Audit data processing method and device and computer equipment

Abstract

The invention relates to an audit data processing method and device and computer equipment. The method comprises the steps of obtaining an auditing template matched with an auditing risk signal from an auditing knowledge graph under the condition that the auditing risk signal is detected, and determining a corresponding evidence obtaining task list according to the auditing template; for each evidence obtaining task in the evidence obtaining task list, calling an audit evidence text matched with the evidence obtaining task from the service system; retrieving auditing knowledge matched with the auditing evidence text from an auditing knowledge graph, and constructing context information according to the auditing knowledge and the auditing evidence text; inputting the context information into an evidence analysis model to obtain a corresponding evidence analysis result; the evidence analysis result comprises at least one of the abstract of the context information, the key information and the compliance judgment. By adopting the method, the auditing efficiency can be improved.

Description

Technical Field

[0001] This application relates to the field of big data processing technology, and in particular to an audit data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] In business operations, auditing is an important component of risk management and corporate governance. Traditional internal audit processes, especially in the project initiation and investigation phases, rely heavily on manual operations.

[0003] In traditional auditing, the internal audit process is as follows: When the audit department detects a risk warning signal (e.g., abnormal indicators from business systems or external whistleblower information), auditors need to conduct a preliminary manual assessment to determine whether an audit should be initiated. If an audit is initiated, auditors need to draft and submit a series of initiation documents, such as the "Audit Initiation Application Form" and "Audit Plan," and undergo a cumbersome internal approval process, which typically takes several days or even weeks. After approval, auditors proceed to the investigation and evidence collection phase. This phase requires auditors to manually log into multiple (usually independent) internal business systems, such as customer relationship management (CRM) systems, financial systems, core business systems, and email servers, based on their experience. Auditors manually search, download, and organize relevant evidence in these systems. This process is time-consuming and labor-intensive. Senior auditors are occupied by a large amount of transactional and repetitive preliminary work, and cannot fully devote their energy to the core audit analysis phase that requires highly professional judgment, resulting in a waste of human resources. Therefore, current auditing work suffers from inefficiency. Summary of the Invention

[0004] Therefore, it is necessary to provide an audit data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the efficiency of audit work in response to the above-mentioned technical problems.

[0005] Firstly, this application provides an audit data processing method, including:

[0006] Upon detecting an audit risk signal, an audit template matching the audit risk signal is obtained from the audit knowledge graph, and a corresponding list of evidence collection tasks is determined based on the audit template.

[0007] For each evidence collection task in the evidence collection task list, retrieve the audit evidence text that matches the evidence collection task from the business system;

[0008] Retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and construct context information based on the audit knowledge and the audit evidence text;

[0009] Contextual information is input into the evidence analysis model to obtain corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the contextual information, key information, and compliance judgment.

[0010] In one embodiment, the audit knowledge graph includes multiple audit templates and template feature vectors corresponding to the audit templates; the step of obtaining the audit template matching the audit risk signal from the audit knowledge graph includes:

[0011] Convert the risk text information indicated by the audit risk signal into a risk feature vector;

[0012] For any of the audit templates, the matching score of the audit template is determined based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template.

[0013] Based on the matching score of each audit template, audit templates that match the audit risk signal are selected from the audit templates.

[0014] In one embodiment, determining the matching score of the audit template based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template includes:

[0015] Determine the semantic similarity between the risk feature vector and the template feature vector corresponding to the audit template;

[0016] Determine the degree of overlap between the entity types in the risk text information and the entity types in the audit template;

[0017] The matching score of the audit template is determined based on the semantic similarity, the overlap, and the template weight of the audit template.

[0018] In one embodiment, determining the corresponding evidence collection task list based on the audit template includes:

[0019] The key information in the risk text information is filled into the placeholders of the audit template that matches the audit risk signal to obtain the evidence collection task corresponding to the audit template;

[0020] Based on the execution order and dependencies between the various evidence collection tasks, construct a list of evidence collection tasks corresponding to the audit template.

