JP5397111B2 - Information processing system - Google Patents

Description

  The present invention relates to an information processing system, an information processing apparatus, and an information processing program.

Risk management is systematically performed as part of corporate control activities.
As a related technology, for example, Patent Document 1 integrates each risk of quality, environment, occupational safety and health, and CSR (Corporate Social Responsibility) related to a company, and conducts business activities from damage due to the risk. The objective is to provide an integrated assessment and control table that protects and enhances corporate social responsibility and provides management aimed at sustainable growth. Multiple risk assessment items and risk control items for entering the results of the risk reduction activities to be managed. The multiple risk assessment items are at least quality risk assessment and occupational safety and health risk. Assessment, environmental risk assessment DOO, information security risk assessment made CSR assessment by businesses to take advantage of this, can control the risk in business activities more highly, it is disclosed that can protect survival and existence of the company.

JP 2006-110978 A

  The present invention relates to an information processing system, an information processing device, and an information processing device that make it possible to determine whether or not to control separately performed when each control activity is performed in a plurality of control processing devices. The purpose is to provide an information processing program.

The gist of the present invention for achieving the object lies in the inventions of the following items.
According to the first aspect of the present invention, there is provided a request receiving means for receiving a request for information relating to an activity from a control processing device that performs a process relating to control of the activity with respect to an activity information storage device storing information relating to the activity; If the object of the first request from the first control processing device received by the receiving means is the same as the object of the second request from the second control processing device received by the request receiving means, the first An information processing apparatus comprising integrated determination notification means for notifying one control processing apparatus or the second control processing apparatus to determine whether or not to control control for the activity should be integrated; An instruction receiving unit that is connected to the apparatus and receives from the information processing apparatus an instruction to determine whether or not to control the control over the activity; and to the instruction receiving unit On the basis of the received instruction, any one of the annual period of the control over the activity, the method of sampling the voucher in the control over the activity, the evaluation procedure type in the control over the activity, and the purpose of the control over the control over the activity An information processing system comprising a plurality of control processing devices including determination means for determining whether to integrate controls based on one or more.

  According to the information processing system of the first aspect, when each control activity is performed in a plurality of control processing apparatuses, it is possible to determine whether or not the separately performed controls should be integrated. It becomes like this.

It is a conceptual module block diagram about the structural example of this Embodiment. It is a flowchart which shows the process example by the population data acquisition monitoring module of this Embodiment. It is explanatory drawing which shows the example of a data structure of population acquisition log | history DB. It is a flowchart which shows the process example by the similar control detection module of this Embodiment. It is a flowchart which shows the process example by the population data acquisition monitoring module of this Embodiment. It is a flowchart which shows the process example by the other similar control detection module of this Embodiment. It is a flowchart which shows another example of a process by the similar control detection module of this Embodiment. It is explanatory drawing which shows the example of a correction recommendation display screen. It is explanatory drawing which shows the example of a data structure of a person in charge table. It is explanatory drawing which shows the example of a data structure of a contact address table. It is a block diagram which shows the hardware structural example of the computer which implement | achieves this Embodiment.

First, financial internal control will be described as an example of corporate control activities that are the subject of this embodiment.
In recent years, financial internal control has been required. With regard to the financial internal control, “Internal Control – Integrated Framework” announced by COSO (Treadway Committee Organizing Committee) in 1992 has become the de facto standard.・ Board of Directors, Management and other organizations intended to provide reasonable assurance to achieve three objectives: efficiency, (2) reliability of financial statements, and (3) compliance with relevant laws and regulations. It is defined as "one process carried out by staff".
In financial internal control, it is necessary to organize the relationship between activities / systems / resources / knowledge information and document business processes. There are four documents for financial internal control: business description, business flow diagram, RCM (risk control matrix), and separation of duties table.

