A method and system for accounting risk identification and decision support

Abstract

This invention discloses a method and system for accounting risk identification and decision support, relating to the field of accounting information processing technology. The method includes: cleaning and standardizing accounting-related data streams to generate accounting event streams; real-time pre-screening of accounting event streams to determine accounting events to be verified and pre-screening results; retrieving evidence according to association rules to form structured evidence packages and performing cross-modal consistency checks to extract contradictory evidence features; incrementally updating the entity relationship graph based on accounting event streams and contradictory evidence features, constructing local subgraphs, and reasoning to obtain graph risk scores and risk association paths; fusing multi-source results to determine risk types and risk levels and outputting decision support results. This invention balances real-time performance and accuracy, improves the ability to identify hidden associations and network-based fraud, significantly reduces false positives and false negatives, reduces manual retrieval and comparison, shortens the time delay for evidence retrieval and review, and enhances the interpretability and audit traceability of conclusions through evidence location and association paths.

Description

Technical Field

[0001] This invention relates to the field of accounting information processing technology, specifically to an accounting risk identification and decision support method and system. Background Technology

[0002] With the widespread adoption of digital operations in enterprises, accounting and auditing risk control have gradually evolved from traditional ledger reconciliation to a data-driven continuous monitoring system. Various ERP / financial shared service platforms, e-invoices and e-contracts, fund receipt and payment interfaces, approval workflows, and business logs continuously generate high-frequency data, shifting risk identification from post-event sampling to in-process early warning. Simultaneously, technologies such as statistical anomaly detection, machine learning classification, rule engines, and knowledge graphs have been introduced into the financial field for automated analysis of transaction, invoice, and process compliance, and for attempting to characterize related-party transactions and fraud chains using relationship networks to achieve greater audit coverage.

[0003] However, existing accounting risk identification technologies still have significant shortcomings in engineering implementation and risk penetration: First, multi-source accounting and business data differ significantly in scope, field naming, time base, and subject identification, lacking cleansing, standardization, and event-based mechanisms for continuous monitoring. This makes it difficult to align the same business across different systems, resulting in unstable risk characteristic calculations and easily broken traceability chains. Second, the early warning stage often relies on static thresholds or single models, which are insufficiently adaptable to seasonal fluctuations in business, process bypasses, and hidden anomaly patterns. High false alarm rates and unexplained omissions easily lead to verification resources being occupied by low-value alarms. Third, evidence verification often remains at the level of single-source field comparison, lacking structured organization and cross-modal consistency verification of multimodal evidence such as contract texts, invoice images, and approval records. This makes it difficult to form falsifiable substantive contradictory features. At the same time, relationship graphs are often built offline or statically maintained, unable to be updated incrementally with events and unable to build local analysis scope around target events. This makes it difficult to capture and interpret related party propagation risks, fund repatriation, and closed-loop structures in a timely manner, ultimately making it difficult to directly map risk conclusions into actionable decisions. Fourth, the lack of a unified dimension and fusion mechanism for multi-source results makes it difficult to form a stable risk classification. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by this invention is that existing accounting risk identification and auxiliary decision-making methods suffer from the following problems: difficulty in cleaning and aligning multi-source accounting and business data; insufficient event-based organization leading to weak traceability and computability; reliance on static rules or single models for pre-screening resulting in both false positives and false negatives, and difficulty in stable classification; lack of multimodal consistency verification and relationship network penetration analysis in evidence verification, making it difficult to explain the causes of risks and form actionable disposal recommendations; and how to achieve joint assessment of evidence, relationships, and risks under the event-driven nature of streaming accounting and output actionable auxiliary decision-making results.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide an accounting risk identification and decision support method, characterized by comprising the following steps:

[0008] Acquire accounting-related data streams, and clean and standardize the accounting-related data streams to generate accounting event streams;

[0009] Perform real-time pre-screening on the accounting event flow and output the set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified.

[0010] For each accounting event to be verified, evidence data associated with the accounting event to be verified is obtained based on preset association rules, and a structured evidence package is generated;

[0011] Multimodal feature extraction and cross-modal consistency verification are performed on the structured evidence package, and contradictory evidence features and consistency verification results corresponding to each accounting event to be verified are output.

[0012] The entity relationship graph is updated incrementally based on the accounting event flow and the contradictory evidence features, and a corresponding local subgraph is constructed for each accounting event to be verified.

[0013] Graph neural network inference is performed on the local subgraph to output the graph risk score and risk association path corresponding to each accounting event to be verified;

[0014] By integrating the pre-screening results, the consistency verification results, and the graph risk score, the risk type and risk level of each accounting event to be verified are determined, and auxiliary decision-making results corresponding to the risk type and risk level are output.

[0015] As a preferred embodiment of the accounting risk identification and decision support method described in this invention, the generation of the accounting event flow includes:

[0016] The accounting-related data stream is cleaned, including: rule completion for missing fields based on account set, organizational dimension, or business rules; idempotent deduplication of duplicate records based on source identifier, business primary key, and time window; boundary verification and anomaly marking for outliers; and entity disambiguation of main information based on strong identifier and name similarity.

[0017] The cleaned data is standardized, including: field mapping and type unification, cross-system identifier alignment, and business time alignment.

[0018] After the data records have been cleaned and standardized, they are processed into event-based data and transformed into a sequence of accounting event objects arranged in chronological order to generate the accounting event flow. Each accounting event object contains at least an event identifier, event type, occurrence time, amount information, subject entity information, and a set of associated identifiers, and retains the original record pointer for audit traceability.

[0019] As a preferred embodiment of the accounting risk identification and decision support method described in this invention, the real-time pre-screening of the accounting event flow includes:

[0020] Feature extraction is performed on the accounting event objects in the accounting event stream to generate a risk feature set for pre-screening. The risk feature set includes at least one or more of the following: amount deviation feature, frequency mutation feature, time anomaly feature, subject anomaly feature, and association identifier integrity feature.

[0021] Pre-screening is performed based on the risk feature set, and a pre-screening risk metric corresponding to each accounting event object is output. A pre-screening basis identifier and a pre-screening risk label corresponding to the pre-screening risk metric are generated. The pre-screening risk metric includes at least one of a pre-screening risk score and a pre-screening risk probability.

[0022] The accounting event objects are selected from the accounting event stream based on the pre-screening risk measurement to form the set of accounting events to be verified, wherein the selection includes at least one or more of the following: based on a preset threshold, based on risk measurement sorting, based on rule or anomaly marker triggering, and based on tiered quota control.

[0023] Output the pre-screening results corresponding to each accounting event to be verified in the set of accounting events to be verified, wherein the pre-screening results include at least one or more of the pre-screening risk measure, the pre-screening basis identifier, and the pre-screening risk label.

[0024] As a preferred embodiment of the accounting risk identification and decision support method described in this invention, the generation of the structured evidence package includes:

[0025] Based on at least one of the following: the set of associated identifiers of the accounting event to be verified, the entity information, and the pre-screening risk label, evidence entries associated with the accounting event to be verified are retrieved from the multi-source evidence storage or business system interface according to the preset association rules. The association rules include at least one or more of the following: primary key association rules, attribute association rules, and time-series window association rules.

[0026] The evidence entries are deduplicated or valid versions are selected to obtain related evidence data for verification.

[0027] The associated evidence data is organized and packaged into a structured evidence package, wherein the structured evidence package includes at least an evidence package identifier, a corresponding accounting event identifier to be verified, a set of evidence items, and evidence association information, and the evidence association information includes at least one of evidence matching basis identifier and matching score.

[0028] As a preferred embodiment of the accounting risk identification and decision support method described in this invention, the step of performing multimodal feature extraction and cross-modal consistency verification includes:

[0029] The evidence items in the structured evidence package are parsed and their fields extracted according to evidence type to generate a set of evidence features;

[0030] The evidence feature set is subjected to field standardization processing, which includes mapping similar fields from different sources to a unified field dictionary and standardizing at least one of the following: amount precision, currency, date format, subject representation method, and tax rate representation method.

[0031] For the same set of evidence features corresponding to the accounting event to be verified, field alignment and consistency determination are performed. The consistency determination includes at least one of full consistency verification, tolerance consistency verification, logical consistency verification, and temporal consistency verification.

[0032] Based on the consistency determination, a consistency verification result is output and contradictory evidence features are generated. The consistency verification result includes at least one of consistency score, contradiction type label, and evidence location information. The contradictory evidence features include at least one of contradictory field identifier, field difference measure, contradiction severity, and related evidence item set.

[0033] As a preferred embodiment of the accounting risk identification and decision support method of the present invention, the step of incrementally updating the entity relationship graph based on the accounting event flow and the contradictory evidence features, and constructing a corresponding local subgraph for each accounting event to be verified, includes:

[0034] Based on the accounting event flow, the main entity, associated identifier and business elements of the accounting event object are parsed. In the entity relationship graph, node existence verification and node update are performed, and relationship edges are written or updated according to the preset relationship mapping rules.

