ORION: An Organizational Risk Intelligence Platform with Rule-Based Scoring and Isolation Forest Anomaly Detection for Multi-Department Risk Monitoring

Abstract

Organizations monitor financial, human-resource, IT, operational and customer risks in separate spreadsheets and tools, so a risk in one department is reported in a different format and at a different time from a risk in another, and unusual transactions are found late. This paper presents ORION, an organizational risk intelligence platform that brings the five departments into one web application. Records are imported through a form or a bulk file, validated and cleaned, and stored in a unified database. A rule engine adds the weights of triggered conditions, such as a high amount, unusual timing or a suspicious merchant or location, into a risk score from 0 to 100 that is classified as Low, Medium, High or Critical and gives the reasons for a flag. An Isolation Forest model gives a second, unsupervised anomaly score for the same transaction. Department dashboards show key indicators, a severity index, trends and live alerts, and an audit view lets a reviewer approve, flag or block. Access is controlled by role and department with bcrypt-hashed passwords and signed tokens. The platform is built with React, Node.js, Express and MongoDB. The architecture, algorithms and prototype are described, and a reproducible evaluation plan is given.

Introduction

The paper proposes ORION (Organizational Risk Intelligence Platform), a unified risk management system designed to identify, monitor and manage risks across different departments of an organization.

In many organizations, departments such as Finance, Human Resources, IT, Operations and Customer Relationship Management (CRM) manage risks using separate tools and spreadsheets. This makes it difficult to monitor the overall organizational risk in one place and identify suspicious activities quickly.

ORION aims to solve this problem by combining all departmental data into a single database and dashboard. It uses a rule-based scoring system and machine learning anomaly detection to identify suspicious transactions, generate alerts and recommend actions.

1. Literature Survey

The proposed system is based on existing research and standards related to organizational risk management, fraud detection, machine learning and cybersecurity.

Important technologies and references include:

• COSO Framework: Provides guidelines for identifying, assessing and managing organizational risks.

• ISO 31000: Provides principles for risk management and continuous monitoring.

• Anomaly Detection: Identifies unusual patterns in organizational data.

• Fraud Detection: Uses statistical and machine learning techniques to identify suspicious transactions.

• Isolation Forest: Detects unusual records without requiring labelled training data.

• JWT: Provides signed authentication tokens containing user information and access permissions.

• Bcrypt: Protects stored passwords through secure password hashing.

• NIST AI RMF: Provides guidelines for responsible and trustworthy AI risk management.

2. Problem Statement and Research Gap

Most existing risk management systems focus on individual departments or specific types of risks.

The major problems are:

• Departments maintain separate risk records.

• There is no centralized platform for monitoring all organizational risks.

• Existing anomaly detection systems mainly provide scores without explaining why a transaction is suspicious.

• Alerts and recommended actions are not integrated into a single monitoring process.

• Sensitive departmental information is not always managed through department-specific access controls.

ORION addresses these gaps by providing centralized monitoring, explainable risk scores, anomaly detection and role-based access control.

3. Proposed System

ORION is a centralized organizational risk intelligence platform that monitors five major departments:

1. Finance

2. Human Resources (HR)

3. Information Technology (IT)

4. Operations

5. Customer Relationship Management (CRM)

The system collects departmental records, analyzes them using risk assessment techniques and displays the results through a common dashboard.

4. Main Features

A. Data Collection and Processing

• Imports records through manual forms and bulk file uploads.

• Validates and cleans the collected data.

• Stores all departmental records in a centralized MongoDB database.

B. Rule-Based Risk Scoring

A rule engine assigns every transaction a risk score between 0 and 100.

The risk is classified into four levels:

• Low

• Medium

• High

• Critical

The system also provides reasons explaining why a particular transaction was flagged.

C. Machine Learning Anomaly Detection

The system uses the Isolation Forest algorithm to identify unusual transactions and activities.

It generates an independent anomaly score that helps identify suspicious records that may not be detected by predefined rules.

D. Dashboard and Alerts

The React dashboard provides:

• Department-wise risk indicators.