First, “Basic 4 Documents” of internal control will be described.
The four basic documents are basic documents created for each business process subject to financial internal control. Specifically, a business description, a business flow diagram, an RCM (risk control matrix), a job There is a separation table.
The business description is also called narrative. This is a documented flow of a series of operations from the start of the transaction to the final entry to the general ledger and reporting. Regulatory documents such as personnel regulations and accounting business regulations are higher-level documents of the business description, and the revision affects the business description. The business manual is a sub-document of the business description and is affected by the revision.
The business flow diagram is a visual flowchart of a series of business flows from the start of a transaction to the final entry to the general ledger and reporting. Risk and control are also placed on this flow.
The RCM (Risk Control Matrix) is a summary of internal control activities related to business processes, a summary of the control points to be achieved (assertion), assumed risks, and corresponding internal control activities. It is. In other words, it describes a pair of risk and control that reduces it.
The segregation of duties table is used to check whether there is a duplication of processing by the same person in charge in the flow of business processes, which causes a problem in financial control.
Assertion is a precondition for financial information to be considered as reliable information. Specifically, reality, completeness, attribution of rights and obligations, validity of evaluation, period allocation The six items of adequacy and validity of display are generally used, but it is desirable that they can be customized because there are some changes by each company or audit corporation. In addition, financial risks need to be covered from the viewpoint of assertion, and it can be said that a risk corresponding to one of these six assertions is highly important.
Risk refers to an impediment to assertions assumed in business processes.
Control refers to internal control activities against risks. Control types include preventive and detective.
In addition, in financial internal control, for the document that analyzed the business related to finance and summarized the result, maintenance evaluation to check the correctness and accuracy of the document and the operation to test whether it is operating as documented There are two types of evaluation.
An operational evaluation is to confirm that the activities described in the controls are being implemented correctly. Sample actual corporate activities (transaction activities, etc. in financial internal control, etc.) during the operation evaluation phase, and collect (or request collection) documents (certifications) that prove that the controls were implemented appropriately ) Doing things.

In order to effectively balance the reduction of operational test burden on business control and the increase in maintenance cost burden on IT general control, the following three procedures are required.
(1) Identification of (automated) control using IT system in business control.
(2) Select important controls from the controls in (1) above.
(3) Identify IT systems on which the control in (2) depends. In other words, the target of IT general control is determined.
However, the person in charge of the business control and the IT general control are different from each other, and the timing of the maintenance of the control may differ. Therefore, when the target of the IT system in the IT general control is selected, the above-mentioned feedback (to perform (3) above) In many cases, it is difficult to perform (1) is necessary, and it has been a subjective choice. This embodiment is used in such a situation, that is, when there are a plurality of control processing apparatuses, voucher collection is performed separately in the operation test, and each person in charge is different.

Hereinafter, an example of a preferred embodiment for realizing the present invention will be described with reference to the drawings.
FIG. 1 shows a conceptual module configuration diagram of a configuration example of the present embodiment.
The module generally refers to components such as software (computer program) and hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a computer program but also a module in a hardware configuration. Therefore, the present embodiment also serves as an explanation of a computer program, a system, and a method. However, for the sake of explanation, the words “store”, “store”, and equivalents thereof are used. However, when the embodiment is a computer program, these words are stored in a storage device or stored in memory. It is the control to be stored in the device. In addition, the modules correspond almost one-to-one with the functions. However, in mounting, one module may be composed of one program, or a plurality of modules may be composed of one program. A plurality of programs may be used. The plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include other modules. Hereinafter, “connection” is used not only for physical connection but also for logical connection (data exchange, instruction, reference relationship between data, etc.).
In addition, the system or device is configured by connecting a plurality of computers, hardware, devices, and the like by communication means such as a network (including one-to-one correspondence communication connection), etc., and one computer, hardware, device. The case where it implement | achieves by etc. is included. “Apparatus” and “system” are used as synonymous terms. “Predetermined” means that the process is determined before the target process, and not only before the process according to this embodiment starts but also after the process according to this embodiment starts. In addition, if it is before the target processing, it is used in accordance with the situation / state at that time or with the intention to be decided according to the situation / state up to that point. “Predetermined” means that the process is determined before the target process, and not only before the process according to this embodiment starts but also after the process according to this embodiment starts. In addition, if it is before the target processing, it is used in accordance with the situation / state at that time or with the intention to be decided according to the situation / state up to that point.

