub-questionnaires, so that the respective person, the respective country, the respective application manager or the respective company only receives those selected regulation questions in the specific, individualized questionnaire that they also receive actually have to be answered. The acceptance of answering individualized questionnaires generated in this way increases significantly, since it is ensured that each user of an individualized questionnaire generated by the method according to the invention actually only receives the questions that are also relevant to him.

There are further advantages if, in a method according to the invention, regulation responses to regulation questions stored in the past are assigned to the respective regulation question when compiling the individualized questionnaire. This allows additional information to be kept ready when compiling and above all when outputting the individualized questionnaire, namely about a past response. For example, the method according to the invention can be carried out regularly once a year, so that the respective user receives the information about the correspondingly stored old regulation answers when answering the individualized questionnaire. A stored regulation response can also include the fact that no regulation response was given at the time. It is also conceivable to always assign the last regulation answer or the entire history of regulation answers to the respective regulation question.

There are further advantages if, in a method according to the invention, the steps of detection, selection, compilation and output are carried out at least partially in a communication network. Such a method can thus be made available as a server-based solution and set up on a web-based platform, for example. The user can now have access to the method according to the invention on a corresponding access device, a mobile phone, a tablet computer, but also in the classic way a desktop computer and can interact with the method at the acquisition interface and/or at the output interface. This makes it possible to make the method available to different users at different locations, in particular in a cloud-based solution.

• - Erfassen wenigstens einer neuen und/oder wenigstens einer geänderten Regulationsfrage,
• - Erfassen wenigstens eines Länderparameters, eines Applikationsparameters und/oder eines Gesellschaftsformparameters für die erfasste Regulationsfrage,
• - Einbinden der erfassten Regulationsfrage in den Regulations-Fragenkatalog.

Another object of the present invention is a customization method for customizing a regulatory questionnaire for use in a method according to the present invention, comprising the following steps:

• - recording at least one new and/or at least one changed regulation question,
• - Recording at least one country parameter, one application parameter and/or one company form parameter for the recorded regulation question,
• - Inclusion of the recorded regulation question in the regulation question catalogue.

An adaptation method according to the invention brings with it the same advantages as have been explained in detail with reference to a method for creating according to the invention. The adjustment procedure can also be understood as an update procedure or maintenance procedure for the regulation questionnaire. It serves to integrate new regulation questions or to map changed regulation questions, which are based on a changed legal situation, in the regulation questionnaire. This makes it possible, particularly in a centralized manner within the framework of the use of a communication network, to keep the regulatory questionnaire continuously up to date.

It is advantageous if a set of new regulation questions is recorded in such an adjustment procedure. If, for example, a new standard or a new law is enacted as a basis for regulation, a set of new regulation questions can map this new standard and be integrated into the regulation questionnaire through the adjustment process.

The subject matter of the present invention is also a computer program product, comprising instructions which, when the program is executed by a computer, cause the computer to carry out a method according to the present invention or an adaptation method according to the present invention. A computer program product according to the invention thus brings with it the same advantages as have been explained in detail with reference to the methods mentioned. Such a computer program product can be designed specifically for the creation method, specifically for the adaptation method or combined for both method variants.

In addition, an object of the present invention is a creation system for creating an individualized questionnaire for checking a regulation situation. This creation system has an acquisition module for acquiring at least one country parameter, correlating with countries relevant to the regulatory situation, and for acquiring at least one application parameter, correlating with software applications relevant for the regulatory situation. The creation system is also equipped with a selection module for selecting regulatory questions from a regulatory questionnaire based on the recorded at least one country parameter and on the basis of the recorded at least one application parameter. The creation system also has a compilation module for compiling the selected regulation questions in an individualized questionnaire and an output module for outputting the individualized questionnaire for answering the selected regulation questions. A creation system according to the invention thus brings with it the same advantages as have been explained in detail with reference to a method according to the invention.

