Audit doubt tracking and investigation method and system, computer device and storage medium

Abstract

The application relates to an audit doubt tracking and investigation method, system, computer device and storage medium. The method comprises the following steps: obtaining an investigation direction of an audit doubt and selecting an investigation strategy; if a customized investigation strategy is selected, determining customized investigation steps corresponding to the investigation direction of the audit doubt based on a large model prompt word example, sequentially executing the customized investigation steps based on an audit tool chain table until the number of investigations reaches a set threshold, and outputting an investigation result; if an automatic investigation strategy is selected, the investigation direction of the audit doubt is disassembled by using a large model to obtain corresponding automatic investigation steps; the automatic investigation steps are sequentially executed based on the audit tool chain table until the intermediate result returned when the steps are sequentially executed matches a preset result or the number of investigations reaches a set threshold, and the investigation result is output. The method can realize investigation of the audit doubt without affecting the user and with controllable steps, and improves the investigation efficiency and transparency of the audit doubt.

Description

Technical Field

[0001] This application relates to the field of audit suspicion investigation technology, and in particular to an audit suspicion tracking and investigation method, system, computer equipment and storage medium. Background Technology

[0002] Auditing can help companies effectively review and evaluate their internal operations and management, and effectively manage existing risks.

[0003] In traditional auditing techniques, the process involves auditors manually collecting data, combining it with their business experience to identify potential audit concerns, and then reviewing the data one by one according to the pre-set investigation direction during the actual audit. This traditional approach is inefficient, heavily reliant on subjective factors, and the accumulation and training of judgment rules are challenging. Furthermore, identifying and extracting audit concerns during the audit process requires significant time and resources.

[0004] In existing technologies, audit systems are built to aggregate audit-related document data, which shortens the data collection time. However, existing audit systems are mainly based on audit steps outlined by auditors, who then select matching tools from a large number of audit tools to execute the audit steps. Although this reduces audit time compared to traditional audit methods, it does not significantly improve audit efficiency. Summary of the Invention

[0005] Therefore, it is necessary to provide an audit tracking and investigation method, system, computer equipment, and computer-readable storage medium that can enable users to track and investigate audit suspicious points in a seamless and controllable manner, and improve the efficiency of audit suspicious point investigation.

[0006] Firstly, this application provides a method for tracing and investigating audit irregularities. The method includes:

[0007] Obtain the direction for investigating audit concerns and select an investigation strategy, including customized investigation strategies and automated investigation strategies;

[0008] If a customized investigation strategy is selected, the customized investigation steps corresponding to the investigation direction of the audit suspicion are determined based on the large model prompt word examples generated from the audit file data. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches the set threshold, and the investigation results of the audit suspicion are output.

[0009] If an automated screening strategy is selected, the large model is used to break down the screening direction of the audit suspicions to obtain the corresponding automated screening steps. Based on the constructed audit toolchain, the automated screening steps are executed sequentially until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches the set threshold, and the screening results of the audit suspicions are output.

[0010] In one embodiment, the large model prompt word examples generated based on audit document data include:

[0011] Construct a data repository for the audit files, the data repository including the audit file data;

[0012] Based on the audit document data, at least one investigation direction and at least one investigation method for the investigation direction are determined, wherein the investigation method includes at least one investigation step;

[0013] Based on the at least one investigation direction and at least one investigation method of the investigation direction, the large model is used to generate the large model prompt word sample.

[0014] In one embodiment, the generation of large model prompt word examples based on the at least one investigation direction and the at least one investigation method for the investigation direction includes:

[0015] The audit tool chain is called to traverse the investigation steps of at least one investigation method in the investigation direction to obtain the first result of each investigation step, and the data pairs of the audit file data are generated.

[0016] The large model is used to traverse the data pairs to generate a hash table consisting of different investigation directions as primary keys and at least one investigation method of the investigation direction as the value;

[0017] Traverse the hash table, concatenate each of the investigation steps and the corresponding first results into a complete string to obtain the large model prompt word sample.