  As shown in the example of FIG. 1, the information processing system according to the present embodiment includes an information processing apparatus having a risk management apparatus 110 and a population data acquisition monitoring module 120, and a BPM (Business Process Management system) 130. doing. In the example of FIG. 1, there are a plurality of risk management devices 110 and BPMs 130, but there may be one BPM 130, and the risk management device 110 may have different controls for the same activity. One risk management device 110 may be used as a physical housing. However, even if there is only one risk management device 110 as a physical housing, if there are cases where control is different for the same activity, the present embodiment regards it as a plurality of risk management devices 110. The risk management apparatus 110, the population data acquisition monitoring module 120, and the BPM 130 are connected via a communication line.

  The risk management apparatus 110 performs processing related to activity control. For example, specifically, RMS (Risk Management System), Information Security Management System (hereinafter, also simply referred to as “ISMS”), Quality Management System (Quality Management System), and QMS ”). For example, different RMSs are juxtaposed such that the risk management device 110A is an RMS in financial internal control and the risk management device 110B is an ISMS.

  The risk management device 110 collects population data from the BPM 130 in order to collect evidence of control implementation in the operation test. For example, more specifically, a person in charge of RMS requests a list of target activities (hereinafter also referred to as population data. For example, financial internal control, etc.) from BPM 130 in order to request other persons in charge to collect vouchers. Then, get a list of transactions). Then, sampling is performed from the list and collection activities are carried out. The voucher is evidence that serves as a trail of control activity, and paper slips or the like may include image data that has been scanned and registered.

The BPM 130 stores information regarding activities. It is an information processing apparatus that supports business process operation management, and specifically includes, for example, a workflow system, EAI (Enterprise Application Integration), and the like.
The BPM 130 stores population data, and passes the population data to the risk management device 110 in response to a request from the risk management device 110.

The population data acquisition monitoring module 120 includes a request reception module 121 and an integrated determination module 122, and is connected to the risk management apparatus 110, the population acquisition history DB 125, and the BPM 130.
The request reception module 121 is located between the similar control detection module 115 and the BPM 130, and monitors communication exchanges between the two. That is, a request for information regarding the activity from the risk management apparatus 110 to the BPM 130 is received.
Then, when the target of the first request from the risk management device 110A received by the request receiving module 121 is the same as the target of the second request from the risk management device 110B, the integration judgment module 122 receives the risk management device 110A. The similar control detection module 115A or the similar control detection module 115B of the risk management apparatus 110B is notified of an instruction for making a determination as to whether or not to control the control for the activity. In order to make the determination, the population data acquisition monitoring module 120 stores the received request from the risk management apparatus 110 in the population acquisition history DB 125. When a new request from the risk management apparatus 110 is received, the corresponding request is searched from the request history stored in the population acquisition history DB 125, and if there is a corresponding request, should they be integrated? The similar control detection module 115A or the similar control detection module 115B is notified of an instruction for determining whether or not. The processing performed by the population data acquisition monitoring module 120 will be described later with reference to FIG.

The population acquisition history DB 125 is accessed from the population data acquisition monitoring module 120. The contents of the request received by the population data acquisition monitoring module 120 are stored. For example, the population acquisition history DB 300 is stored. FIG. 3 is an explanatory diagram showing an example of the data structure of the population acquisition history DB 300. The population acquisition history DB 300 includes an ID column 310, an acquisition target activity ID column 320, an acquisition date / time column 330, an acquisition target period column 340, a request source MSID column 350, a request source control ID column 360, and a correction recommended target ID column. 370.
The ID column 310 stores an ID (IDentification) that uniquely identifies a request from the risk management apparatus 110 to the BPM 130.
The acquisition target activity ID column 320 stores a part of the content of the request (the target activity in the population data, specifically, the activity (transaction type)).
The acquisition date / time column 330 stores the date / time when the request or the response to the request was made (may include year, hour / minute / second, etc.).
The acquisition target period column 340 stores a part of the content of the request (the period of the target activity in the population data).
The request source MSID column 350 stores an MSID that uniquely identifies the risk management apparatus 110 that made the request.
The request source control ID column 360 stores a control ID for uniquely identifying a control in the risk management apparatus 110 that made the request.
The correction recommended target ID column 370 stores the ID of another request (ID of the ID column 310) corresponding to the ID of the request (ID of the ID column 310) when correction correction is made.