[0021] In one embodiment, retrieving the audit evidence text matching the forensic task from the business system includes:

[0022] For the aforementioned evidence collection task, a corresponding client credential authorization request is initiated to the authorization center; the client credential authorization request includes an identity identifier and access permission scope;

[0023] Receive the security token returned by the authorization center after verifying the client's credential authorization request;

[0024] Based on the security token, generate the corresponding API call request, and send the API call request for the business system to the API gateway;

[0025] Receive business data returned by the API gateway that matches the evidence collection task and is invoked from the business system;

[0026] Extract the audit evidence text of the evidence collection task instruction from the business data.

[0027] In one embodiment, the evidence analysis model includes a large language model; the step of inputting contextual information into the large language model to obtain the evidence analysis result includes:

[0028] The context information is then filled into the prompt template to obtain the filled template.

[0029] The filled template is input into the large language model, which generates a summary of the context information based on the filled template, extracts key information from the context information, and performs compliance judgment on the context information to obtain the model analysis results.

[0030] The model analysis results are correlated with the audit evidence text to obtain the evidence analysis results.

[0031] Secondly, this application also provides an audit data processing apparatus, comprising:

[0032] The acquisition module is used to acquire an audit template that matches the audit risk signal from the audit knowledge graph when an audit risk signal is detected, and to determine a corresponding list of evidence collection tasks based on the audit template.

[0033] The calling module is used to call the audit evidence text that matches the evidence collection task from the business system for each evidence collection task in the evidence collection task list.

[0034] The retrieval module is used to retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and to construct context information based on the audit knowledge and the audit evidence text;

[0035] The analysis module is used to input contextual information into the evidence analysis model to obtain corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the contextual information, key information, and compliance judgment.

[0036] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0038] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0039] The aforementioned audit data processing methods, devices, computer equipment, computer-readable storage media, and computer program products, upon detecting an audit risk signal, retrieve an audit template matching the audit risk signal from the audit knowledge graph, and determine a corresponding list of evidence collection tasks based on the audit template; for each evidence collection task in the list, retrieve audit evidence text matching the evidence collection task from the business system; retrieve audit knowledge matching the audit evidence text from the audit knowledge graph, and construct context information based on the audit knowledge and the audit evidence text; input the context information into the evidence analysis model to obtain the corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the context information, key information, and a compliance judgment. In this way, by automatically detecting audit risk signals and intelligently matching audit templates, a structured list of evidence collection tasks can be quickly generated. By automatically retrieving matching audit evidence texts from the business system for each task in the evidence collection task list, the time spent in the evidence collection stage is reduced. By retrieving matching audit knowledge from the audit knowledge graph to construct contextual information and inputting it into the evidence analysis model, analysis results including summaries, key information, and compliance judgments are obtained. This automates evidence preparation and analysis, not only improving the efficiency of evidence processing but also reducing the impact of human subjective bias on the audit process, thereby improving the overall efficiency and reliability of audit work. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is an application environment diagram of an audit data processing method in one embodiment;

[0042] Figure 2 This is a flowchart illustrating an audit data processing method in one embodiment;

[0043] Figure 3 This is a logic diagram of an intelligent mapping method from a risk type to an audit process template in one embodiment;

[0044] Figure 4 This is a logic diagram of a cross-system data autonomous acquisition method for an investigation and evidence collection agent in one embodiment;

[0045] Figure 5 This is a logic diagram of an evidence preprocessing and intelligent summary generation method in one embodiment;

[0046] Figure 6 This is a logic diagram of an audit data processing method in one embodiment;

[0047] Figure 7 This is a structural block diagram of an audit data processing device in one embodiment;

[0048] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0050] The audit data processing method provided in this application embodiment can be applied to, for example, Figure 1 The application environment shown includes a risk signal monitoring module, an AI workflow engine module, an audit knowledge graph, an investigation and evidence collection agent module, a unified identity authentication and authorization center, a secure API gateway, an evidence preprocessing module (with a built-in large language model), and an electronic document management module.

[0051] When the intelligent audit system detects an audit risk signal, it retrieves an audit template matching the signal from the audit knowledge graph and determines a corresponding list of evidence collection tasks based on the template. For each evidence collection task in the list, the intelligent audit system retrieves the audit evidence text matching the task from the business system. The intelligent audit system then retrieves audit knowledge matching the audit evidence text from the audit knowledge graph and constructs contextual information based on the audit knowledge and the audit evidence text. Finally, the intelligent audit system inputs the contextual information into the evidence analysis model to obtain the corresponding evidence analysis results. The evidence analysis results include at least one of the following: a summary of the contextual information, key information, and a compliance judgment.