[0035] Based on the contradictory evidence characteristics, contradictory relationship information is written into the entity relationship graph, and the contradictory relationship information is associated as a risk attribute with at least one of the entity nodes and relationship edges involved in the contradiction.

[0036] Using each accounting event to be verified and its related entities as a seed set, a local subgraph is extracted from the entity relationship graph according to a preset expansion strategy. The preset expansion strategy includes at least one or more of the following: hop count expansion strategy, time window constraint strategy, relationship type constraint strategy, and relationship strength constraint strategy.

[0037] As a preferred embodiment of the accounting risk identification and decision support method described in this invention, the execution of the graph neural network inference includes:

[0038] The graph structure, node features, and edge features of the local subgraph are input into a graph neural network model, and the node features and edge features are iteratively updated to generate a graph representation of the local subgraph.

[0039] Based on the graph representation, output the graph risk score corresponding to the accounting event to be verified;

[0040] Based on the contribution information of node features and edge features output by the graph neural network model, key nodes and key edges are determined from the local subgraph, and risk association paths composed of the key nodes and key edges are generated.

[0041] As a preferred embodiment of the accounting risk identification and auxiliary decision-making method of the present invention, the step of determining the risk type and risk level of each accounting event to be verified, and outputting the auxiliary decision-making result corresponding to the risk type and risk level, includes:

[0042] The pre-screening results, the consistency verification results, and the graph risk score are subjected to feature alignment and fusion processing to obtain a comprehensive risk assessment result;

[0043] Based on the comprehensive risk assessment results, the risk type and risk level of each accounting event to be verified are determined;

[0044] Based on the risk type and the risk level, the auxiliary decision-making result is generated and output.

[0045] Secondly, embodiments of the present invention provide an accounting risk identification and decision support system, including:

[0046] Event stream generation module: Acquires accounting-related data streams, cleans and standardizes the accounting-related data streams, and generates accounting event streams;

[0047] Pre-screening module: Performs real-time pre-screening on the accounting event stream, and outputs a set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified;

[0048] Evidence association module: For each accounting event to be verified, obtain evidence data associated with the accounting event to be verified based on preset association rules, and generate a structured evidence package;

[0049] Consistency verification module: Performs multimodal feature extraction and cross-modal consistency verification on the structured evidence package, and outputs contradictory evidence features and consistency verification results corresponding to each accounting event to be verified;

[0050] Graph update module: Increments the entity relationship graph based on the accounting event flow and the contradictory evidence features, and constructs the corresponding local subgraph for each accounting event to be verified;

[0051] Graph reasoning module: Performs graph neural network reasoning on the local subgraph and outputs graph risk scores and risk association paths corresponding to each accounting event to be verified;

[0052] Fusion Decision Module: Fusion of the pre-screening results, the consistency verification results, and the graph risk score to determine the risk type and risk level of each accounting event to be verified, and output auxiliary decision results corresponding to the risk type and risk level.

[0053] The beneficial effects of this invention are as follows: First, by cleaning, standardizing, and organizing accounting-related data flows into a continuous accounting event flow, differences in definitions, field names, and entity identifiers between different systems are unified and aligned. This provides a traceable, unified data foundation for risk characteristic calculations, reducing misjudgments and result drift caused by data noise. Second, by implementing real-time pre-screening at the event flow level and outputting traceable pre-screening basis identifiers and risk labels, subsequent verification no longer triggers every single event. Instead, verification resources are concentrated on high-risk candidate events, improving screening efficiency and reducing the audit burden caused by invalid alarms. Third, by generating structured evidence packages around the accounting events to be verified and performing field alignment and cross-modal consistency checks on multi-source evidence, inconsistencies between evidence such as invoices, contracts, funds, and processes are transformed into calculable contradictory evidence features. This provides falsifiable evidence support and clear location information for risk conclusions, facilitating review and compliance documentation. Fourth, by incrementally updating the entity relationship graph based on accounting events and contradictory evidence, and constructing local subgraphs of event associations, risk signals can propagate and aggregate within the relationship network, enhancing the ability to penetrate and identify network-type risks such as related-party transactions, fund repatriation, and multi-person collaborative fraud. Fifth, by performing graph reasoning on local subgraphs and outputting risk association paths, the basis for risk scoring has an interpretable relational chain expression, thus facilitating auditors in locating key entities, key relationships, and the order of verification. Sixth, by integrating pre-screening results, consistency verification results, and graph risk scoring to form the final risk type and risk level, and outputting matching auxiliary decision-making results, risk identification and disposal recommendations have a consistent mapping relationship, improving the executability and closed-loop efficiency of risk disposal. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein:

[0055] Figure 1 A flowchart illustrating an accounting risk identification and decision support method provided in the first embodiment of the present invention;

[0056] Figure 2 The diagram shows the module connection of an accounting risk identification and decision support system provided in the third embodiment of the present invention. Detailed Implementation

[0057] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0058] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides an accounting risk identification and decision support method.

[0059] S1: Obtain accounting-related data streams, and clean and standardize the accounting-related data streams to generate accounting event streams.

[0060] The purpose of step S1 is to transform heterogeneous accounting-related data from within and outside the enterprise into accounting event streams in a traceable, alignable, and continuously computable manner, providing a unified data foundation for subsequent real-time pre-screening, evidence association, and incremental updates to the entity relationship graph. The accounting-related data stream refers to a set of data that is continuously generated in chronological order and reflects the occurrence of economic transactions and their accounting impact; the data stream emphasizes that data arrives incrementally and carries time information, enabling subsequent steps to achieve continuous monitoring and real-time triggering based on time windows.

[0061] It should be noted that the cleaning process is not simply deleting abnormal records, but rather a data quality governance process geared towards risk identification scenarios. Furthermore, the cleaning process includes, but is not limited to: rule completion for missing fields, where rule completion is based at least on account sets, organizational dimensions, or business rules to determine default or inferred values; idempotent deduplication of duplicate records, where idempotent deduplication is based on a combination of source identifier, business primary key, and time window to form a uniqueness judgment condition, eliminating redundancy caused by duplicate reporting, duplicate accounting, or interface replay; boundary verification and marking of outliers, where boundary verification includes at least checks for amount symbols, tax rate ranges, date reversal, and field type consistency, and records that do not meet the verification conditions are marked as outliers for subsequent pre-screening; and entity disambiguation of entity information, where entity disambiguation prioritizes normalization mapping based on strong identifiers such as tax ID and bank account number, and, when strong identifiers are insufficient, uses name similarity and a preset mapping table for auxiliary matching, to reduce the breakage of subsequent association chains caused by the same entity being split into multiple entities.

[0062] Furthermore, the standardization process eliminates inconsistencies in data definitions, field naming, and type representations across different systems, ensuring comparability of the same business data across different sources. This standardization process includes field mapping and type unification. Field mapping maps heterogeneous fields to a predefined field dictionary, and type unification includes standardization of monetary precision, date and time formats, and classification codes. It also includes cross-system identifier alignment, which establishes associated indexes for at least one or more of the following: voucher number, document number, contract number, invoice number, and approval number. This enables subsequent evidence retrieval and cross-modal alignment comparisons using the same business anchor. Finally, the standardization process includes business time alignment, extracting business-meaning time information from records across different sources and unifying it to a consistent time benchmark to support the identification of risks involving contradictory time logic.

[0063] It should also be noted that the process of generating accounting event streams is event-based processing, which transforms the cleaned and standardized records into a sequence of accounting event objects arranged in chronological order. Furthermore, each accounting event object includes at least an event identifier, event type, occurrence time, amount information, entity information, and a set of associated identifiers, while retaining pointers to the original records for audit traceability. The event identifier is used to consistently reference the same accounting event object in subsequent steps, ensuring that the accounting events to be verified output from the pre-screening can be accurately located and associated with the structured evidence package. Even further, the entity information forms a unified entity reference identifier during eventization, enabling the same entity to correspond to the same node or the same node identifier in the subsequent entity relationship graph, thus providing feasible data anchors for incremental updates and local subgraph construction.

[0064] S2: Perform real-time pre-screening on the accounting event flow and output the set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified.

[0065] The purpose of step S2 is to quickly screen and sort high-risk clues with low computational cost under the condition of continuous input of accounting event stream, forming a set of accounting events to be verified. This avoids excessive resource consumption or response delays caused by triggering all accounting event objects one by one in subsequent multimodal evidence analysis and graph neural network inference. It should also be noted that the real-time pre-screening is not intended to give a final risk conclusion, but is used to output candidate accounting event objects and their pre-screening results that can be further verified by subsequent steps, so that the risk identification process forms a hierarchical computation link that combines lightweight screening and heavy-duty verification.