The similar control detection module 115 in the risk management apparatus 110 includes an instruction receiving module 116 and a determination module 117.
The instruction receiving module 116 receives from the population data acquisition and monitoring module 120 an instruction to determine whether or not to control control over activities.
Then, based on the determination instruction received by the instruction receiving module 116, the determination module 117 includes a fiscal period in the control over the activity, a method of sampling vouchers in the control over the activity, a procedure type of evaluation in the control over the activity, Based on one or more of the control objectives in the control over the activity, a determination is made as to whether the controls should be integrated.
In addition, the determination module 117 in the similar control detection module 115 further determines whether or not to perform any one or more of year period adjustment, sampling method adjustment, procedure type integration, and control purpose integration. May be performed. The processing performed by the similar control detection module 115 will be described later with reference to FIG.

  FIG. 2 is a flowchart illustrating an example of processing performed by the population data acquisition monitoring module 120 according to the present embodiment. As a rough process, the population data acquisition monitoring module 120 monitors the acquisition of population data to the BPM 130 by the risk management apparatus 110, and detects control candidates that can be integrated based on the monitoring results. Note that the processing in step S202 is performed by the request receiving module 121, and the processing from step S204 to step S210 is performed by the integrated determination module 122.

In step S202, a population data acquisition request from the risk management apparatus 110 to the BPM 130 is received.
In step S204, the population data acquisition request received in step S202 is registered in the population acquisition history DB 300. More specifically, the contents of the request are stored in the acquisition target activity ID column 320 and the acquisition target period column 340, and the MSID and control ID of the request source risk management device 110 are respectively stored in the request source MSID column 350 and the request source. Are stored in the control ID column 360. The date and time when the request is received (or the date and time when the BPM 130 returns the population data acquisition request) is stored in the acquisition date and time column 330.

In step S206, it is determined whether or not there is data in the population acquisition history DB in which the combination of “request source MSID, request source control ID” is different and the acquisition target activity ID and the acquisition target period are the same. If there is data, the process proceeds to step S208. Otherwise, the process is terminated (step S299). That is, for example, when there is a population data acquisition request for the same activity from different controls to the BPM 130, it is detected as a duplicate population data acquisition request.
In step S208, it is determined whether or not there is already a correction recommended target ID in either one of the two. If already present, the process ends (step S299), otherwise the process proceeds to step S210. In other words, if corrections such as control integration have been made in accordance with correction recommendations made in the past, they will not be subject to this correction recommendation.
In step S210, a notification that the same population data has been acquired is transmitted to the risk management apparatus 110 that has made the population data acquisition request received in step S202. Moreover, you may transmit to the risk management apparatus 110 which performed the population data acquisition request of the same acquisition object activity ID and acquisition object period at step S206.

  FIG. 4 is a flowchart showing an example of processing performed by the similar control detection module 115 according to the present embodiment. As a rough process, the similar control detection module 115 determines the integration of the control based on the notification (duplicate control information) received from the population data acquisition monitoring module 120 and takes charge of the result as a correction recommendation. The person in charge. Then, upon receiving approval for correction by the person in charge, the similar control detection module 115 executes control integration based on the notified correction recommendation. In addition, each determination process (step S404, step S408, step S412, step S416) in the flowchart is performed by communicating with other risk management devices 110 in addition to the notification received from the population data acquisition monitoring module 120. It may be compared with the information used in the risk management apparatus 110. Note that the process of step S402 is performed by the instruction receiving module 116, and the process from step S404 to step S426 is performed by the determination module 117.