[0018] In one embodiment, the customized investigation step corresponding to determining the investigation direction of the audit suspicion includes:

[0019] At least one task step to determine the direction of investigation for the audit suspicion, and call the audit tool interface matched in the audit tool chain to obtain the second result corresponding to the task step;

[0020] The task steps and the corresponding second result are matched with the large model prompt word examples, and the investigation methods matched from the large model prompt word examples and the investigation steps included in the investigation methods are used as customized investigation steps for the audit doubts.

[0021] In one embodiment, before obtaining the direction for investigating audit concerns and selecting whether to perform customized tracking, the method further includes:

[0022] Obtain at least one auditing tool, encapsulate the API interface of the at least one auditing tool, and store the encapsulated auditing tool in the auditing tool chain list after configuring the information. The information configuration includes auditing tool name configuration, interface function name configuration, and interface function description configuration.

[0023] In one embodiment, the automated screening steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches a set threshold, including:

[0024] The audit tool interface matching the current automated investigation step is called from the audit tool chain to obtain the intermediate result returned by the current automated investigation step;

[0025] The intermediate result returned by the current automated investigation step is compared with the preset result. Based on the comparison result, it is selected whether to execute the next automated investigation step. If so, the next automated investigation step is generated using the large model based on the intermediate result, and the intermediate result of the next automated investigation step is compared with the preset result by calling the matching audit tool interface. This process continues until the number of investigations by the automated investigation step reaches a set threshold or the returned intermediate result matches the preset result. If not, the intermediate result returned by the current automated investigation step is used as the investigation result of the audit suspicion.

[0026] In one embodiment, the method further includes:

[0027] Based on the constructed audit toolchain, the customized investigation steps or the automated investigation steps are executed sequentially until a termination command is received, and the investigation results of the audit doubts are output.

[0028] Secondly, this application also provides an audit suspicion tracking and investigation device. The device includes:

[0029] The investigation strategy selection module is used to obtain the investigation direction of audit suspicions and select the investigation strategy, which includes customized investigation strategies and automated investigation strategies.

[0030] The investigation process management module is used to determine the customized investigation steps corresponding to the investigation direction of the audit suspicion point based on the large model prompt word examples generated from the audit document data if a customized investigation strategy is selected. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, and the investigation results of the audit suspicion point are output.

[0031] If an automated screening strategy is selected, the large model is used to break down the screening direction of the audit suspicions to obtain the corresponding automated screening steps. Based on the constructed audit toolchain, the automated screening steps are executed sequentially until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches the set threshold, and the screening results of the audit suspicions are output.

[0032] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the content of the first aspect described above.

[0033] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the content of the first aspect described above.

[0034] The aforementioned audit suspicion tracking and investigation methods, devices, computer equipment, and storage media obtain the investigation direction of audit suspicions and select an investigation strategy. The investigation strategy includes customized and automated investigation strategies. If a customized investigation strategy is selected, based on the obtained large model prompt word examples generated from audit document data, the customized investigation steps corresponding to the investigation direction of the audit suspicion are determined. These customized investigation steps are then executed sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, at which point the investigation result of the audit suspicion is output. If an automated investigation strategy is selected, the large model is used to investigate the audit suspicion... The investigation direction of each point is broken down to obtain corresponding automated investigation steps. Based on the constructed audit toolchain, the automated investigation steps are executed sequentially until the intermediate results returned during sequential execution match the preset results or the number of investigations reaches a set threshold. The investigation results of the audit doubts are then output. By combining customized and automated audit doubt investigation methods and obtaining the audit intermediate results sequentially during automated execution, it is ensured that the audit doubt investigation steps and output results meet expectations. Furthermore, by constructing the audit toolchain, audit doubt investigation is achieved in a user-unobtrusive and step-controllable manner, improving the efficiency and transparency of audit doubt investigation. Attached Figure Description

[0035] Figure 1 This is an application environment diagram of an audit suspicion tracking and investigation method in one embodiment;

[0036] Figure 2 This is a structural block diagram of an audit suspicion tracking and investigation system in one embodiment;

[0037] Figure 3 This is a flowchart illustrating an audit suspicion tracking and investigation method in one embodiment;

[0038] Figure 4 This is a flowchart illustrating the generation of a large model prompt word example in step 302 of one embodiment;

[0039] Figure 5 This is a flowchart illustrating step 403 in one embodiment;

[0040] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0042] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0043] The audit suspicion tracking and investigation method provided in this application embodiment can be applied to, for example, Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. Data storage system 106 can store audit file data that server 104 needs to process. Data storage system 106 can be integrated on server 104, or it can be placed in the cloud or on other network servers.