[0052] The intelligent audit system of this application embodiment can continuously monitor internal and external multi-dimensional risk signal sources. When a risk signal that meets preset conditions is identified, an AI workflow is automatically triggered and instantiated, realizing intelligent risk signal perception and AI workflow triggering. The AI ​​workflow engine intelligently matches and loads the optimal audit process template from the audit knowledge graph based on the type of risk signal, key entities, and other information. This template predefines the audit objectives, investigation scope, dynamic evidence collection checklist, compliance points, and templates for documents required for project initiation, realizing intelligent mapping from risk type to audit process template. Based on the loaded template and specific information in the risk signal (such as involved personnel, business order number, time range, etc.), the system automatically fills in and generates a complete set of electronic project initiation documents and pushes them to relevant personnel for one-click approval. This system automates the initiation of audit projects. After approval, the AI ​​workflow deploys one or more "investigation and evidence collection agents." Each agent is granted a minimal, time-limited access token based on the audit task. Following the evidence collection checklist defined in the template, the agent autonomously and in parallel interacts with various business systems, achieving the deployment and autonomous execution of the investigation and evidence collection agent. The agent utilizes a "unified identity authentication and authorization center" and a "secure API gateway" to securely and compliantly make API calls with CRM, core business systems, and financial systems, automatically capturing and downloading all relevant evidence, achieving autonomous acquisition and integration of cross-system data. The agent then performs unified formatting processing on all collected evidence (structured data, text, audio, video, etc.). By utilizing a Large Language Model (LLM) based on Retrieval Enhanced Generation (RAG) technology, key information is extracted, content is summarized, and preliminary compliance assessments are made for unstructured evidence. Standardized tags are applied to all evidence, enabling preprocessing and intelligent summarization of evidence materials. All processed evidence, along with its metadata, summaries, and preliminary conclusions, are automatically organized, categorized, and structured into a structured electronic working document folder according to audit logic (e.g., by timeline, by evidence type, by related parties). This folder is then presented to auditors, achieving the generation of a structured electronic working document folder.

[0053] The audit data processing method of this application provides a solution that can automate the preliminary audit work, intelligently complete cross-system investigation and evidence collection, and preprocess massive amounts of evidence, so as to improve the overall efficiency, quality and depth of audit work.

[0054] In one exemplary embodiment, such as Figure 2 As shown, an audit data processing method is provided, which is applied to... Figure 1 Taking the intelligent auditing system in China as an example, this will be explained, including:

[0055] Step S202: If an audit risk signal is detected, obtain an audit template that matches the audit risk signal from the audit knowledge graph, and determine the corresponding evidence collection task list based on the audit template.

[0056] Audit risk signals include various types of information that can alert enterprises to potential audit risks, such as abnormal indicators generated by business systems (e.g., transactions exceeding limits, records of process violations), whistleblower information, external regulatory alerts, and public opinion feedback. The signal content can be expressed as structured data (e.g., numerical abnormal indicators) or unstructured data (e.g., text-based whistleblower content).

[0057] The audit knowledge graph can include a structured, semantic audit domain knowledge base, which stores various entities in the audit domain (such as "risk type", "business process", "control point", "regulatory provisions", "historical cases", "audit procedures" etc.) and the complex relationships between them (such as "belongs to", "causes", "violates", "applies to"). Each entity and relationship has machine-readable semantic tags and attributes.

[0058] An audit template can be one or more nodes or subgraphs predefined in an audit knowledge graph, used to encapsulate standardized audit response plans for a specific type of risk. For example, an audit template can be a parameterized workflow blueprint, whose core content includes clear audit objectives, a predefined scope of investigation, and a structured list of evidence collection tasks, that is, the audit objectives and evidence collection tasks are digitized and templated.

[0059] The evidence collection task list may include an ordered or executable set of tasks defined by the audit template. Each evidence collection task in the task list can indicate the type of evidence to be obtained, the business system identifier of the evidence source, and the evidence collection conditions.