In step S402, the same population data acquisition notification is received from the population data acquisition monitoring module 120.
In step S404, it is determined whether the fiscal periods are the same. If they are the same, the process proceeds to step S408, and otherwise, the process proceeds to step S406. Note that the fiscal year period is a period (year) in which control activities are performed, and is usually determined in units of 110 risk management devices.
Periodic consistency is a prerequisite for the implementation of all recommendations, so it should be a correction recommendation independent of other conditions. Otherwise, it is judged as consistency at a lower level, and the integrated recommendation at the level where the difference is found is implemented.
In step S406, a period matching recommendation is added. Thereafter, the process proceeds to step S408.

In step S408, it is determined whether the sampling method is the same. If they are the same, the process proceeds to step S412; otherwise, the process proceeds to step S410. The sampling method is a method of extracting a sample for evaluation from the population data. Specifically, random sampling or systematic sampling (the first one is selected at random, and so on) Sampling). In addition, the number of items to be sampled and other attribute conditions (such as a monetary amount equal to or more than a predetermined amount) may be included.
In step S410, a sampling method matching recommendation is registered. After this, the process proceeds to step S422.

In step S412, it is determined whether the procedure types are the same. If they are the same, the process proceeds to step S416, and otherwise, the process proceeds to step S414. The procedure type is a method of performing a test at the time of evaluation, and specifically includes collation, browsing, observation, a question, and the like.
In step S414, the collection activity level integration recommendation is registered. After this, the process proceeds to step S422.

In step S416, it is determined whether the control purpose is the same. If they are the same, the process proceeds to step S420, and otherwise, the process proceeds to step S418. The control purpose indicates the purpose controlled by the control, and specifically includes completeness, accuracy, correctness, maintenance continuity, and the like.
In step S418, a test level integration recommendation is registered. After this, the process proceeds to step S422.

In step S420, a control integration recommendation is registered. In other words, if the sampling method, procedure type, and control purpose are the same, an integrated control recommendation is registered.
In step S422, a correction recommendation is transmitted. That is, the recommendation of step S406, step S410, step S414, step S418, and step S420 is used as a correction recommendation, and the similar control detection module 115 of another risk management device 110 (Yes in step S206 in the flowchart illustrated in FIG. 2) In step S 299, the risk management apparatus 110) for which the same population data acquisition notification has not been transmitted is transmitted to the population data acquisition monitoring module 120.

In step S424, it is determined whether approval has been made. If approved, the process proceeds to step S426, and otherwise, the process ends (step S499). Whether or not the person in charge of the risk management apparatus 110 that has performed the processing of the flowchart illustrated in the example of FIG. 4 discusses and approves the person in charge of the other risk management apparatus 110 that transmitted the same correction recommendation in step S422. To decide. The similar control detection module 115 receives the determination result and determines whether or not it is approved.
In step S426, integration of approved controls is executed. For example, the same control is changed between different risk management apparatuses 110. Further, the sampling method and the like may be matched.

FIG. 5 is a flowchart illustrating an example of processing performed by the population data acquisition monitoring module 120 according to the present embodiment.
In step S502, a correction recommendation is received. More specifically, the correction recommendation transmitted in step S422 of the flowchart shown in the example of FIG. 4 is received.
In step S504, the mutual IDs are recorded in the correction recommended target ID column 370 in the population acquisition history DB 300. That is, the mutual ID (ID column 310) is recorded in the risk management device 110 that has transmitted the correction recommendation and the correction recommended target ID column 370 corresponding to the risk management device 110 that has received the correction recommendation. In the example of FIG. 3, “3” is recorded in the correction recommended target ID column 370 of the row whose ID column 310 is “1”, and correction recommended target ID column 370 of the row whose ID column 310 is “3”. “1” is recorded.

FIG. 6 is a flowchart showing an example of processing by the other similar control detection module 115 of the present embodiment. This process is performed by the similar control detection module 115 of another risk management apparatus 110 to which the correction recommendation is transmitted in step S422 of the flowchart shown in the example of FIG.
In step S602, a correction recommendation is received. More specifically, the correction recommendation transmitted in step S422 is received.
In step S604, it is determined whether it has been approved. If approved, the process proceeds to step S606; otherwise, the process ends (step S699). This is the same processing as step S424.
In step S606, control integration is executed. This is the same processing as step S426.