[0044] On terminal 102, the direction of investigation for audit suspicions is obtained, and an investigation strategy is selected. The investigation strategy includes a customized investigation strategy and an automated investigation strategy. If a customized investigation strategy is selected, the customized investigation steps corresponding to the direction of investigation for the audit suspicion are determined based on the obtained large model prompt word examples generated from the audit document data. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, and the investigation result of the audit suspicion is output. If an automated investigation strategy is selected, the direction of investigation for the audit suspicion is decomposed using the large model to obtain the corresponding automated investigation steps. The automated investigation steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of investigations reaches the set threshold, and the investigation result of the audit suspicion is output.

[0045] The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, etc. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0046] In one embodiment, an audit suspicion tracking and investigation system is provided, such as Figure 2 As shown, the system includes an audit data management module 10, an audit tool management module 20, an investigation strategy selection module 30, an investigation process management module 40, and a user interaction management module 50.

[0047] The Audit Data Management Module 10 is used to build a data repository for audit documents, storing and managing audit document data. Audit document data serves as the data source for tracing and investigating audit irregularities, including data from the audit platform, internal documents, and external documents. Data formats include, but are not limited to, relational database data, tabular documents, and text documents.

[0048] Specifically, the audit platform data is stored based on form information and field information within those forms. Form information includes a unique form identifier (ID), table name, system to which it belongs, and form description. Field information includes a unique field identifier (ID), field name, unique identifier of the form to which it belongs, and field description.

[0049] Based on the business category, server path, and file type of the internal and external file data, persistent information for internal and external file data is constructed respectively. The file types for internal file data include, but are not limited to, csv, xls, xlsx, doc, docx, pdf, and json. The file types for external file data include, but are not limited to, html, csv, xls, xlsx, doc, docx, pdf, and json.

[0050] The audit tool management module 20 is used to acquire at least one audit tool, encapsulate the API interface of the at least one audit tool, and store the encapsulated audit tool in the audit tool chain list after configuring its information. The API interface must ensure that the parameters passed are of string type, and the returned result is also of string type. The information configuration includes the audit tool name (ToolName), the interface function name (ToolFunc), and the interface function description (ToolDescription).

[0051] The investigation strategy selection module 30 is used to obtain the investigation direction of audit suspicions and select the investigation strategy, which includes customized investigation strategies and automated investigation strategies.

[0052] The investigation process management module 40, when a customized investigation strategy is selected, determines the customized investigation steps corresponding to the investigation direction of the audit suspicion based on the obtained large model prompt word examples generated from the audit document data. It then executes these customized investigation steps sequentially based on the audit tool chain list constructed by the audit tool management module 20 until the number of investigations reaches a set threshold, and outputs the investigation result of the audit suspicion. Alternatively, when an automated investigation strategy is selected, it uses the large model to break down the investigation direction of the audit suspicion to obtain the corresponding automated investigation steps. Based on the audit tool chain list constructed by the audit tool management module 20, it executes these automated investigation steps sequentially until the intermediate results returned during sequential execution match the preset results or the number of investigations reaches a set threshold, and then outputs the investigation result of the audit suspicion.

[0053] The user interaction management module 50 is used to receive the investigation direction and investigation strategy of the audit doubts input by the user terminal and send them to the investigation strategy selection module 30, and to send the investigation results of the audit doubts output by the investigation process management module 40 to the user terminal.

[0054] Optionally, the user interaction management module 50 also includes three audit result interaction methods: fully automatic execution, step-by-step execution, and manually guided execution. The fully automatic execution method executes the investigation steps sequentially until the investigation result is output. The step-by-step execution method executes the investigation steps sequentially and terminates the current investigation step based on a termination command sent by the user. The manually guided execution method executes the investigation steps sequentially and returns the intermediate results of each investigation step to the user, while simultaneously returning the next investigation step to the user. The user then determines whether to terminate the investigation based on the intermediate results and the next investigation step.