[0066] The real-time pre-screening uses accounting event objects in the accounting event stream as processing units, extracting features and quickly identifying accounting event objects upon their arrival or within a preset time window. Feature extraction includes obtaining one or more of the following from the accounting event object: monetary information, occurrence time, event type, entity information, and a set of associated identifiers, and generating a risk feature set for pre-screening. This risk feature set includes at least one or more of the following: monetary deviation features, frequency mutation features, time anomaly features, entity anomaly features, and associated identifier integrity features. It should be noted that these risk features can be directly calculated from the accounting event stream without accessing external evidence data, thus ensuring the real-time nature and stability of the pre-screening.

[0067] Furthermore, the real-time pre-screening can output pre-screening results using one or more collaborative methods among rule-based screening, statistical screening, and model screening. Further, the rule-based screening is used to quickly identify accounting event objects that meet clear risk triggering conditions. These risk triggering conditions include at least one or more of the following: the amount exceeds a preset threshold or relative threshold; the frequency or cumulative amount of accounting event objects of the same entity increases abnormally within a preset time window; the occurrence time of the accounting event object meets the characteristics of non-working hours or abnormal periods; the association identifier of the accounting event object is missing, has an abnormal format, or is contradictory; and the entity is in a preset risk entity set or meets preset risk profile characteristics. It should also be noted that the threshold can be a static threshold or a dynamic threshold based on historical statistical distribution to adapt to differences in different organizations, business types, and account definitions, thereby reducing false positives and false negatives caused by inappropriate static thresholds.

[0068] The statistical screening is used to aggregate and statistically analyze accounting event flows within a sliding time window to obtain baseline features for anomaly detection. The current accounting event object or current window indicator is then compared with these baseline features to trigger anomaly flags. The aggregated statistics include at least one or more of the following: statistical analysis based on organization, account, subject, or event type, focusing on amount, frequency, or percentage. Furthermore, the statistical screening can be used to identify sudden increases, decreases, or structural shifts under short-term fluctuations, thereby improving the adaptability of pre-screening to normal fluctuations in business volume.

[0069] Furthermore, the model screening is used to quickly score risk patterns that are difficult to exhaustively enumerate through rules or statistical conditions. The model screening employs a lightweight classification model or anomaly detection model to infer the risk feature set and outputs a pre-screened risk score or risk probability. To meet real-time requirements, the model preferably adopts a model structure capable of rapid inference in a streaming environment and can be updated at preset intervals based on historical annotation or handling results. It should also be noted that the synergy between rule screening, statistical screening, and model screening achieves complementarity: rule screening ensures the recall of high-certainty risk clues, statistical screening improves the ability to capture short-term fluctuation anomalies, and model screening improves the coverage of latent anomaly patterns, thereby increasing the effective hit rate of the set of accounting events to be verified under controllable computational overhead.

[0070] Furthermore, the real-time pre-screening may include sequence consistency screening to identify risk patterns that depend on the relationship between consecutive accounting event objects. The sequence consistency screening maintains status information related to specific accounting event objects within a preset time window and determines whether there are missing or sequentially abnormal supporting events logically associated with the accounting event object, thereby triggering an anomaly flag. These supporting events may include one or more of approval completion events, invoice generation events, or accounting entry events. Through this method, process bypass risks that are difficult to detect using only a single accounting event object field can be pre-screened.

[0071] It should be noted that the output of step S2 includes a set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified. Further, the set of accounting events to be verified is a subset of accounting event objects filtered from the accounting event stream, and its generation method includes at least one or more of the following: directly including accounting event objects based on hit rules or anomaly markers; selecting the top few accounting event objects based on pre-screening risk scores; including accounting event objects whose pre-screening risk scores exceed a preset threshold; or selecting accounting event objects based on a tiered quota method across different event types, different entities, or different organizational dimensions. It should also be noted that using a tiered quota method can prevent high-frequency or large-value transactions from consuming all verification resources, thereby enabling the system to maintain coverage of multiple types of risks with limited verification resources.

[0072] Furthermore, the pre-screening results include at least one or more of the following: a pre-screening risk score associated with the accounting event to be verified, a basis identifier, and a pre-screening risk label; wherein, the basis identifier is a pre-screening basis identifier used to record the triggered rule item, statistical anomaly type, or model output basis, and the pre-screening risk label is used to characterize the risk direction or verification focus. It should also be noted that the pre-screening basis identifier and the pre-screening risk label can be used to drive the selection of evidence retrieval scope and verification strategy in subsequent steps, enabling subsequent evidence analysis to shift from full retrieval to on-demand retrieval, thereby reducing overall link latency and data access costs.

[0073] This step achieves lightweight real-time screening at the accounting event flow level, keeping the number of accounting event objects requiring subsequent evidence retrieval and graph inference within a manageable range, enabling the system to operate stably under actual enterprise scale and data throughput conditions. Secondly, by outputting pre-screening results including risk scores, pre-screening basis identifiers, and risk labels, subsequent verification steps can retrieve evidence and construct local analysis scopes around risk clues, reducing access to irrelevant evidence and invalid calculations. Thirdly, through a combination of rules, statistics, models, and sequence consistency screening mechanisms, the pre-screening's coverage of static anomalies, fluctuation anomalies, and process bypass risks is improved, and the screening strategy remains adaptable to changes in business scope or seasonal fluctuations, thereby providing higher-quality candidate inputs for subsequent multimodal consistency verification and graph neural network inference.

[0074] S3: For each accounting event to be verified, obtain evidence data associated with the accounting event to be verified based on preset association rules, and generate a structured evidence package.

[0075] The purpose of step S3 is to automatically acquire relevant evidence data that can prove or disprove the risk clues of each accounting event to be verified, based on the output of step S2, and organize the relevant evidence data into a structured evidence package as direct input for subsequent multimodal feature extraction and cross-modal consistency verification. It should also be noted that the evidence data is not arbitrarily expanded from all enterprise materials, but rather targeted and organized under preset association rules, using the accounting event to be verified as an anchor point. This ensures the relevance of the evidence while controlling data access costs and response latency, and reduces verification noise caused by irrelevant evidence.

[0076] The preset association rules are used to determine the association path, matching conditions, and retrieval priority between the accounting events to be verified and the evidence data. It should be noted that the association rules include at least one or more of the following: primary key association rules, attribute association rules, time-series window association rules, and risk label-driven association rules. The primary key association rules match associations based on association identifiers that uniquely point to the same business transaction. These association identifiers include at least one or more of the following: voucher number, document number, contract number, invoice number, approval number, project number, order number, and transaction number. The attribute association rules match entity information with key fields. These key fields include at least one or more of the following: counterparty entity, bank account, amount range, currency, tax rate, material or service category, and handler or department. The time-series window association rules are used to aggregate associated evidence within a preset time range. This time range can be set to different window lengths based on event type or business process to adapt to the natural time sequence of different businesses. The risk label-driven association rules are used to adjust the focus and scope of evidence retrieval based on pre-screened risk labels. Furthermore, the association rules can be executed according to priority. Primary key association rules are used first to complete strong matching. When strong matching is insufficient or evidence is incomplete, attribute association rules and time-series window association rules are used for supplementary matching. During supplementary matching, risk tag-driven association rules are combined to determine the priority order of evidence retrieval, so as to improve the evidence recall rate and reduce the probability of false association.

[0077] Furthermore, obtaining the evidence data includes retrieving original evidence entries associated with the accounting event to be verified from multi-source evidence storage or business system interfaces, and performing deduplication, version selection, and consistency governance on the original evidence entries. It should be noted that the multi-source evidence storage or business system interfaces may include electronic contract databases, invoice image databases, invoice platforms, fund receipt or account statement storage, approval process log databases, order and inventory record databases, etc.; in some embodiments, the evidence entries exist in the form of structured records, semi-structured text, or unstructured files. It should also be noted that, for cases where the same evidence entry has multiple versions or is archived multiple times, a valid version can be selected based on the archiving time, signature status, approval status, business status, or integrity verification result to avoid using expired or inconsistent evidence that could affect subsequent verification conclusions; wherein, the integrity verification result can be obtained based on file digest information or hash verification.

[0078] Furthermore, the process of generating the structured evidence package includes organizing and encapsulating the evidence data into evidence items and fields, forming a data structure that can be directly consumed by subsequent multimodal processing. It should be noted that the structured evidence package includes at least one or more of the following: evidence package identifier, corresponding accounting event identifier to be verified, evidence item set, and evidence association information; wherein, the evidence item set includes at least one or more of the following for each evidence item: evidence type identifier, evidence source identifier, original file pointer or record pointer, evidence collection time, key field set, and field confidence information; the evidence association information includes at least an association method identifier, matching score, and basis identifier between the evidence item and the accounting event to be verified, used to characterize the credibility and traceability of the association between the evidence item and the accounting event to be verified; wherein, the basis identifier is an evidence matching basis identifier, used to record the executed association rule path, matching conditions, and their triggering basis. Furthermore, when the evidence item is a text or image file, the structured evidence package can record file summary information, access permission information, and parsing status information to support retrieval, parsing, and audit logging within compliance boundaries.