[0060] In practical implementation, upon detecting an audit risk signal, the signal can be analyzed. If it is a structured signal (such as abnormal transaction data), its core features (such as transaction amount, involved business modules, and risk level labels) can be extracted. If it is an unstructured signal (such as a text report), key entities (such as the department involved and description of the violation) and semantic features (such as risk type tendency) are extracted using natural language processing technology. Subsequently, based on the analyzed signal features, a search can be performed in the audit knowledge graph to match audit templates associated with the signal features. Specifically, the similarity of the signal features with the attributes of each template in the knowledge graph (such as risk type matching degree and business domain overlap) can be calculated to select the template with the highest matching degree. Finally, the preset evidence collection dimensions and corresponding requirements are extracted from the matched audit templates, transformed into specific executable tasks, and organized into an evidence collection task list according to logical order (such as time order and business process order).

[0061] Step S204: For each evidence collection task in the evidence collection task list, retrieve the audit evidence text that matches the evidence collection task from the business system.

[0062] Among them, the evidence collection task is a single task unit in the evidence collection task list, which includes the core parameters required to complete the task, such as the target evidence type (e.g., contract text, transaction records, approval records, email correspondence, etc.), the business system identifier of the evidence source (e.g., financial system, contract management system), evidence screening conditions (e.g., time range, associated entity ID, business number, etc.), and evidence format requirements (e.g., PDF, Excel, text string, etc.).

[0063] Among them, business systems may include internal information systems used by enterprises to support various business operations. These systems store raw data or documents related to the business, including but not limited to financial systems, customer relationship management (CRM) systems, core business processing systems, office automation (OA) systems, mail servers, contract management systems, human resource management systems, etc. Each system usually has an independent data storage format and access interface.

[0064] The audit evidence text may include various data carriers that can be used as audit evidence obtained from the business system, including structured data (such as transaction record tables and numerical indicators in the database), semi-structured data (such as tagged approval process records), and unstructured data (such as OCR text of scanned contracts, email text, meeting minutes documents, audio transcription text, etc.). Its content must be consistent with the target evidence type of the evidence collection task.

[0065] In practice, for each evidence collection task in the task list, the core parameters of the task are first parsed, such as the type of target evidence, business system identifier, filtering conditions, and format requirements. Then, based on the business system identifier, the corresponding target business system is determined, and a connection is established with the business system through a pre-defined standardized interface (such as an API interface). During the connection process, system access permissions are automatically verified to ensure the security of data access. Next, the parsed filtering conditions are converted into query instructions (such as SQL query statements or system-defined search parameters) that the target business system can recognize, and this instruction is sent to the business system to request matching audit evidence text. Finally, the evidence collection tasks corresponding to the audit evidence text fields are associated and stored, establishing a task-evidence mapping relationship.

[0066] Step S206: Retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and construct contextual information based on the audit knowledge and the audit evidence text.

[0067] Audit knowledge may include structured knowledge retrieved from the audit knowledge graph that is relevant to the current evidence text, including but not limited to applicable audit regulations, corporate policy clauses, judgment criteria for similar historical audit cases, compliance standards corresponding to business scenarios, and rules for interpreting evidence.

[0068] The contextual information may include a comprehensive set of information formed by semantically associating the evidence text with the matching audit knowledge. This set includes both the original content of the evidence text and the background knowledge that supports the interpretation of the evidence, providing a complete semantic context and basis for judgment for subsequent evidence analysis.

[0069] For example, audit evidence text (such as the text transcribed from a phone recording) can be used as a query to perform vector similarity retrieval in the audit knowledge graph. The retrieval target is the most relevant legal provisions, internal operating procedures, and typical violation statements from historical cases to the current dialogue scenario. For instance, knowledge fragments such as "prohibition of misleading customers" and "template-based claims descriptions" can be retrieved as audit knowledge for domain audit evidence text matching. Then, the retrieved knowledge fragments are combined with the original text content to construct a richer context information.

[0070] Step S208: Input the context information into the evidence analysis model to obtain the corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the context information, key information, and compliance judgment.

[0071] The evidence analysis model may include an artificial intelligence model for automating the processing and analysis of contextual information.

[0072] As an example, an evidence analysis model can be a model built on natural language processing (NLP) technology, such as a pre-trained language model based on the Transformer architecture, which, after being fine-tuned with data from the auditing domain, has the ability to understand text, extract information, and make logical judgments, and can output pre-defined types of analysis results based on the input context information.

[0073] As another example, the evidence analysis model can be a large language model built on the retrieval-enhanced generation (RAG) technique.