  FIG. 7 is a flowchart illustrating another example of processing performed by the similar control detection module 115 according to the present embodiment. In the flowchart shown in the example of FIG. 4, the term consistency is a precondition for implementation of all recommendations, but it is handled in the same way as the others, and processing is performed so that two or more recommendations may be included. . Note that the process of step S702 is performed by the instruction receiving module 116, and the processes from step S704 to step S728 are performed by the determination module 117.

Each process from step S702 to step S706, step S708, step S712, and step S716 is equivalent to each process from step S402 to step S406 in the flowchart shown in the example of FIG. 4, step S408, step S412, and step S416. is there.
The processing of step S710, step S714, and step S718 differs from the processing of step S410, step S414, and step S418 in the flowchart shown in the example of FIG. 4 immediately after the determination processing (step S708, step S712, and step S716). It is a point to go.

In step S720, it is determined whether there is a matching recommendation or an integrated recommendation. That is, if any of Step S706, Step S710, Step S714, and Step S718 is performed, the process proceeds to Step S724. Otherwise, the process proceeds to Step S722.
Each process from step S722 to step S728 is equivalent to each process from step S420 to step S426 in the flowchart shown in the example of FIG.

FIG. 8 is an explanatory diagram showing a correction recommendation display screen example 800 displayed on the display of the risk management apparatus 110 when the similar control detection module 115 detects or receives a correction recommendation.
A correction recommendation display screen example 800 includes an MSID display column 802, a control ID display column 804, an acquisition target activity ID display column 806, a target period display column 808, a correction recommendation content display column 810, a self MS correction item display column 812, and a partner MS. It has a correction item display field 814, a partner MS person in charge display field 816, a partner MS person in charge telephone number display field 818, and a partner MS person in charge mail address display field 820.
That is, based on the notification received from the population data acquisition monitoring module 120, the target period display field 808 is filled from the MSID display field 802, and the correction recommendation content is displayed based on the processing result of the flowchart shown in FIG. 4 or FIG. The partner MS correction item display column 814 is filled from the column 810.

Then, using the person-in-charge table 900 and the contact table 1000, the partner MS person in charge display field 816, the partner MS person in charge telephone number display field 818, and the partner MS person in charge mail address display field 820 are filled. FIG. 9 is an explanatory diagram showing an example of the data structure of the person-in-charge table 900. The person-in-charge table 900 has an MSID column 910, a control ID column 920, and a person-in-charge ID column 930.
The MSID column 910 stores the MSID of the risk management device 110.
The control ID column 920 stores the control ID of the control in the risk management device 110.
The person-in-charge ID column 930 stores a person-in-charge ID that uniquely identifies the person in charge in charge of the control.
FIG. 10 is an explanatory diagram showing an example of the data structure of the contact address table 1000.
The contact table 1000 includes a person-in-charge ID column 1010, a name column 1020, a contact phone number column 1030, and a contact mail address column 1040.
The person-in-charge ID column 1010 stores the person-in-charge ID of the person in charge.
The name column 1020 stores the name of the person in charge.
The contact telephone number column 1030 stores a telephone number that is a contact address of the person in charge.
The contact e-mail address column 1040 stores an e-mail address that is a contact address of the person in charge.
The similar control detection module 115 extracts a person-in-charge ID from the person-in-charge table 900 based on the MSID and control ID in the notification received from the population data acquisition monitoring module 120, and based on the person-in-charge ID, the contact table 1000 The name, telephone number, and mail address are extracted from the information, and stored in the partner MS person in charge display field 816, the partner MS person in charge telephone number display field 818, and the partner MS person in charge mail address display field 820.