[0079] The structured evidence package may also include evidence gap markers and evidence retrieval strategy records. It should be noted that the evidence gap markers are used to record situations where key evidence types, key fields are missing, or matching credibility is insufficient, which could not be obtained under preset association rules. The evidence retrieval strategy records are used to record the evidence priority strategies corresponding to different pre-screening risk labels and the executed association rule paths, thereby providing a basis for adopting differentiated verification strategies in subsequent steps and providing traceable input for outputting a list of supplementary verification evidence to be verified in the decision support output.

[0080] This step involves using the accounting event to be verified as an anchor point and performing targeted evidence retrieval under multi-level association rules. This transforms evidence acquisition from manual retrieval to an automated and reproducible association calculation process, thereby reducing human omissions and subjective selection biases. Secondly, by prioritizing strong matching, supplementing with weak matching, and combining a risk-label-driven association strategy, the evidence recall rate is improved while controlling the risk of false associations, ensuring that subsequent cross-modal consistency verification is based on a more credible evidence set. Thirdly, by encapsulating heterogeneous evidence items into structured evidence packages containing association methods, matching scores, evidence matching basis identifiers, and gap markers, subsequent multi-modal feature extraction can perform field alignment and comparison around a unified event anchor point, and form traceable gap descriptions when evidence is insufficient. This enhances the feasibility, verifiability, and traceability of this invention in audit and compliance scenarios.

[0081] S4: Perform multimodal feature extraction and cross-modal consistency verification on the structured evidence package, and output the contradictory evidence features and consistency verification results corresponding to each accounting event to be verified.

[0082] The purpose of step S4 is to perform multimodal feature extraction and cross-modal consistency verification on the structured evidence package generated in step S3, and output the contradictory evidence features and consistency verification results corresponding to each accounting event to be verified, thereby achieving substantive verification of the accounting events to be verified. It should also be noted that this step does not only read fields within a single evidence item, but verifies the cross-source consistency of the same accounting event to be verified across different evidence items; by aligning and comparing the key elements expressing the same business fact in multimodal evidence, the traditional verification process relying on manual sampling can be transformed into a calculable, repeatable, and traceable automated verification process.

[0083] In this embodiment: field confidence information is used to characterize the credibility of the extracted fields in the multimodal extraction; evidence credibility is used to characterize the overall credibility at the evidence item level and serve as a contradiction evaluation factor; reasoning robustness index is used to characterize the stability of the graph reasoning output at step S6 and serves as a fusion weighting factor in step S7.

[0084] The multimodal feature extraction includes parsing and extracting fields from the evidence items in the structured evidence package according to evidence type, to form an evidence feature set for consistency verification. It should be noted that the evidence items include at least one or more of structured records, text items, and image items; feature extraction for structured records includes field reading, format standardization, and unit and precision unification; feature extraction for text items includes the identification and extraction of key fields such as subject, amount, date, tax rate, subject name, and clause elements; feature extraction for image items includes character recognition and extraction of ticket or layout fields based on layout element location. It should also be noted that, to ensure comparability between different evidence items, the feature extraction also includes field standardization processing, that is, mapping similar fields from different sources to a unified field dictionary, and unifying the precision of amount, currency, date format, subject representation method, tax rate representation method, etc.; in some embodiments, the field standardization processing can be implemented using the unified entity identifier and field dictionary formed in steps S1 and S3.

[0085] Furthermore, the cross-modal consistency verification includes performing field alignment and consistency determination on the evidence feature set corresponding to the same accounting event to be verified. It should be noted that field alignment is used to determine the corresponding field relationships representing the same business fact in different evidence items. These corresponding field relationships include at least one or more of the following: amount field alignment, tax rate field alignment, subject field alignment, time field alignment, quantity and unit price field alignment, and project or order identifier field alignment. After field alignment is completed, the corresponding field values ​​are used to calculate consistency indicators. Furthermore, the consistency determination includes at least one or more of the following methods: full consistency verification, used to determine whether field values ​​are consistent; tolerance consistency verification, used to determine whether field values ​​are consistent within a preset tolerance range; logical consistency verification, used to determine whether field values ​​meet preset business logic constraints; and temporal consistency verification, used to determine whether key time fields meet the natural order of the business process. It should also be noted that the tolerance range can be configured based on currency precision, tax rules, or business type, and the business logic constraints can be determined based on preset internal control rules, accounting processing rules, or invoice specifications, so that the consistency determination has industry adaptability and configurability.

[0086] Furthermore, in some embodiments, the multimodal feature extraction may also include the extraction of auxiliary features for image authenticity, used to provide a reference for the credibility of evidence in consistency determination. It should be noted that the auxiliary features for image authenticity may include one or more of the following: layout consistency features, seal or signature area element features, and abnormal occlusion or duplicate traces in key areas; by using the above auxiliary features as credibility factors for evidence items, a basis for assessing the severity of contradictions can be provided when there are field conflicts or missing information, thereby reducing the risk of misjudgment due to defects in the quality of a single piece of evidence.

[0087] This step outputs contradictory evidence features and consistency verification results. It should be noted that the consistency verification results include at least one or more of the following: consistency score, contradiction type label, evidence location information, and field alignment criteria. The evidence location information indicates the contradictory evidence item and its corresponding field location or field identifier, facilitating subsequent audit tracing and manual review. Furthermore, the contradictory evidence features are data objects that structurally represent contradictory information, including at least one or more of the following: contradictory field identifier, field difference measure, contradiction severity, set of related evidence items, and evidence credibility information. The field difference measure describes the magnitude of the contradiction; the contradiction severity can be comprehensively determined based on the contradiction type, difference magnitude, evidence credibility, and importance of business rules; and the set of related evidence items records the identifiers of the evidence items involved in the formation of the contradiction and their association methods, thus enabling the contradictory evidence features to serve as input for incremental updates of the entity relationship graph and graph neural network inference in subsequent steps.

[0088] Furthermore, in some implementations, this step can also summarize the consistency verification results to form verification conclusion segments oriented towards different risk directions. It should be noted that when the consistency verification result points to anomalies in the bill elements, a bill consistency anomaly mark is formed; when the consistency verification result points to anomalies in the process elements, a process consistency anomaly mark is formed; when the consistency verification result points to inconsistencies between funds and business elements, a funds consistency anomaly mark is formed. Through the above-mentioned summarization of causes, more targeted evidence and verification focus can be provided for subsequent risk type determination and auxiliary decision-making output.

[0089] This step transforms the verification of invoices, accounts, certificates, and facts into a computable process of generating contradictory features by performing field alignment and consistency judgment on multi-source evidence, thereby reducing the risk of subjective differences and sampling omissions in traditional manual verification. Secondly, by outputting consistency verification results that include evidence location information and field alignment basis, the system not only provides risk clues but also provides traceable evidence, facilitating audit review and compliance record keeping. Thirdly, by structuring contradictory information into contradictory evidence features and introducing expressions of evidence credibility and severity, subsequent graph updates and graph reasoning can strengthen risk tracing around contradictory-driven relationships, making it easier to locate the source of risk and propagation path in the associated network, thereby improving the invention's ability to identify hidden fraud and complex compliance risks.

[0090] S5: Update the entity relationship graph incrementally based on the accounting event flow and the contradictory evidence features, and construct the corresponding local subgraph for each accounting event to be verified.

[0091] It should be noted that the purpose of step S5 is to uniformly map the accounting event flow formed in step S1 and the contradictory evidence features output in step S4 onto the entity relationship graph, so as to form a structured relationship representation that can be used for subsequent graph reasoning. Furthermore, it constructs a corresponding local subgraph from the entity relationship graph around each accounting event to be verified, enabling subsequent graph neural network reasoning to be calculated within the scope of relationships strongly related to the events, thereby balancing risk penetration capability and computational controllability. It should also be noted that this step emphasizes incremental updates, that is, continuously adding, merging, and enhancing attributes of the graph as the accounting event flow continues to arrive, rather than repeatedly reconstructing the entire historical data, to ensure real-time performance and project feasibility, and to ensure that the risk context is updated synchronously with business evolution.

[0092] The entity relationship graph is a graph structure data with entities as nodes and relationships between entities as edges. It should be noted that the nodes include at least one or more entity types such as enterprise entities, counterparty entities, personnel, departments, bank accounts, contracts, invoices, vouchers, approval forms, orders, or projects; the edges include at least one or more of the following: fund payment relationships, invoicing and receipt relationships, contract signing and performance relationships, approval and transfer relationships, accounting and voucher attribution relationships, account attribution relationships, and relationships between related parties or shared elements. It should also be noted that each entity node preferably uses the unified entity identifier formed in steps S1 and S3 for identification, and the source identifier and time attribute are retained in the node and edge attributes to avoid the same entity being split into multiple nodes, which would lead to broken relationship chains and to support audit traceability.