• 1 ein erfindungsgemäßes Erstellungssystem,
• 2 eine weitere Ausführungsform eines erfindungsgemäßen Erstellungssystems,
• 3 eine mögliche Ausgestaltung eines Regulations-Fragenkatalogs,
• 4 eine Vermeidung doppelter Regulationsfragen in einem individualisierten Fragebogen,
• 5 eine weitere Ausführungsform eines individualisierten Fragebogens,
• 6 eine weitere Ausführungsform eines erfindungsgemäßen individualisierten Fragebogens,
• 7 eine Aufspaltung eines individualisierten Fragebogens der vorliegenden Erfindung,
• 8 eine weitere Ausführungsform eines erfindungsgemäßen individualisierten Fragebogens.

Further advantages, features and details of the invention result from the following description, in which exemplary embodiments of the invention are described in detail with reference to the drawings. The features mentioned in the claims and in the description can each be essential to the invention individually or in any combination.

• 1 a creation system according to the invention,
• 2 a further embodiment of a creation system according to the invention,
• 3 a possible design of a regulatory questionnaire,
• 4 an avoidance of double regulation questions in an individualized questionnaire,
• 5 another embodiment of an individualized questionnaire,
• 6 a further embodiment of an individualized questionnaire according to the invention,
• 7 a breakdown of an individualized questionnaire of the present invention,
• 8th another embodiment of an individualized questionnaire according to the invention.

1 shows schematically how a method according to the invention can proceed. A detection interface is provided here with the help of the detection module 20, which can be designed, for example, in a web-based design as an input mask on an input device. The user of the method and of the creation system 10 can now enter country parameters LP and application parameters AP. As soon as country parameters LP and application parameters AP have been recorded by the recording module 20, the selection step according to the invention can be carried out using the selection module 30 from the RFK regulation questionnaire. One or more selected regulation questions RF are then forwarded to the compilation module 40 and compiled there to form an individualized questionnaire IF, which is now specific to the recorded country parameters LP and application parameters AP. In the final step, the creation system 10 now uses the output module 50 to output the individualized questionnaire IF that has been created. This is preferably also done web-based on a display device of the user's terminal device.

The 1 shows the course of the process in a creation system 10 in a communication network 100, ie as a server-based solution. The creation system 10 can thus be integrated into a web-based platform and only the acquisition module 20 and the output module 50 can represent the corresponding web-based interfaces for the user of a method according to the invention.

2 essentially corresponds to a creation system according to the 1 . However, it is also possible to record a company form parameter GP here, so that even more complex regulatory situations can be described and recorded. The individualized questionnaire IF in the output module 50 now reflects this even more complex regulation situation in the same way.

The 3 shows schematically further details of how a regulatory questionnaire RFK can be structured, which in the embodiments of 1 and 2 can be put to use. A large number of different regulation questions RF are arranged in a list here in tabular form, with at least one country parameter LP, at least one application parameter AP and at least one company parameter GP being stored for each regulation question RF. Thus, after the recording step, a simple comparison in the RFK regulation questionnaire can be used to select the correspondingly relevant RF regulation questions.

The 4 shows a result of such a comparison, so that the individualized questionnaire IF now has a large number of, in 4 arranged one below the other in a list, has regulation questions RF. Due to the fact that some regulation questions RF are selected twice for a large number of different country parameters LP or a large number of different application parameters AP 4 how to avoid such duplications. For example, a test step can be carried out which, as in 4 shown, duplicated regulation questions RF deleted from the compiled individualized questionnaire IF.

The 5 gives an example for further details regarding the individualized questionnaire IF. The regulation questions RF are in the form of yes/no questions here, so that they can be answered very easily, with a high degree of certainty and, above all, in a standardized manner, but they can also be evaluated. In addition, it is possible here to output the relevant country parameters LP, application parameters AP and company form parameters GP for each regulation question RF.

The embodiment of 6 goes one step further. A responsibility value VW is specified here for each regulation question RF, which contains a definition of where the responsibility for answering this regulation question RF lies. This can be in a common list according to the 6 be shown, but in particular in a split structure according to 7 . This is how it shows 7 the individual questionnaire IF der 6 , which in a subsequent step is split into three different sub-questionnaires, for example, which combine different responsibility values VW with one another, for example. This ensures that every person responsible or every responsible position only receives the part of the questionnaire for which he is also responsible and which he is therefore responsible for answering.

In the 8th a further embodiment is shown, in which a regulation response RA stored from the past is additionally included in the individualized questionnaire IF.

The above explanation describes the present invention solely within the framework of examples. It goes without saying that individual features of the embodiments can be freely combined with one another, insofar as this makes technical sense, without departing from the scope of the present invention.