  Note that the hardware configuration of a computer (risk management apparatus 110, information processing apparatus having the population data acquisition monitoring module 120 as a configuration, BPM 130) on which the program according to the present embodiment is executed is illustrated in FIG. A general computer, specifically a personal computer, a computer that can be a server, or the like. That is, as a specific example, the CPU 1101 is used as a processing unit (calculation unit), and the RAM 1102, the ROM 1103, and the HD 1104 are used as storage devices. For example, a hard disk may be used as the HD 1104. CPU 1101 for executing programs such as the population data acquisition monitoring module 120 and the similar control detection module 115, a RAM 1102 for storing the programs and data, a ROM 1103 for storing a program for starting the computer, and the like An HD 1104 as a storage device, an input device 1106 for inputting data such as a keyboard and a mouse, an output device 1105 such as a CRT or a liquid crystal display, a communication line interface 1107 for connecting to a communication network such as a network interface card, and the like , And a bus 1108 for exchanging data by connecting them. A plurality of these computers may be connected to each other via a network.

Among the above-described embodiments, the computer program is a computer program that reads the computer program, which is software, in the hardware configuration system, and the software and hardware resources cooperate with each other. Is realized.
Note that the hardware configuration illustrated in FIG. 11 illustrates one configuration example, and the present embodiment is not limited to the configuration illustrated in FIG. 11, and is a configuration capable of executing the modules described in the present embodiment. I just need it. For example, some modules may be configured by dedicated hardware (for example, ASIC), and some modules may be in an external system and connected via a communication line. A plurality of systems shown in FIG. 5 may be connected to each other via communication lines so as to cooperate with each other. In particular, in addition to personal computers, information appliances, copiers, fax machines, scanners, printers, and multifunction machines (image processing apparatuses having two or more functions of scanners, printers, copiers, fax machines, etc.) Etc. may be incorporated.

In the above-described embodiment, when there is one BPM 130, the population data acquisition monitoring module 120 may be incorporated in the BPM 130.
In the above embodiment, the data structures shown in FIGS. 3, 9, and 10 are not limited to these data structures, and may be other data structures. For example, a link structure or the like may be used instead of the table structure. Further, the data items are not limited to those shown in the drawings, and may have other data items.

The program described above may be provided by being stored in a recording medium, or the program may be provided by communication means. In that case, for example, the above-described program may be regarded as an invention of a “computer-readable recording medium recording the program”.
The “computer-readable recording medium on which a program is recorded” refers to a computer-readable recording medium on which a program is recorded, which is used for program installation, execution, program distribution, and the like.
The recording medium is, for example, a digital versatile disc (DVD), which is a standard established by the DVD Forum, such as “DVD-R, DVD-RW, DVD-RAM,” and DVD + RW. Standard “DVD + R, DVD + RW, etc.”, compact disc (CD), read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), Blu-ray disc ( Blu-ray Disc (registered trademark), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM), flash Includes memory, random access memory (RAM), etc. .
The program or a part of the program may be recorded on the recording medium for storage or distribution. Also, by communication, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wired network used for the Internet, an intranet, an extranet, etc., or wireless communication It may be transmitted using a transmission medium such as a network or a combination of these, or may be carried on a carrier wave.
Furthermore, the program may be a part of another program, or may be recorded on a recording medium together with a separate program. Moreover, it may be divided and recorded on a plurality of recording media. Further, it may be recorded in any manner as long as it can be restored, such as compression or encryption.

DESCRIPTION OF SYMBOLS 110 ... Risk management apparatus 115 ... Similar control detection module 120 ... Population data acquisition monitoring module 125 ... Population acquisition history DB
130 ... BPM

Claims (1)

Request receiving means for receiving a request for information on the activity from the control processing device that performs processing on control of the activity with respect to the activity information storage device storing the information on the activity;
If the subject of the first request from the first control processing device received by the request receiving means is the same as the subject of the second request from the second control processing device received by the request receiving means, An information processing apparatus comprising: an integrated determination notification means for notifying the first control processing apparatus or the second control processing apparatus of an instruction to determine whether or not to control control for the activity should be integrated;
An instruction receiving means connected to the information processing apparatus for receiving from the information processing apparatus a determination instruction as to whether or not to integrate control of control over activities;
Based on the instruction received by the instruction receiving means, the annual period in the control for the activity, the method of sampling the voucher in the control for the activity, the procedure type of the evaluation in the control for the activity, the purpose of the control in the control for the activity An information processing system comprising: a plurality of control processing devices including determination means for determining whether or not to integrate controls based on any one or more of them.

Images