• Overall organizational risk levels.

• Risk trends and statistics.

• Suspicious transaction alerts.

• Recommended actions.

• Audit and review information.

E. Security and Access Control

ORION uses:

• Bcrypt for password hashing.

• JSON Web Tokens (JWT) for authentication.

• Role-based access control.

• Department-based access restrictions.

This ensures that users can access only the departments and functions assigned to them.

5. System Architecture

The proposed ORION architecture consists of five main layers:

1. Data Import and Preprocessing Layer: Collects, validates, cleans and transforms departmental records.

2. Database Layer: Uses MongoDB to store centralized organizational data.

3. Risk Analysis Layer: Uses Node.js and Express.js to calculate rule-based risk scores and perform anomaly detection.

4. Dashboard Layer: Uses React.js to display department-wise information, alerts and recommendations.

5. Security Layer: Handles authentication, password protection and department-based access permissions.

6. Objectives

The main objectives of ORION are:

• Develop a centralized platform for organizational risk management.

• Import and manage data from five different departments.

• Assign risk scores between 0 and 100.

• Classify risks into Low, Medium, High and Critical categories.

• Implement Isolation Forest for anomaly detection.

• Generate alerts and recommended actions.

• Provide a centralized dashboard with risk trends and indicators.

• Allow authorized users to approve, flag or block transactions.

• Implement secure role-based and department-based access control.

• Evaluate the system using a reproducible testing methodology.

7. Advantages

• Centralizes risk monitoring across multiple departments.

• Identifies suspicious transactions and unusual activities.

• Provides explainable risk scores.

• Combines rule-based analysis with machine learning.

• Generates real-time-style alerts and recommendations.

• Improves organizational decision-making.

• Protects sensitive departmental information.

• Maintains audit records of review decisions.

8. Technologies Used

Conclusion

ORION combines data import and preprocessing, a weighted rule engine with stated reasons, an Isolation Forest anomaly check, department dashboards with alerts and recommendations, and role- and department-based access control in one platform, functions that existing tools provide separately. Future work includes the quantitative evaluation described above, calibration of the rule weights from audited data, predictive models that warn before a risk occurs, industry-specific indicators for healthcare, banking, manufacturing and retail, automated responses to critical risks, graph-based detection of related accounts [9], richer reports and trend analysis, and cloud deployment.

References

[1] Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management — Integrating with Strategy and Performance, 2017. [2] International Organization for Standardization, ISO 31000:2018 Risk Management — Guidelines, 2018. [3] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM Comput. Surv., vol. 41, no. 3, Art. 15, 2009. [4] R. J. Bolton and D. J. Hand, “Statistical fraud detection: A review,” Stat. Sci., vol. 17, no. 3, pp. 235–255, 2002. [5] E. W. T. Ngai, Y. Hu, Y. H. Wong, Y. Chen, and X. Sun, “The application of data mining techniques in financial fraud detection: A classification framework and an academic review of literature,” Decis. Support Syst., vol. 50, no. 3, pp. 559–569, 2011. [6] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. 8th IEEE Int. Conf. Data Mining (ICDM), 2008, pp. 413–422. [7] T. Saito and M. Rehmsmeier, “The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets,” PLOS ONE, vol. 10, no. 3, e0118432, 2015. [8] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, 2023. [9] L. Akoglu, H. Tong, and D. Koutra, “Graph based anomaly detection and description: A survey,” Data Min. Knowl. Discov., vol. 29, pp. 626–688, 2015. [10] I. H. Sarker, “Machine learning: Algorithms, real-world applications and research directions,” SN Comput. Sci., vol. 2, Art. 160, 2021. [11] M. Jones, J. Bradley, and N. Sakimura, “JSON Web Token (JWT),” IETF RFC 7519, May 2015. [12] N. Provos and D. Mazières, “A future-adaptable password scheme,” in Proc. USENIX Annu. Tech. Conf., 1999, pp. 81–91.

Copyright

Copyright © 2026 Mangai K, Deepak M, Gokul Raj C, Chandra Mouli N. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.