Reference List

10

creation system

20

acquisition module

30

selection module

40

compilation module

50

output module

100

communication network

RF

regulation issue

RFK

Regulation Questionnaire

RA

regulatory response

IF

individualized questionnaire

LP

country parameters

AP

application parameters

gp

company form parameters

VW

accountability value

Claims (14)

Procedure for creating an individualized questionnaire (IF) to review a regulatory situation: - Recording at least one country parameter (LP) correlating with countries relevant to the regulatory situation, - Recording at least one application parameter (AP) correlating with software applications relevant to the regulation situation, - Selection of regulatory questions (RF) from a regulatory questionnaire (RFK) based on the recorded at least one country parameter (LP) and on the basis of the recorded at least one application parameter (AP), - Compilation of the selected regulation questions (RF) in an individualized questionnaire (IF), - Output of the individualized questionnaire (IF) to answer the selected regulation questions (RF). procedure after claim 1 , characterized in that in addition at least one company form parameter (GP) is recorded correlating with company forms relevant to the regulation situation, the recorded at least one company form parameter (GP) being taken into account in the selection of the regulation questions (RF). Method according to one of the preceding claims, characterized in that the regulation questionnaire (RFK) has at least one country parameter (LP) and/or one application parameter (AP), in particular also a company form parameter (GP), for each regulation question (RF). Method according to one of the preceding claims, characterized in that the selected regulation questions (RF) are checked for double selection and regulation questions (RF) selected twice are not compiled in the individualized questionnaire (IF) and/or are deleted from the individualized questionnaire (IF). . Method according to one of the preceding claims, characterized in that the regulation questions (RF) in the regulation questionnaire (RFK) are in the form of yes/no questions. Method according to one of the preceding claims, characterized in that the individualized questionnaire (IF) has the selected regulation questions (RF) together with the recorded country parameter (LP), the recorded application parameter (AP) and/or a recorded company form parameter (GP). Method according to one of the preceding claims, characterized in that on the basis of the recorded country parameter (LP), the recorded application parameter (AP) and/or a recorded company form parameter (GP) for at least one selected regulation question (RF), in particular for all selected regulation questions ( RF), a responsibility value (VW) is determined and added to the individualized questionnaire (IF). Method according to one of the preceding claims, characterized in that a specific, individualized questionnaire (IF) is compiled and output for at least one country parameter (LP), for at least one application parameter (AP) and/or for at least one company parameter (GP). Method according to one of the preceding claims, characterized in that regulation answers (RA) stored in the past to regulation questions (RF) are assigned to the respective regulation question (RF) when the individualized questionnaire (IF) is compiled. Method according to one of the preceding claims, characterized in that the steps of detection, selection, compilation and output are carried out at least partially in a communications network (100). Adaptation method for adapting a regulation questionnaire (RFK) for use in a method with the characteristics of one of the Claims 1 until 10 , having the following steps: - recording at least one new and/or at least one changed regulation question (RF), - recording at least one country parameter (LP), one application parameter (AP) and/or one company form parameter (GP) for the recorded regulation question (RF ), - Integrating the recorded regulation question (RF) into the regulation questionnaire (RFK). adjustment procedure claim 11 , characterized in that a set of new regulation questions (RF) is recorded. Computer program product, comprising instructions which, when the program is executed by a computer, cause the computer to carry out a method with the characteristics of one of Claims 1 until 10 and/or an adaptation process having the characteristics of one of the Claims 11 or 12 to execute. Creation system (10) for creating an individualized questionnaire (IF) for checking a regulatory situation, having a detection module (20) for detecting at least one country parameter (LP) correlating with countries relevant to the regulatory situation and for detecting at least one application parameter (AP) correlating with for software applications relevant to the regulatory situation, further comprising a selection module (30) for selecting regulatory questions (RF) from a regulatory questionnaire (RFK) on the basis of the recorded at least one country parameter (LP) and on the basis of the recorded at least one application parameter (AP), further having a compilation module (40) for assembling the selected regulation questions (RF) in an individualized questionnaire (IF), further having an output module (50) for outputting the individualized questionnaire (IF) to answer the selected regulation questions (RF).

Images