[0093] Furthermore, the incremental update includes two collaborative update mechanisms: basic relationship writing based on accounting event flow and contradictory relationship writing based on contradictory evidence features. Further, the basic relationship writing includes: parsing accounting event objects in the accounting event flow, preferably including at least the accounting event objects corresponding to the accounting event to be verified, performing node existence verification and node updating, and writing or updating edges according to preset relationship mapping rules; wherein, the relationship mapping rules are used to map the event type and business element of the accounting event object to the relationship type in the graph. It should also be noted that the writing of nodes and edges preferably adopts an incremental idempotent approach, that is, merging and updating when the same entity and the same relationship arrive repeatedly, and performing accumulation or refresh processing on the relationship attributes; further, in some embodiments, enhanced writing is performed on the relationship edges corresponding to the accounting event to be verified, the enhanced writing including at least one or more of relationship strength enhancement processing and risk attribute supplementary writing, so that the graph can form a higher resolution risk context for high-concern events based on the full set of relationships.

[0094] The inversion of contradictory relationships is used to transform inconsistencies in evidence into risk signals that can be propagated and aggregated in the graph. It should be noted that the contradictory evidence features include at least one or more of the following: contradictory field identifier, difference measure, contradictory severity, set of associated evidence items, and evidence credibility information. During incremental updates, these contradictory evidence features can be written into the graph as edge attributes, node attributes, or independent contradictory nodes. Furthermore, the inversion of contradictory relationships can also combine evidence credibility, matching score, and business rule importance to perform confidence updates or attenuation processing on contradictory markers, to avoid undue amplification of graph risk signals by low-credibility or weakly associated evidence. Even further, in some embodiments, risk markers or risk weights can be set for involved entity nodes based on contradictory severity or contradictory type to characterize potential risk sources or key verification objects, thereby providing guidance for the focused construction of subsequent local subgraphs.

[0095] It should be noted that, to ensure the stability and consistency of the graph update, this step can perform consistency governance on newly added or updated nodes and edges, including entity disambiguation verification, relationship direction verification, time attribute verification, and duplicate relationship merging verification. When multiple identifier conflicts are found for the same entity, strong identifier merging can be prioritized and alias mapping relationships can be retained. When duplicate or contradictory attributes are found for relationship edges, valid attributes can be selected based on time, evidence credibility, or business status, and change records can be retained to support subsequent audit traceability and model training.

[0096] Furthermore, constructing a corresponding local subgraph for each accounting event to be verified includes: using the accounting event to be verified and its related entities as a seed set, extracting a subgraph from the entity relationship graph according to a preset expansion strategy, and injecting the relationship context and contradiction information related to the event into the node and edge attributes of the subgraph, making it an analysis unit that can be independently used for graph reasoning. It should be noted that the expansion strategy includes at least one or more of the following: hop count expansion strategy, time window constraint strategy, relationship type constraint strategy, and relationship strength constraint strategy: the hop count expansion strategy is used to traverse along the relationship edges within a preset hop count range to obtain adjacent entities; the time window constraint strategy is used to retain only nodes and edges that are associated with the accounting event to be verified within a preset time range to reduce the introduction of historically irrelevant relationships; the relationship type constraint strategy is used to limit the set of relationship types used for expansion; the relationship strength constraint strategy is used to prioritize retaining nodes and edges with high relationship strength or risk markers to improve the information density and relevance of the subgraph. Furthermore, in some implementations, the expansion strategy can also be adaptively adjusted based on the contradiction type between the pre-screening risk label in step S2 and step S4. For example, when the contradiction points to the invoice element, priority is given to expanding the relationship related to the contract, invoice, warehousing, or acceptance; when the contradiction points to the process element, priority is given to expanding the relationship between the approval link and the person in charge, so that the local subgraph can more centrally cover the key verification path.

[0097] Furthermore, the output of the local subgraph may include a set of subgraph nodes, a set of subgraph edges and their attributes, and the identification mapping information of nodes and edges in the original graph. The attributes include at least one or more of the following: risk-related time, amount, relationship type, contradiction marker, risk marker, matching score, field confidence information, evidence credibility information, contradiction marker confidence level, and source tracing information, serving as input feature sources for subsequent graph neural network inference. It should also be noted that by preserving a structured representation of multi-hop relationship chains in the local subgraph, support can be provided for subsequent risk source tracing and interpretation output, expanding risk analysis from single-point contradiction location to the identification of propagation chains at the relationship network level.

[0098] This step elevates risk signals from single-point events to structured information that can propagate and aggregate along relationships by writing accounting event objects and contradictory evidence into an entity relationship graph with unified entity identifiers. This supports penetrating analysis of network risks such as hidden related-party transactions, fund loops, or multi-person collaborative fraud. Secondly, through the graph representation of contradictory evidence features and optional risk labeling mechanisms, subsequent graph reasoning can leverage contradictory-driven relationships to strengthen and form a more targeted risk context, improving the ability to identify substantive contradictions and key responsibility chains. Thirdly, by constructing a local subgraph of the event center and applying hop count, time window, and relationship constraints, the computational scope of graph reasoning is controllable and more relevant. This reduces noise caused by irrelevant relationships and enables the system to operate stably under continuous data throughput conditions, thus providing a highly relevant, traceable, and implementable input structure for the graph neural network reasoning in the subsequent step S6.

[0099] S6: Perform graph neural network inference on the local subgraph and output the graph risk score and risk association path corresponding to each accounting event to be verified.

[0100] The purpose of step S6 is to perform risk reasoning and penetration analysis at the relational network level on the local subgraph constructed in step S5, based on the local subgraph to be verified, and output graph risk scores and risk association paths corresponding to each accounting event to be verified, thereby further improving the process from single-point contradiction verification to relational network tracing. It should also be noted that the graph neural network reasoning does not directly calculate the entire entity relationship graph of the enterprise, but rather performs reasoning on local subgraphs strongly correlated with the accounting events to be verified, in order to control the computational scale while ensuring penetration depth and meeting real-time or near-real-time processing requirements.

[0101] Performing graph neural network inference on the local subgraph includes: taking the graph structure relationships, node features, and edge features of the local subgraph as input, iteratively updating the node and edge representations using a graph neural network model, and outputting risk inference results based on the updated graph representations. It should be noted that the node features include at least one or more of the following: entity type, subject identifier, key attributes of transactions or documents, time attribute, amount attribute, relationship strength attribute, risk label attribute, and contradiction label attribute; the edge features include at least one or more of the following: relationship type, occurrence time, amount or frequency attribute, matching score, evidence credibility, and contradiction severity. It should also be noted that by introducing contradictory evidence features and risk labels on nodes and edges, the graph neural network can explicitly utilize the substantial risk signal of evidence inconsistency during information propagation and aggregation, thereby improving its ability to identify hidden fraud chains and complex compliance risks.

[0102] Furthermore, the graph neural network model employs message passing and aggregation mechanisms to propagate information through multiple rounds in local subgraphs, enabling nodes related to the accounting event to be verified to integrate contextual information from their multi-hop neighborhoods to capture multi-hop relationship patterns such as closed-loop related-party transactions, fund repatriation, joint agents, or shared accounts. In some implementations, the model can set differentiated aggregation weights for different relationship types to distinguish the contributions of financial relationships, bill relationships, process relationships, and entity relationships to risk inference; and can combine time attributes and relationship strength attributes to constrain information propagation, thereby enhancing sensitivity to recent, high-intensity abnormal relationships and suppressing interference from low-relevance historical relationships.

[0103] It should be noted that the graph risk score is a quantitative result of risk output for each accounting event to be verified, used to characterize the degree to which it triggers abnormal patterns at the relational network level. Furthermore, the graph risk score may include one or more of risk probability, risk level, or comprehensive risk score. Its generation can be based on a comprehensive calculation of the inference representation of nodes and edges in the local subgraph, and combined with the severity of contradictory evidence, the credibility of evidence, the distribution of relational strength, and abnormal structural characteristics, so that the score not only reflects the intensity of a single point of contradiction, but also reflects the potential hidden risks revealed by the network structure. Furthermore, in some embodiments, graph sub-scores can be output separately for different risk directions to support subsequent risk type segmentation and matching of treatment strategies.

[0104] It should also be noted that the risk association path is used to provide a structured interpretation of graph risk scoring, representing the key relationship chains and key node sets that trigger high-risk scoring from the accounting event to be verified in a local subgraph. Furthermore, the generation of the risk association path includes: during or after graph neural network inference, determining candidate key nodes and key edges based on the importance contribution information of nodes and edges, and organizing them into one or more multi-hop paths; wherein, the importance contribution information can be obtained from the aggregation weights, attention contributions, sensitivity analysis results, or path scoring rules output by the model. It should also be noted that the risk association path includes at least one or more of the following: entity identifiers, relationship types, key attributes, contradiction markers, and confidence information, enabling auditors to locate where the risk propagates and through which relationship chains it forms a tracing clue.

[0105] In some implementations, the graph neural network model may also output inference confidence or uncertainty measure, which is used to characterize the stability of graph risk score and risk association path, and may be used as a component of the inference robustness index in step S7.