[0055] In one embodiment, such as Figure 3 As shown, a method for tracing and investigating audit suspicious points is provided, which can be applied to... Figure 2 Taking the system in the example, the following steps are included:

[0056] Step 301: Obtain the direction for investigating audit concerns and select an investigation strategy, which includes customized investigation strategies and automated investigation strategies.

[0057] The direction for investigating audit doubts is provided by the auditors.

[0058] Step 302: If a customized investigation strategy is selected, then based on the obtained large model prompt word examples generated from the audit document data, determine the customized investigation steps corresponding to the investigation direction of the audit suspicion, and execute the customized investigation steps sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, and output the investigation results of the audit suspicion.

[0059] Specifically, the investigation direction of audit concerns is matched with the large model's prompt word examples to obtain the customized investigation steps corresponding to the investigation direction of the audit concerns. The audit tool interface matching each customized investigation step is called from the audit tool chain list of the audit tool management module 20, and the customized investigation steps are executed sequentially to obtain the intermediate results of each customized investigation step until the number of investigations reaches a set threshold, and the investigation result of the audit concerns is output.

[0060] Step 303: If an automated investigation strategy is selected, the investigation direction of the audit suspicion is broken down using a large model to obtain the corresponding automated investigation steps; the automated investigation steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of investigations reaches a set threshold, and the investigation results of the audit suspicion are output.

[0061] Specifically, the large model breaks down the audit file data stored in the audit data management module 10 according to the direction of the audit suspicion investigation, generating the first automated investigation step. It then calls the audit tool interface matching the first automated investigation step from the audit tool chain list in the audit tool management module 20 to execute the first automated investigation step, obtaining the intermediate result of the first automated investigation step. This result is returned to the user terminal through the user interaction management module 50. If the received intermediate result matches the preset result, the automated investigation step terminates; otherwise, based on the intermediate result and investigation direction of the first automated investigation step, the next automated investigation step is generated and continues until the number of investigations reaches a set threshold or the returned intermediate result matches the preset result, at which point the investigation result of the audit suspicion is output.

[0062] In the above-mentioned audit suspicion tracking and investigation method, the investigation direction of the audit suspicion is obtained, and an investigation strategy is selected. The investigation strategy includes a customized investigation strategy and an automated investigation strategy. If a customized investigation strategy is selected, the customized investigation steps corresponding to the investigation direction of the audit suspicion are determined based on the obtained large model prompt word examples generated from the audit document data. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, and the investigation result of the audit suspicion is output. If an automated investigation strategy is selected, the large model is used to investigate the audit suspicion direction. The process involves breaking down the audit process to obtain corresponding automated investigation steps. Based on the constructed audit toolchain, these automated investigation steps are executed sequentially until the intermediate results returned during sequential execution match the preset results or the number of investigations reaches a set threshold. The investigation results of the audit doubts are then output. This approach combines customized and automated audit doubt investigation methods, and sequentially obtains audit intermediate results during automated execution to ensure that the audit doubt investigation steps and output results meet expectations. Furthermore, by constructing the audit toolchain, the process achieves audit doubt investigation that is seamless for the user and the steps are controllable, thereby improving the efficiency and transparency of audit doubt investigation.

[0063] In one embodiment, such as Figure 4 As shown, the large model prompt word example generated based on the audit document data in step 302 specifically includes the following steps:

[0064] Step 401: Construct a data repository for the audit files, wherein the data repository includes the audit file data.

[0065] Specifically, the audit data management module 10 is used to build a data repository for audit documents.

[0066] Step 402: Determine at least one investigation direction and at least one investigation method for the investigation direction based on the audit document data, wherein the investigation method includes at least one investigation step.

[0067] Specifically, based on the auditors' sorting of the audit file data stored in the audit data management module 10, the investigation directions for various audit projects and the empirical investigation steps for different investigation methods for each investigation direction are obtained. These constitute the customized investigation steps input into the large model, generating sample prompt words for the large model in the customized investigation strategy.