[0074] The evidence analysis model processes the contextual information, generating the following output: evidence analysis results, including a summary, key information, and compliance judgment. The summary is a condensed representation of the core content of the contextual information, retaining key logical relationships. Key information includes core elements extracted from the contextual information (such as the parties involved, time, amount, violation points, applicable regulations, etc.). The compliance judgment is a conclusive assessment based on audit knowledge regarding whether the evidence text complies with regulations.

[0075] In the above audit data processing method, upon detecting an audit risk signal, an audit template matching the audit risk signal is obtained from the audit knowledge graph, and a corresponding list of evidence collection tasks is determined based on the audit template. For each evidence collection task in the list, audit evidence text matching the evidence collection task is retrieved from the business system. Audit knowledge matching the audit evidence text is retrieved from the audit knowledge graph, and contextual information is constructed based on the audit knowledge and the audit evidence text. The contextual information is input into the evidence analysis model to obtain the corresponding evidence analysis results. The evidence analysis results include at least one of the following: a summary of the contextual information, key information, and a compliance judgment. In this way, by automatically detecting audit risk signals and intelligently matching audit templates, a structured list of evidence collection tasks can be quickly generated. By automatically retrieving matching audit evidence texts from the business system for each task in the evidence collection task list, the time spent in the evidence collection stage is reduced. By retrieving matching audit knowledge from the audit knowledge graph to construct contextual information and inputting it into the evidence analysis model, analysis results including summaries, key information, and compliance judgments are obtained. This automates evidence preparation and analysis, not only improving the efficiency of evidence processing but also reducing the impact of human subjective bias on the audit process, thereby improving the overall efficiency and reliability of audit work.

[0076] In another embodiment, the audit knowledge graph includes multiple audit templates and template feature vectors corresponding to the audit templates; obtaining audit templates that match audit risk signals from the audit knowledge graph includes: converting risk text information indicated by the audit risk signals into risk feature vectors; for any audit template, determining a matching score for the audit template based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template; and filtering out audit templates that match the audit risk signals from the audit templates based on the matching scores of each audit template.

[0077] In one embodiment, the matching score of the audit template is determined based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template, including: determining the semantic similarity between the risk feature vector and the template feature vector corresponding to the audit template; determining the overlap between the entity types in the risk text information and the entity types in the audit template; and determining the matching score of the audit template based on the semantic similarity, overlap, and template weight of the audit template.

[0078] For the convenience of those skilled in the art, Figure 3 An exemplary logical diagram of a method for intelligently mapping risk types to audit process templates is provided.

[0079] In practice, after receiving audit risk signals, the AI ​​workflow engine of the intelligent audit system uses natural language processing technology (such as the BERT model) to transform textual information such as risk type and entity description into a high-dimensional feature vector, namely the risk feature vector V_risk. The audit knowledge graph stores a large number of audit template nodes, and each template node also has its corresponding feature vector pre-calculated, namely the template feature vector V_template.

[0080] Then, a similarity calculation can be performed to find the audit template that best matches the audit risk signal. Therefore, based on a preset mapping relationship, the similarity between the risk feature vector and the template feature vector corresponding to the audit template can be mapped to a matching score. This mapping relationship can be expressed as follows:

[0081] MatchScore=α*CosineSimilarity(V_risk,V_template)+β*EntityOverlapScore(E_risk, E_template) + γ * FeedbackWeight;

[0082] Among them, CosineSimilarity calculates the semantic similarity between the risk signal and the template, i.e., semantic similarity; EntityOverlapScore calculates the overlap between the entity type (such as employee, product) in the risk signal and the entity type applicable to the template; FeedbackWeight is the template weight, which is a feedback weight based on historical audit results. If the success rate of an audit project using a certain template is high, then the weight value is high; α, β, γ are configurable weight coefficients.

[0083] Then, the audit template with the highest Match Score can be selected as the audit template that matches the audit risk signal from the audit templates. This audit template can be a parameterized structure, such as:

[0084] {

[0085] "template_id": "TPL_FRAUD_02",

[0086] "audit_objective": "Verify whether there is organized insurance fraud..."