[0106] Furthermore, in some implementations, to enhance the robustness and operability of the reasoning results, this step may also perform post-processing verification on the graph risk score and risk association paths. It should be noted that the post-processing verification may include: filtering relationship chains in the path with insufficient evidence credibility or contradiction severity; verifying the chronological order of the paths to avoid generating explanatory paths that do not conform to the natural business sequence; and constraining the combination of path length and relationship type to improve the readability of the explanation results. Through these methods, while providing penetrating analysis capabilities, it is possible to ensure that the output explanation paths possess business rationality and traceability.

[0107] This step, by performing graph neural network inference on local subgraphs, can capture multi-hop correlation risk patterns that are difficult to identify based on traditional single-transaction rules, achieving network-level identification of hidden related transactions, fund loops, and coordinated fraud. Secondly, by introducing contradictory evidence features and risk labels as graph feature inputs, the model can use the substantial signal of evidence inconsistency to strengthen risk inference, thereby reducing false alarms caused by relying solely on statistical anomalies and improving the hit rate of substantial risks. Thirdly, by outputting risk correlation paths, the basis for graph risk scoring is presented in the form of a structured relational chain, enabling the system to not only provide risk quantification results but also provide traceable and verifiable tracing clues, providing interpretable network evidence support for subsequent risk type determination and auxiliary decision-making.

[0108] S7: Integrate the pre-screening results, the consistency verification results, and the graph risk score to determine the risk type and risk level of each accounting event to be verified, and output the auxiliary decision-making results corresponding to the risk type and risk level.

[0109] The purpose of step S7 is to integrate the pre-screening results output from step S2, the consistency verification results output from step S4, and the graph risk score output from step S6 to form a final risk assessment for each accounting event to be verified, determine its risk type and risk level, and output auxiliary decision-making results corresponding to the risk type and risk level. It should also be noted that this step is not a simple superposition of multiple risk results, but rather a unified risk fusion and decision mapping mechanism that complementarily verifies rapid clues at the event attribute level, substantial contradictions at the evidence level, and propagation risks at the relationship network level, thereby improving the stability and operability of risk assessment while ensuring identification efficiency.

[0110] The fusion process includes feature alignment, unified dimensional processing, and confidence adjustment of the pre-screening results, consistency verification results, and graph risk scores. It should be noted that feature alignment is used to extract quantitative and qualitative elements from each input result that can be used for comprehensive judgment. These elements include at least one or more of the following: pre-screening risk score or label, consistency score and main contradiction type, graph risk score and critical path features. Unified dimensional processing is used to convert risk outputs from different sources into comparable standardized expressions. These standardized expressions include at least one or more of the following: unified risk score, unified level label, or unified confidence expression. Confidence adjustment is used to weight the contribution of each input result based on the pre-screening basis identifier, contradiction severity, evidence credibility, and reasoning robustness indicators. Furthermore, in some implementations, the pre-screening results can be assigned a basic weight based on the certainty corresponding to the pre-screening basis identifier; the consistency verification results can be assigned a contradiction weight based on the contradiction evidence severity and evidence credibility; and the graph risk score can be assigned a network weight based on the local subgraph structure anomaly strength and risk-related path consistency. This allows the fusion result to reflect the decision-making principle that strong evidence receives greater weight and weak clues receive lower weight.

[0111] It should be noted that the inference robustness index is used to characterize the stability and interpretability consistency of the graph inference output, and may include, but is not limited to, one or more of the following: the pass rate of risk association path time sequence verification, the result of risk association path consistency verification, the proportion of high-confidence relationships retained after filtering in the path, and the confidence expression of the inference output.

[0112] Furthermore, the fusion can be achieved through rule-based fusion, model-based fusion, or a combination of both. It should be noted that rule-based fusion is used to prioritize risks that meet strong constraints or highly deterministic patterns. For example, when a consistency check result shows a high-severity contradiction in a key field and the credibility of the evidence meets a threshold, the risk level can be directly increased or a specific risk type can be triggered. Model-based fusion is used to comprehensively evaluate the interaction relationships between multi-dimensional signals to output a comprehensive risk score or comprehensive risk level. The combination of both methods is used to improve the coverage of complex risk patterns while ensuring interpretability. It should also be noted that, regardless of the fusion method used, it is preferable to retain traceable records of contributions to the input signals for subsequent audit review and result reproduction.

[0113] It should be noted that determining risk types and risk levels includes: classifying the accounting events to be verified into risk categories and severity levels based on the fusion results. Furthermore, the risk types include at least one or more of the following: invoice and tax compliance risk, fund and transaction authenticity risk, process and internal control risk, and related party and network fraud risk; the risk levels include at least high, medium, and low levels, or corresponding multi-level risk tiers. It should also be noted that the determination of risk types can be cross-validated by combining pre-screening risk labels, conflict type labels, and relationship types of risk association paths: for example, when the conflict type is mainly concentrated on invoice elements and the risk association path includes invoicing and accounting relationships, it can be classified as invoice and tax compliance; when the risk association path presents a fund return or closed-loop structure and the graph risk score is significantly increased, it can be classified as related party and network fraud; when time sequence inconsistency anomalies and approval link deficiencies dominate in the fusion, it can be classified as process and internal control. Through the above methods, risk types and risk levels have interpretable judgment criteria and can form a consistent mapping with subsequent handling strategies.

[0114] Furthermore, the output of auxiliary decision-making results includes selecting matching handling suggestions, verification strategies, and evidence supplementation requirements based on risk type and risk level, and outputting them in a structured manner. It should be noted that the auxiliary decision-making results include at least one or more of the following: handling suggestions, a list of evidence to be supplemented for verification, review priorities, and recommended verification paths. The handling suggestions specify the type and intensity of handling actions under the corresponding risk level; the list of evidence to be supplemented indicates the current evidence gaps and the types or fields of evidence that need to be supplemented; the review priorities are used to prioritize events under limited audit resources; and the recommended verification paths combine risk-related paths and evidence location information to suggest the verification order and key targets. It should also be noted that the auxiliary decision-making results are preferably generated based on a preset risk handling mapping rule base. This rule base defines standardized response strategies corresponding to different risk types and risk levels, thereby ensuring the consistency, executability, and reusability of the decision output.

[0115] Furthermore, in some implementations, this step can also generate decision execution parameters to drive the collaborative handling of subsequent systems or manual processes. It should be noted that the decision execution parameters include at least one or more of the following: action type, action threshold, responsible role, notification scope, and review time limit; by mapping the risk assessment results to executable parameters, standardized connection from risk identification to action execution can be achieved, reducing the cost of manual interpretation and execution deviations.

[0116] This step integrates pre-screening results, consistency verification results, and graph risk scoring to complementarily verify risk signals at the clue, evidence, and network layers. This ensures that the final risk assessment is efficient, substantive, and penetrating, thereby improving robustness and reducing resource waste caused by false alarms from a single module. Secondly, through a joint discrimination mechanism based on risk labels, contradiction types, and risk correlation paths, the risk type classification has an interpretable basis, enabling subsequent actions to match the risk causes and avoiding a one-size-fits-all approach. Thirdly, by outputting structured auxiliary decision-making results bound to risk type and risk level, the system not only completes risk identification but also provides actionable verification priorities and handling paths, improving the operability and closed-loop efficiency of audit and compliance handling.

[0117] Example 2 is the second embodiment of the present invention, which differs from the previous embodiment in that:

[0118] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art or the current technical solution, can be embodied in the form of a software product. This current computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0119] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0120] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0121] Example 3, referring to Figure 2 As an embodiment of the present invention, an accounting risk identification and auxiliary decision-making system is provided, which includes an event flow generation module, a pre-screening module, an evidence association module, a consistency verification module, a graph update module, a graph reasoning module, and a fusion decision-making module;

[0122] Event stream generation module: Acquires accounting-related data streams, cleans and standardizes the accounting-related data streams, and generates accounting event streams;

[0123] Pre-screening module: Performs real-time pre-screening on the accounting event stream, and outputs a set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified;

[0124] Evidence association module: For each accounting event to be verified, obtain evidence data associated with the accounting event to be verified based on preset association rules, and generate a structured evidence package;

[0125] Consistency verification module: Performs multimodal feature extraction and cross-modal consistency verification on the structured evidence package, and outputs contradictory evidence features and consistency verification results corresponding to each accounting event to be verified;

[0126] Graph update module: Increments the entity relationship graph based on the accounting event flow and the contradictory evidence features, and constructs the corresponding local subgraph for each accounting event to be verified;

[0127] Graph reasoning module: Performs graph neural network reasoning on the local subgraph and outputs graph risk scores and risk association paths corresponding to each accounting event to be verified;

[0128] Fusion Decision Module: Fusion of the pre-screening results, the consistency verification results, and the graph risk score to determine the risk type and risk level of each accounting event to be verified, and output auxiliary decision results corresponding to the risk type and risk level.

[0129] Example 4 is an embodiment of the present invention, which provides an accounting risk identification and decision support method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation / comparative experiments.