[0068] Step 403: Based on the at least one investigation direction and at least one investigation method of the investigation direction, generate the large model prompt word sample using the large model.

[0069] Among them, such as Figure 5 As shown, step 403, based on the at least one investigation direction and at least one investigation method of the investigation direction, uses the large model to generate the large model prompt word sample, specifically including the following steps:

[0070] Step 501: Call the matching audit tool interface from the audit tool chain list to traverse the investigation steps of at least one investigation method in the investigation direction to obtain the first result of each investigation step, and generate the data pair of the audit file data.

[0071] Step 502: Use the large model to traverse the data pairs and generate a hash table consisting of different investigation directions as primary keys and at least one investigation method of the investigation direction as values.

[0072] Step 503: Traverse the hash table, concatenate each of the investigation steps and the corresponding first results into a complete string to obtain the large model prompt word sample.

[0073] Specifically, data pairs are generated by identifying investigation directions and corresponding investigation methods identified by auditors. These data are then traversed to create corresponding hash tables, resulting in large-scale model prompt word examples for the audit file data. The nesting descriptions of new prompt word examples in the large model deepen with each investigation step. This improves the accuracy of identifying audit suspicious points using customized investigation strategies.

[0074] In one embodiment, the customized investigation steps corresponding to determining the investigation direction of the audit suspicion in step 302 specifically include the following:

[0075] At least one task step is taken to determine the direction of investigation for the audit suspicion, and the corresponding audit tool interface in the audit toolchain is called to obtain a second result corresponding to the task step. The task step and the corresponding second result are matched with the large model prompt word sample, and the investigation method matched from the large model prompt word sample and the investigation steps included in the investigation method are used as customized investigation steps for the audit suspicion.

[0076] In this embodiment, auditors identify at least one task step in the direction of audit suspicion investigation, call the corresponding audit tool interface in the audit toolchain to execute the task step, obtain a second result, and match the task step and the second result with the large model prompt word sample. The matched investigation method and the investigation steps contained in the investigation method are obtained from the large model prompt word sample as customized investigation steps for audit suspicion, which improves the efficiency and accuracy of obtaining the investigation steps for audit suspicion.

[0077] In one embodiment, step 303, which involves sequentially executing the automated screening steps based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches a set threshold, includes:

[0078] The audit tool interface matching the current automated investigation step is called from the audit tool chain to obtain the intermediate result returned by the current automated investigation step;

[0079] The intermediate result returned by the current automated investigation step is compared with the preset result. Based on the comparison result, it is selected whether to execute the next automated investigation step. If so, the next automated investigation step is generated using the large model based on the intermediate result, and the intermediate result of the next automated investigation step is compared with the preset result by calling the matching audit tool interface. This process continues until the number of investigations by the automated investigation step reaches a set threshold or the returned intermediate result matches the preset result. If not, the intermediate result returned by the current automated investigation step is used as the investigation result of the audit suspicion.

[0080] Optionally, the intermediate result returned by each automated investigation step is compared with the preset result. If the intermediate result matches the preset result, the automated investigation step is terminated, and the intermediate result obtained in the current step is output as the investigation result. If the intermediate result does not match the preset result, the large model is used to generate the next automated investigation step based on the intermediate result and the investigation direction. The matching audit tool interface is called to obtain the intermediate result of the next automated investigation step and compare it with the preset result, until the number of investigations of the automated investigation step reaches a set threshold or the returned intermediate result matches the preset result.

[0081] In this embodiment, intermediate results are returned to the user terminal by executing each automated investigation step through the audit toolchain. Based on the comparison between the intermediate results and the predicted results, if the intermediate results do not meet the preset results, a new automated investigation step is generated using a large model. This allows for manual intervention to adjust the deviations generated during the investigation process, thereby achieving controllable modification of the automated investigation steps and improving the reliability and accuracy of the audit results.