[0087] "evidence_checklist": [

[0088] {"system": "CRM", "api": "get_policies", "params": {"agent_id": "${agent_id}", "date_range": "${time_window}"}},

[0089] {"system": "CLAIMS", "api": "get_claim_docs", "params": {"policy_ids": "${policy_ids}"}},

[0090] {"system": "AUDIO", "api": "get_call_records", "params": {"agent_id": "${agent_id}"}}

[0091] ], ...

[0093] }

[0094] In one embodiment, determining the corresponding evidence collection task list based on the audit template includes: filling key information from the risk text information into placeholders in the audit template that match the audit risk signal to obtain the evidence collection tasks corresponding to the audit template; and constructing the evidence collection task list corresponding to the audit template based on the execution order and dependencies between the evidence collection tasks.

[0095] For example, the entity value ("A007", "2023-10-01 to 2023-10-30") from the risk text information indicated by the audit risk signal can be filled into the ${...} placeholder in the audit template to generate a specific and executable audit plan. Ultimately, a complete audit plan instance containing specific investigation steps, a parameterized evidence collection checklist, and document templates can be output for subsequent processes. This complete audit plan instance includes an evidence collection task list, which contains multiple evidence collection tasks. Optionally, this instantiated evidence collection task list can be a directed acyclic graph (DAG) that defines the execution order and dependencies of the tasks. For example, task 2 (obtaining claims documents) depends on the output of task 1 (obtaining the policy number).

[0096] In another embodiment, retrieving audit evidence text matching the forensic task from the business system includes: initiating a corresponding client credential authorization request to the authorization center for the forensic task; the client credential authorization request includes an identity identifier and access permission scope; receiving a security token returned by the authorization center after verifying the client credential authorization request; generating a corresponding API call request based on the security token; and sending an API call request for the business system to the API gateway; receiving business data matching the forensic task retrieved from the business system returned by the API gateway; and extracting the audit evidence text indicating the forensic task from the business data.

[0097] For the convenience of those skilled in the art, Figure 4 An exemplary logical diagram of a cross-system data autonomous acquisition method for an investigation and evidence collection agent is provided.

[0098] In practice, the agent in the intelligent audit system receives an instantiated list of evidence collection tasks from the workflow engine. This is a directed acyclic graph (DAG) that defines the execution order and dependencies of the tasks. For example, task 2 (obtaining claims documents) depends on the output of task 1 (obtaining the policy number).

[0099] For each forensic task, the Agent sends a Client Credentials authorization request to the authorization center. The request includes its own identity and the scope of permissions to be accessed, such as scope=crm:read_policy claims:read_doc.

[0100] The authorization center verifies the legitimacy of the Agent and, based on the authorization policy of this audit project, generates a JSON WebToken (JWT), i.e., a security token, which contains specific permissions, user identity (a virtual "audit robot" identity), and a short validity period (such as 15 minutes).

[0101] The Agent places the JWT in the Authorization header of the HTTP request and initiates an API call request to the target business system to the API gateway.

[0102] The API gateway first verifies and decodes the JWT, checking its validity and scope of permissions (claims). Only after successful verification is the API call request routed to the actual backend business system microservice. All call actions are recorded in an immutable audit log.

[0103] After receiving the business data returned by the API, the Agent securely stores it temporarily in an encrypted storage area. Then, it parses this business data, extracts the parameters required for the evidence collection task, namely the audit evidence text indicated by the evidence collection task. For example, it extracts policy_ids from the policy data and uses this as input to start executing tasks that depend on it. Then, it repeats the above process until the audit evidence text indicated by each evidence collection task is obtained.

[0104] After all evidence collection tasks are completed, the Agent will package all the collected audit evidence texts, along with metadata describing the data source, acquisition time, API endpoint, and other information, and submit them to the evidence preprocessing module.

[0105] In another embodiment, the evidence analysis model includes a large language model; inputting contextual information into the large language model to obtain evidence analysis results includes: filling the contextual information into a prompt template to obtain a filled template; inputting the filled template into the large language model, and using the large language model to generate a summary of the contextual information, extract key information from the contextual information, and perform compliance judgment on the contextual information to obtain model analysis results; and associating the model analysis results with the audit evidence text to obtain evidence analysis results.

[0106] For the convenience of those skilled in the art, Figure 5An exemplary logic diagram of an evidence preprocessing and intelligent summary generation method is provided.