[0130] The experiment used historical anonymized business data from a medium-sized equipment manufacturing enterprise in China for one quarter. This data was replayed chronologically to create an incremental data stream, simulating real-world online operating conditions. The data covered multiple sources, including ERP accounts payable and general ledger entries, purchase orders and receiving information, contract terms and archived records, structured fields and image files from the VAT invoice platform, bank-enterprise direct payment records and receipts, and OA approval logs. The total number of transactions covered in the quarter was 12,400. The determination of event truth values ​​involved cross-referencing audit review conclusions, payment refund or freeze records, tax verification receipts, and business supplementary documentation results to create a reference label, ensuring the evaluation criteria were traceable and verifiable. Six comparison schemes were set up: Scheme A was manual sampling audit; Scheme A2 was manual verification with scripts; Scheme B was rule engine monitoring; Scheme B2 was rule-based adaptive statistical analysis; Scheme B3 was cross-modal consistency verification without introducing graph inference; and Scheme C was the entire-link system of this invention. All schemes ran on the same hardware environment and the same dataset to ensure a consistent comparison basis.

[0131] In step S1, the system of the present invention performs cleaning and standardization processing on accounting-related data streams to generate accounting event streams. During the cleaning phase, missing fields are completed according to account set, organizational dimension, and business rules; duplicate records are deduplicated idempotently based on source identifiers, business primary keys, and time windows; boundary checks are performed on amount symbols, tax rate ranges, date reversal, and field type consistency, and anomaly flags are written; entity disambiguation is performed on main information, and for cases where the same supplier has different abbreviations in the ERP and invoice systems, normalization mapping is completed based on tax number, and when strong identifiers are insufficient, auxiliary matching is completed by combining name similarity with a preset mapping table to ensure the stability of subsequent evidence association chains. During the standardization phase, multi-source fields are mapped to a unified field dictionary, unifying amount precision, currency, and date format, and establishing cross-system aligned indexes for associated identifiers such as voucher number, document number, contract number, invoice number, and approval number. Subsequently, the recorded events are transformed into a sequence of accounting event objects arranged in chronological order, while retaining the original record pointers to support audit traceability.

[0132] In step S2, real-time pre-screening is performed on the accounting event flow to form a set of accounting events to be verified. The pre-screening extracts risk characteristics for each accounting event object, such as amount deviation, frequency abrupt changes, time anomalies, entity anomalies, and completeness of related identifiers. It also uses rule-based screening and lightweight model screening to collaboratively output pre-screening risk measures, and generates pre-screening basis identifiers and risk labels to characterize the trigger source and verification direction. The generation of the set of accounting events to be verified uses a combination of threshold screening, risk measure ranking, and anomaly labeling triggering, ensuring that subsequent evidence verification only triggers the candidate set, thereby avoiding the resource consumption and increased latency caused by entering all transactions one by one into a heavy computational chain.

[0133] In step S3, evidence is retrieved and packaged into a structured evidence package based on preset association rules surrounding the accounting event to be verified. Evidence association is centered on primary key matching such as invoice number, contract number, and voucher number, supplemented by entity information, amount range, and time window. Deduplication and valid version selection are performed on the evidence items to form associated evidence data for verification. This associated evidence data is then organized and packaged into a structured evidence package, which includes at least an evidence package identifier, a corresponding accounting event identifier to be verified, a set of evidence items, and evidence association information. The evidence association information includes evidence matching basis identifiers and matching scores, thereby ensuring that the evidence retrieval process is reproducible and traceable.

[0134] In step S4, multimodal feature extraction and cross-modal consistency verification are performed on the structured evidence package. Structured records are directly read and fields are standardized; key fields are identified and extracted from contract text; character recognition is performed on invoices, receipts, and other image files, and invoice fields are extracted based on layout positioning; similar fields are mapped to a unified field dictionary, and field standardization and alignment are completed. Based on this, complete consistency, tolerance consistency, logical consistency, and temporal consistency judgments are performed, outputting consistency scores, contradiction type labels, and evidence location information, and generating contradictory evidence features. In the quarterly sample, contradictions such as contract amounts exceeding thresholds for the total price and tax of invoices, discrepancies between the receipt payment account and the contractually agreed account, and missing or abnormal approval links can all be located to specific evidence items and field positions, thus providing structured input for subsequent graph updates and reasoning.

[0135] In steps S5 and S6, the entity relationship graph is incrementally updated based on the accounting event flow and contradictory evidence features. After constructing a local subgraph, graph neural network inference is executed. Graph nodes include entity types such as enterprise entities, suppliers, personnel, departments, bank accounts, contracts, invoices, vouchers, and approval forms. Relationship edges include relationship types such as fund receipt and payment, invoicing and receipt, contract ownership, approval flow, and accounting ownership. Contradictory evidence features are written as risk attributes into relevant nodes and relationship edges. The local subgraph uses the accounting event to be verified and its related entities as the seed set, and is truncated based on hop count, time window, relationship type, and relationship strength constraints, so that the inference scope focuses on the relationship network strongly related to the event. Graph neural network inference outputs graph risk score and risk association path. In network-type risk samples, the risk association path can reveal multi-hop hidden associations between the handler, the beneficiary relationship of the receiving account, and the control relationship of the supplier, thereby achieving penetrating identification that is difficult for the rule engine to cover stably.

[0136] In step S7, the pre-screening results, consistency verification results, and graph risk scores are integrated to form a comprehensive risk assessment result, thereby determining the risk type and risk level, and outputting auxiliary decision-making results corresponding to the risk type and risk level. These results are used to drive subsequent actions such as freezing, supplementing certificates, review and sorting, and verification path arrangement, so that the risk identification results are executable and have a closed-loop implementation capability.

[0137] The key data recorded is shown in Table 1:

[0138] Table 1: Experimental Data Recording Table

[0139]

[0140] As can be seen from the table, while maintaining a consistent "total transaction volume covered," the differences among the various schemes are mainly reflected in key indicators such as candidate screening quality, evidence verification efficiency, contradiction location capability, network risk penetration capability, and review cost. These differences can form a stable correspondence with the technical mechanisms of each step in this invention. First, in terms of response efficiency, Scheme A and Scheme A2 are constrained by manual scheduling and post-event sampling processes, with risk identification response times in the range of 173,520 seconds and 91,840 seconds, respectively, which is difficult to meet the near real-time monitoring requirements of the procurement payment chain. Although Scheme B and Scheme B2 can compress the response time to 318.6 seconds and 247.1 seconds, their main cost is the generation of a large number of rule-triggered alarms and the resulting pressure of secondary screening. Solution C further reduces the response time to 142.8 seconds. Instead of simply lowering the threshold, it controls the number of events within a verifiable range through pre-screening and reduces cross-system retrieval overhead through targeted evidence retrieval driven by association rules. This allows the heavy verification chain to complete the closed loop within a controllable scale, thereby achieving the simultaneous realization of "reduced latency" and "improved verification quality".

[0141] Secondly, false alarm control and accuracy metrics directly reflect the structural shortcomings of existing technologies. Scheme B has a false alarm rate of 34.2% and an overall accuracy of only 65.8%, indicating that alarm mechanisms relying solely on rule triggers are ill-equipped to reliably distinguish between "reasonable business exceptions" and "substantive risks." Furthermore, it is prone to false triggering and propagation under conditions of multiple accounts, differences in organizational definitions, and cross-system data drift. Scheme B2 uses statistical adaptation to somewhat suppress threshold drift, reducing the false alarm rate to 26.7%, but it remains at a relatively high level. The key comparison lies between Schemes B3 and C: when cross-modal consistency verification is introduced, the false alarm rate significantly decreases to 14.3% and 12.0%, respectively, while the accuracy increases to 83.1% and 87.9%, respectively. This demonstrates that consistency verification can converge generalized alarms into "locatable contradictory evidence features," providing evidence for risk assessment and reducing statistical false alarms. This result further illustrates that relying solely on rule or statistical adaptation is insufficient to obtain substantive constraints equivalent to evidence verification, and existing technologies struggle to achieve the false alarm suppression effect embodied in this invention without introducing evidence-level cross-validation.

[0142] Furthermore, the underreporting rate of major risks and the number of network-based risk patterns detected reflect the differences in the ability to penetrate hidden association structures. The underreporting rates of major risks for Scheme B and Scheme B2 are 21.3% and 17.0%, respectively, and the number of network-based risk patterns detected is only 2 and 3, respectively. This indicates that their identification capabilities are still mainly limited to the level of single-event attributes or one-hop relationships, making it difficult to reliably cover collaborative fraud and hidden associations in multi-hop transmission structures. Scheme C reduces the underreporting rate of major risks to 5.9% and increases the number of network-based risk patterns detected to 7, with a risk association path explainability score of 4.4. This shows that incremental graph updates and local subgraph reasoning enable the continuous accumulation of risk context and output traceable chain-like evidence through relational network reasoning, thereby filling the gap in the rule system's ability to "not see or understand" complex network risks. Further comparison with scheme B3 shows that although the accuracy rate of contradictory evidence location in B3 has been improved to 79.1%, the number of network-type risk detections is still 3 and the false negative rate is 14.6%. This indicates that evidence consistency verification can significantly improve "contradictory location and false alarm suppression". However, the gain in "multi-hop relationship penetration and hidden association identification" requires further support from the graph reasoning module. This also proves the necessity of the present invention in the collaborative design of the evidence layer and the network layer.