[0082] In one embodiment, after selecting a customized investigation strategy to obtain the corresponding customized investigation steps or selecting an automated investigation strategy to obtain the corresponding automated investigation steps, the customized investigation steps or the automated investigation steps are executed sequentially based on the constructed audit toolchain until a termination command is received, and the investigation results of the audit doubts are output.

[0083] In one example embodiment, a method for tracing and investigating audit concerns is provided, applicable to, for example... Figure 2 The audit suspicion tracking and investigation system shown includes the following steps:

[0084] S1 collects various auditing tools and configures the information for each tool, including the tool name (ToolName), interface function name (ToolFunc), and interface function description (ToolDescription). The configured auditing tools are then integrated into the auditing tool list (Tool-list). Tool-list = [tool1, tool2, ..., tool...]. tool-cnt ].

[0085] S2, based on the auditors' analysis of the audit file data stored in the audit data management module 10, the investigation directions S for various audit projects are obtained. direction And for each investigation direction S direction-n Different screening methods L steps-n Experience-based troubleshooting steps (Action) n The process involves calling the matching audit tool interface from the audit tool list (Tool-list) and iterating through the investigation steps (Action). n Generate data for Pair detect-n =(S direction-n L steps-n ), where L steps-n =[Action1, Result1; Action2, Result2; ...; Action n Result n ].

[0086] Each investigation step is an Action. i(i∈[1,n]) This can be refined to the point where it can be completed independently using a single auditing tool. Result i (i∈[1,n]) are the intermediate results obtained after using the auditing tool for each investigation step.

[0087] Traversing data pairs detect-n =(S direction-n L steps-n ), generating S with different investigation directions direction-n L, all investigation methods for primary keys and various investigation directions steps-for-direction-n A hash table (HashMap) assembled from values ​​is denoted as Dict. search-direction ={S direction-1 :L steps-for-direction-1 , ......, S direction-dircnt :L steps-for-direction-dircnt}

[0088] Traversing the hash table Dict search-direction For each linked list L steps-for-direction-n Each investigation method L steps-n The investigation method L steps-n =[Action1, Result1; Action2, Result2; ...; Action n Result n Each element in the array is concatenated as a complete string to obtain a large model cue word example in the form of CoT (Chain-of-Thought).

[0089] S3, outlining the directions for investigating audit concerns. direction And select an investigation strategy.

[0090] S4, If a customized investigation strategy is selected, then the direction of the investigation for audit suspicions is determined. direction At least one task step (Action) q 'This calls the corresponding audit tool interface in the audit tool list (Tool-list) to execute the task step (Action). q ', and obtain the corresponding second result Result q ', this task step Action q ' and the second result q 'Match with large model suggestion word examples, and obtain the matching investigation method L from the large model suggestion word examples.' steps-n And the investigation method L steps-n The included troubleshooting steps (Action) iThis is a customized investigation step for audit concerns. The audit toolchain (Tool-list) is invoked to execute the customized investigation steps sequentially until the number of investigations reaches a set threshold m, at which point the investigation results for the audit concerns are output.

[0091] S5, If the automated screening strategy is selected, the large model will be used to screen for audit suspicions in the following directions: S direction 'Break down the process to obtain the first automated investigation step, denoted as Action1'. Call the audit tool interface that matches the first automated investigation step Action1' from the audit tool list Tool-list to obtain the intermediate result Result1' of the first automated investigation step Action1'.

[0092] The intermediate result Result1' returned by the first automated troubleshooting step is compared with the preset result. If the intermediate result Result1' matches the preset result, the automated troubleshooting step is terminated, and the intermediate result Result1' obtained in the current step is output as the troubleshooting result. If the intermediate result Result1' does not match the preset result, the large model is used to determine the intermediate result Result1' and the troubleshooting direction S. direction 'Generate the next automated investigation step Action2', and call the matching audit tool interface to obtain the intermediate result Result2' of the next automated investigation step Action2'. Compare this result with the preset result until the automated investigation step Action is completed. k The number of checks for '(k∈[1,m]) reaches the set threshold m or the returned intermediate result Result k 'Matches the preset result.'

[0093] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0094] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements an audit suspicion tracing and investigation method. The display unit of the computer device is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0095] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0096] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0097] Step 1: Obtain the direction for investigating audit concerns and select an investigation strategy, which includes customized investigation strategies and automated investigation strategies.