[0107] In practice, after receiving audit evidence text, the evidence preprocessing module of the intelligent audit system can automatically identify its type. For example, if it is a PDF / Image (scanned document), it calls the OCR service to extract it into structured text; if it is an MP3 / WAV (recording), it calls the ASR service to generate dialogue text with timestamps and speaker identifiers; if it is an EML / MSG (email), it parses the email header and body; and if it is JSON / CSV (structured data), it parses it directly.

[0108] Then, intelligent analysis based on Retrieval Augmentation Generation (RAG) and Large Language Model (LLM) can be performed. For the extracted audit evidence text, a RAG process can be executed instead of simple prompting, including: Retrieval: First, the text content of the audit evidence text (such as the text transcribed from a call recording) is used as a query to perform vector similarity retrieval in the audit knowledge graph. The retrieval target is the most relevant legal provisions, internal operating procedures, and typical violations in historical cases. For example, knowledge fragments such as "prohibition of inducing customers" and "template-based claims descriptions" are retrieved; Augmentation: The retrieved knowledge fragments are combined with the original text content to construct a richer context, that is, contextual information is constructed based on audit knowledge and audit evidence text; Generation: The augmented context is injected into a carefully designed prompt template to obtain the filled template, which is then sent to the Large Language Model (LLM) for multi-task processing.

[0109] For example, the prompt template may include:

[0110] # CONTEXT

[0111] ## Original dialogue:

[0112] ${Original Dialogue Text}

[0113] ## Relevant Compliance Knowledge:

[0114] - Agents are prohibited from inducing clients to fabricate causes of accidents.

[0115] - Accident descriptions in multiple claims should not be highly similar.

[0116] # INSTRUCTIONS

[0117] You are a senior financial audit expert. Based on the above CONTEXT, please complete the following tasks and output the results in JSON format:

[0118] 1. summary: Generates a dialogue summary of no more than 200 words.

[0119] 2. entities: Extract all key entities (name, policy number, amount, date).

[0120] 3. `compliance_check`: Assess whether the conversation is suspected of violating regulations. Fields include `suspicion` (boolean), `reason` (string, detailed reason), and `evidence_quote` (string, original quote).

[0121] In its implementation, the intelligent audit system parses the JSON output returned by the LLM (Model Analysis Module), representing the model analysis results. It then combines this output with the original audit evidence text, packaging them into a unified intelligent evidence object, which serves as the evidence analysis result. This intelligent evidence object is then stored in the corresponding folder of the intelligent audit system's electronic working paper management module. The system automatically builds a full-text index and knowledge graph links based on its content (such as summaries, entities, and compliance judgment results), facilitating full-text retrieval, correlation analysis, and drill-down by auditors.

[0122] For the convenience of those skilled in the art, Figure 6 An example is provided: a logic diagram of an audit data processing method.

[0123] The intelligent audit project initiation and investigation method of this application realizes the automation and immediacy of audit initiation, compressing the audit project establishment and preparation work of several days to several weeks into several hours, and realizing rapid response to risks; it achieves comprehensive, efficient, objective and neutral evidence collection. The automated execution of the agent ensures the comprehensiveness of the evidence scope, avoids omissions and selective biases in manual operation, and significantly improves the integrity and objectivity of the evidence chain; it helps auditors focus on core value judgments. Through automated data collection and intelligent preprocessing, auditors are freed from heavy transactional work and can directly conduct in-depth analysis, reasoning and judgment based on the high-quality evidence package organized by the system; it improves compliance and security. Through a unified authorization center and API gateway, it ensures full traceability of data access and controllable permissions, meeting data security and compliance requirements. The UI-less operation mode of the agent also reduces the risk of data leakage; through audit knowledge graph and feedback mechanism, the system can learn from each audit practice, continuously optimize the matching accuracy of templates and evidence collection strategies, and achieve continuous evolution.

[0124] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0125] Based on the same inventive concept, this application also provides an audit data processing apparatus for implementing the audit data processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more audit data processing apparatus embodiments provided below can be found in the limitations of the audit data processing method described above, and will not be repeated here.

[0126] In one exemplary embodiment, such as Figure 7 As shown, an audit data processing apparatus is provided, comprising:

[0127] The acquisition module 710 is used to acquire an audit template that matches the audit risk signal from the audit knowledge graph when an audit risk signal is detected, and to determine a corresponding list of evidence collection tasks based on the audit template.