[0143] Finally, the review time and interpretability indicators reflect the executable nature of the output for business handling. The weekly manual review time for Solution C is 29.2 hours, significantly lower than Solution B's 60.1 hours and Solution A's 88.0 hours. This indicates that the output not only provides risk conclusions but also offers traceable evidence and clues for tracing relationships, thereby reducing the time spent by reviewers repeatedly searching across multiple systems, piecing together links, and explaining alarm causes. This shifts the review process from "finding evidence" to "making judgments." In summary, this embodiment, through a unified sample benchmark and multi-solution breakdown comparison, provides direct counter-evidence against the shortcomings of existing technologies at the objective indicator level: existing technologies struggle to simultaneously achieve low false alarms, low false negatives, the ability to penetrate related networks, and the rapid formation of executable handling clues. In contrast, this invention, through a collaborative mechanism of evidence consistency verification and graph reasoning, enables these effects to be achieved in parallel and stably implemented under engineering constraints.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying accounting risks and supporting decision-making, characterized in that, include: Acquire accounting-related data streams, and clean and standardize these data streams to generate accounting event streams; Perform real-time pre-screening on the accounting event flow and output the set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified. For each accounting event to be verified, evidence data associated with the accounting event to be verified is obtained based on preset association rules, and a structured evidence package is generated; Multimodal feature extraction and cross-modal consistency verification are performed on the structured evidence package, and contradictory evidence features and consistency verification results corresponding to each accounting event to be verified are output. The entity relationship graph is updated incrementally based on the accounting event flow and the contradictory evidence features, and a corresponding local subgraph is constructed for each accounting event to be verified. Graph neural network inference is performed on the local subgraph to output the graph risk score and risk association path corresponding to each accounting event to be verified; By integrating the pre-screening results, the consistency verification results, and the graph risk score, the risk type and risk level of each accounting event to be verified are determined, and auxiliary decision-making results corresponding to the risk type and risk level are output. The real-time pre-screening includes: extracting features from accounting event objects in the accounting event stream to generate a risk feature set for pre-screening; performing pre-screening based on the risk feature set and outputting a pre-screening risk measure corresponding to each accounting event object; and selecting accounting event objects from the accounting event stream based on the pre-screening risk measure to form the set of accounting events to be verified. The process of obtaining evidence data associated with the accounting event to be verified includes: retrieving evidence entries associated with the accounting event to be verified based on one or more of the association identifier set, entity information, and pre-screening risk tags of the accounting event to be verified, according to preset association rules; deduplicating or selecting valid versions of the evidence entries; and organizing and encapsulating the processed associated evidence data into the structured evidence package. The process of performing multimodal feature extraction and cross-modal consistency verification includes: parsing and extracting fields from the evidence items in the structured evidence package according to evidence type to generate an evidence feature set; performing field standardization on the evidence feature set; performing field alignment and consistency determination on the evidence feature set corresponding to the same accounting event to be verified; and generating the contradictory evidence features and consistency verification results based on the consistency determination. The step of incrementally updating the entity relationship graph based on the accounting event flow and the contradictory evidence features, and constructing a corresponding local subgraph for each accounting event to be verified, includes: parsing the main entity, associated identifier, and business elements of the accounting event object based on the accounting event flow; performing node existence verification and node updating in the entity relationship graph; and writing or updating relationship edges according to preset relationship mapping rules; writing contradictory relationship information in the entity relationship graph based on the contradictory evidence features; and constructing a local subgraph includes: using the accounting event to be verified and its associated entities as a seed set, and extracting a local subgraph from the entity relationship graph according to a preset expansion strategy.

2. The accounting risk identification and decision support method as described in claim 1, characterized in that, The generation of the accounting event stream includes: The accounting-related data stream is cleaned, including: rule completion for missing fields based on account set, organizational dimension, or business rules; idempotent deduplication of duplicate records based on source identifier, business primary key, and time window; boundary verification and anomaly marking for outliers; and entity disambiguation of main information based on strong identifier and name similarity. The cleaned data is standardized, including: field mapping and type unification, cross-system identifier alignment, and business time alignment. After the data records have been cleaned and standardized, they are processed into event-based data and transformed into a sequence of accounting event objects arranged in chronological order to generate the accounting event flow. Each accounting event object contains at least an event identifier, event type, occurrence time, amount information, subject entity information, and a set of associated identifiers, and retains the original record pointer for audit traceability.

3. The accounting risk identification and decision support method as described in claim 2, characterized in that, In the real-time pre-screening of the accounting event flow: The risk feature set includes at least one or more of the following: amount deviation feature, frequency mutation feature, time anomaly feature, subject anomaly feature, and related identifier integrity feature; The pre-screening risk measure includes at least one of pre-screening risk score and pre-screening risk probability; The selection includes at least one or more of the following: based on a preset threshold, based on risk measurement ranking, based on rule or anomaly marker triggering, and based on tiered quota control. Output the pre-screening results corresponding to each accounting event to be verified in the set of accounting events to be verified, wherein the pre-screening results include at least one or more of the pre-screening risk measure, the pre-screening basis identifier, and the pre-screening risk label.

4. The accounting risk identification and decision support method as described in claim 3, characterized in that, The association rules include at least one or more of the following: primary key association rules, attribute association rules, and time-series window association rules; The structured evidence package includes at least an evidence package identifier, a corresponding accounting event identifier to be verified, a set of evidence items, and evidence association information; The evidence association information includes at least one of the evidence matching basis identifier and the matching score.

5. The accounting risk identification and decision support method as described in claim 4, characterized in that, The field standardization process includes mapping similar fields from different sources to a unified field dictionary, and standardizing at least one of the following: amount precision, currency, date format, subject representation method, and tax rate representation method. The consistency determination includes at least one of full consistency verification, tolerance consistency verification, logical consistency verification, and timing consistency verification. The consistency verification result includes at least one of the following: consistency score, contradiction type label, and evidence location information. The contradictory evidence features include at least one of the following: contradiction field identifier, field difference measure, contradiction severity, and set of related evidence items.

6. The accounting risk identification and decision support method as described in claim 5, characterized in that, The contradictory relationship information is associated as a risk attribute with at least one of the entity nodes and relation edges involved in the contradiction; The preset expansion strategy includes at least one or more of the following: hop count expansion strategy, time window constraint strategy, relation type constraint strategy, and relation strength constraint strategy.

7. The accounting risk identification and decision support method as described in claim 6, characterized in that, The execution graph neural network inference includes: The graph structure, node features, and edge features of the local subgraph are input into a graph neural network model, and the node features and edge features are iteratively updated to generate a graph representation of the local subgraph. Based on the graph representation, output the graph risk score corresponding to the accounting event to be verified; Based on the contribution information of node features and edge features output by the graph neural network model, key nodes and key edges are determined from the local subgraph, and risk association paths composed of the key nodes and key edges are generated.

8. The accounting risk identification and decision support method as described in claim 7, characterized in that, The process of determining the risk type and risk level of each accounting event to be verified, and outputting auxiliary decision-making results corresponding to the risk type and risk level, includes: The pre-screening results, the consistency verification results, and the graph risk score are subjected to feature alignment and fusion processing to obtain a comprehensive risk assessment result; Based on the comprehensive risk assessment results, the risk type and risk level of each accounting event to be verified are determined; Based on the risk type and the risk level, the auxiliary decision-making result is generated and output.

9. An accounting risk identification and decision support system, used to implement the accounting risk identification and decision support method as described in any one of claims 1 to 8, characterized in that, include: Event stream generation module: Acquires accounting-related data streams, cleans and standardizes the accounting-related data streams, and generates accounting event streams; Pre-screening module: Performs real-time pre-screening on the accounting event stream, and outputs a set of accounting events to be verified and the pre-screening results corresponding to each accounting event to be verified; Evidence association module: For each accounting event to be verified, obtain evidence data associated with the accounting event to be verified based on preset association rules, and generate a structured evidence package; Consistency verification module: Performs multimodal feature extraction and cross-modal consistency verification on the structured evidence package, and outputs contradictory evidence features and consistency verification results corresponding to each accounting event to be verified; Graph update module: Increments the entity relationship graph based on the accounting event flow and the contradictory evidence features, and constructs the corresponding local subgraph for each accounting event to be verified; Graph reasoning module: Performs graph neural network reasoning on the local subgraph and outputs graph risk scores and risk association paths corresponding to each accounting event to be verified; Fusion Decision Module: Fusion of the pre-screening results, the consistency verification results, and the graph risk score to determine the risk type and risk level of each accounting event to be verified, and output auxiliary decision results corresponding to the risk type and risk level.

Images