[0098] Step 2: If a customized investigation strategy is selected, based on the large model prompt word examples generated from the audit document data, the customized investigation steps corresponding to the investigation direction of the audit suspicion are determined. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches the set threshold, and the investigation results of the audit suspicion are output.

[0099] Step 3: If an automated screening strategy is selected, the large model is used to break down the screening direction of the audit suspicions to obtain the corresponding automated screening steps; the automated screening steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches the set threshold, and the screening results of the audit suspicions are output.

[0100] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0101] A data repository for audit documents is constructed, the data repository including the audit document data; at least one investigation direction and at least one investigation method for the investigation direction are determined based on the audit document data, the investigation method including at least one investigation step; based on the at least one investigation direction and the at least one investigation method for the investigation direction, large model prompt word examples are generated using large model.

[0102] In one embodiment, when the processor executes the computer program, it further performs the following steps: calling the matching audit tool interface from the audit tool chain list to traverse the investigation steps of at least one investigation method of the investigation direction to obtain the first result of each investigation step, and generating data pairs of the audit file data; using the large model to traverse the data pairs to generate a hash table composed of different investigation directions as primary keys and the at least one investigation method of the investigation direction as values; traversing the hash table to concatenate each investigation step and the corresponding first result into a complete string to obtain the large model prompt word example.

[0103] In one embodiment, when the processor executes the computer program, it further implements the following steps: determining at least one task step for investigating the audit suspicion, and calling the audit tool interface matched in the audit toolchain to obtain a second result corresponding to the task step; matching the task step and the corresponding second result with the large model prompt word sample, and using the investigation method matched from the large model prompt word sample and the investigation steps included in the investigation method as customized investigation steps for the audit suspicion.

[0104] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining at least one auditing tool, encapsulating the at least one auditing tool into an API interface, and storing the encapsulated auditing tool in the auditing tool chain list after configuring its information, wherein the information configuration includes auditing tool name configuration, interface function name configuration, and interface function description configuration.

[0105] In one embodiment, when the processor executes the computer program, it further implements the following steps: calling the audit tool interface matching the current automated investigation step from the audit tool chain to obtain the intermediate result returned by the current automated investigation step; comparing the intermediate result returned by the current automated investigation step with the preset result, and selecting whether to execute the next automated investigation step based on the comparison result. If yes, the next automated investigation step is generated using the large model based on the intermediate result, and the matching audit tool interface is called to obtain the intermediate result of the next automated investigation step and compare it with the preset result, until the number of investigations of the automated investigation step reaches a set threshold or the returned intermediate result matches the preset result. If not, the intermediate result returned by the current automated investigation step is used as the investigation result of the audit suspicion.

[0106] In one embodiment, when the processor executes the computer program, it further performs the following steps: sequentially executing the customized investigation steps or the automated investigation steps based on the constructed audit toolchain until a termination command is received, and outputting the investigation results of the audit doubts.

[0107] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps corresponding to the methods described in the above embodiments.

[0108] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0109] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0110] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for tracing and investigating audit suspicions, characterized in that, The method includes: Obtain the direction for investigating audit concerns and select an investigation strategy, including customized investigation strategies and automated investigation strategies; If a customized investigation strategy is selected, the customized investigation steps corresponding to the investigation direction of the audit suspicion are determined based on the large model prompt word examples generated from the audit file data. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches the set threshold, and the investigation results of the audit suspicion are output. If an automated screening strategy is selected, the large model is used to break down the screening direction of the audit suspicions to obtain the corresponding automated screening steps; the automated screening steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches the set threshold, and the screening results of the audit suspicions are output. The large model prompt word example generated based on audit file data includes: constructing a data repository for the audit file, the data repository including the audit file data; determining at least one investigation direction and at least one investigation method for the investigation direction based on the audit file data, the investigation method including at least one investigation step; calling a matching audit tool interface from the audit tool chain to traverse the investigation steps of the at least one investigation method for the investigation direction to obtain a first result for each investigation step, generating a data pair of the audit file data; using the large model to traverse the data pair to generate a hash table composed of different investigation directions as primary keys and the at least one investigation method for the investigation direction as values; traversing the hash table, concatenating each investigation step and the corresponding first result into a complete string to obtain the large model prompt word example; The customized investigation steps for determining the direction of investigation for the audit suspicion include: determining at least one task step for determining the direction of investigation for the audit suspicion, and calling the audit tool interface matched in the audit tool chain to obtain a second result corresponding to the task step; matching the task step and the corresponding second result with the large model prompt word sample, and using the investigation method matched from the large model prompt word sample and the investigation steps included in the investigation method as the customized investigation steps for the audit suspicion.

2. The audit suspicion tracking and investigation method according to claim 1, characterized in that, Before identifying the direction for investigating audit concerns and selecting whether to conduct customized tracking, the method further includes: Obtain at least one auditing tool, encapsulate the API interface of the at least one auditing tool, and store the encapsulated auditing tool in the auditing tool chain list after configuring the information. The information configuration includes auditing tool name configuration, interface function name configuration, and interface function description configuration.

3. The audit suspicion tracking and investigation method according to claim 1, characterized in that, The automated screening steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches a set threshold, including: The audit tool interface matching the current automated investigation step is called from the audit tool chain to obtain the intermediate result returned by the current automated investigation step; The intermediate result returned by the current automated investigation step is compared with the preset result. Based on the comparison result, it is selected whether to execute the next automated investigation step. If so, the next automated investigation step is generated using the large model based on the intermediate result. The matching audit tool interface is called to obtain the intermediate result of the next automated investigation step and compare it with the preset result. This process continues until the number of investigations by the automated investigation step reaches a set threshold or the returned intermediate result matches the preset result. If not, the intermediate result returned by the current automated investigation step is output as the investigation result of the audit suspicion.

4. The audit suspicion tracking and investigation method according to claim 1, characterized in that, The method further includes: Based on the constructed audit toolchain, the customized investigation steps or the automated investigation steps are executed sequentially until a termination command is received, and the investigation results of the audit doubts are output.

5. An audit suspicion tracking and investigation system, characterized in that, The system includes: The investigation strategy selection module is used to obtain the investigation direction of audit suspicions and select the investigation strategy, which includes customized investigation strategies and automated investigation strategies. The investigation process management module is used to determine the customized investigation steps corresponding to the investigation direction of the audit suspicion point based on the large model prompt word examples generated from the audit document data if a customized investigation strategy is selected. The customized investigation steps are executed sequentially based on the constructed audit toolchain until the number of investigations reaches a set threshold, and the investigation results of the audit suspicion point are output. If an automated screening strategy is selected, the large model is used to break down the screening direction of the audit suspicions to obtain the corresponding automated screening steps; the automated screening steps are executed sequentially based on the constructed audit toolchain until the intermediate results returned during sequential execution match the preset results or the number of screenings reaches the set threshold, and the screening results of the audit suspicions are output. The large model prompt word example generated based on audit file data includes: constructing a data repository for the audit file, the data repository including the audit file data; determining at least one investigation direction and at least one investigation method for the investigation direction based on the audit file data, the investigation method including at least one investigation step; calling a matching audit tool interface from the audit tool chain to traverse the investigation steps of the at least one investigation method for the investigation direction to obtain a first result for each investigation step, generating a data pair of the audit file data; using the large model to traverse the data pair to generate a hash table composed of different investigation directions as primary keys and the at least one investigation method for the investigation direction as values; traversing the hash table, concatenating each investigation step and the corresponding first result into a complete string to obtain the large model prompt word example; The customized investigation steps for determining the direction of investigation for the audit suspicion include: determining at least one task step for determining the direction of investigation for the audit suspicion, and calling the audit tool interface matched in the audit tool chain to obtain a second result corresponding to the task step; matching the task step and the corresponding second result with the large model prompt word sample, and using the investigation method matched from the large model prompt word sample and the investigation steps included in the investigation method as the customized investigation steps for the audit suspicion.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps corresponding to the method of any one of claims 1 to 4.

Images