[0128] The calling module 720 is used to call the audit evidence text that matches the evidence collection task from the business system for each evidence collection task in the evidence collection task list.

[0129] The retrieval module 730 is used to retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and construct context information based on the audit knowledge and the audit evidence text.

[0130] The analysis module 740 is used to input contextual information into the evidence analysis model to obtain corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the contextual information, key information, and compliance judgment.

[0131] In one embodiment, the audit knowledge graph includes multiple audit templates and template feature vectors corresponding to the audit templates; the acquisition module 710 is specifically used to convert the risk text information indicated by the audit risk signal into a risk feature vector; for any audit template, a matching score of the audit template is determined based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template; and based on the matching score of each audit template, audit templates that match the audit risk signal are selected from the audit templates.

[0132] In one embodiment, the acquisition module 710 is specifically used to determine the semantic similarity between the risk feature vector and the template feature vector corresponding to the audit template; determine the overlap between the entity type in the risk text information and the entity type in the audit template; and determine the matching score of the audit template based on the semantic similarity, the overlap, and the template weight of the audit template.

[0133] In one embodiment, the acquisition module 710 is specifically used to fill the key information in the risk text information into the placeholder of the audit template that matches the audit risk signal, so as to obtain the evidence collection task corresponding to the audit template; and to construct the evidence collection task list corresponding to the audit template according to the execution order and dependency relationship between the evidence collection tasks.

[0134] In one embodiment, the calling module 720 is specifically configured to initiate a corresponding client credential authorization request to the authorization center for the forensic task; the client credential authorization request includes an identity identifier and access permission scope; receive a security token returned by the authorization center after verifying the client credential authorization request; generate a corresponding API call request based on the security token; and send an API call request for the business system to the API gateway; receive business data from the business system that matches the forensic task returned by the API gateway; and extract the audit evidence text indicated by the forensic task from the business data.

[0135] In one embodiment, the evidence analysis model includes a large language model; the analysis module 740 is specifically used to fill the context information into a prompt template to obtain a filled template; input the filled template into the large language model, and through the large language model, generate a summary of the context information, extract key information from the context information, and perform compliance judgment on the context information to obtain a model analysis result; associate the model analysis result with the audit evidence text to obtain the evidence analysis result.

[0136] Each module in the aforementioned audit data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0137] In one exemplary embodiment, a computer device is provided, which may include an intelligent auditing system, the internal structure of which may be as shown in the figure below. Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores audit data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an audit data processing method.

[0138] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0139] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0140] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0141] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0142] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0143] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0144] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0145] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An audit data processing method, characterized in that, The method includes: Upon detecting an audit risk signal, an audit template matching the audit risk signal is obtained from the audit knowledge graph, and a corresponding list of evidence collection tasks is determined based on the audit template. For each evidence collection task in the evidence collection task list, retrieve the audit evidence text that matches the evidence collection task from the business system; Retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and construct context information based on the audit knowledge and the audit evidence text; Contextual information is input into the evidence analysis model to obtain corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the contextual information, key information, and compliance judgment.

2. The method according to claim 1, characterized in that, The audit knowledge graph includes multiple audit templates and template feature vectors corresponding to the audit templates; The step of obtaining an audit template that matches the audit risk signal from the audit knowledge graph includes: Convert the risk text information indicated by the audit risk signal into a risk feature vector; For any of the audit templates, the matching score of the audit template is determined based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template. Based on the matching score of each audit template, audit templates that match the audit risk signal are selected from the audit templates.

3. The method according to claim 2, characterized in that, The step of determining the matching score of the audit template based on the similarity between the risk feature vector and the template feature vector corresponding to the audit template includes: Determine the semantic similarity between the risk feature vector and the template feature vector corresponding to the audit template; Determine the degree of overlap between the entity types in the risk text information and the entity types in the audit template; The matching score of the audit template is determined based on the semantic similarity, the overlap, and the template weight of the audit template.

4. The method according to claim 2, characterized in that, The step of determining the corresponding evidence collection task list based on the audit template includes: The key information in the risk text information is filled into the placeholders of the audit template that matches the audit risk signal to obtain the evidence collection task corresponding to the audit template; Based on the execution order and dependencies between the various evidence collection tasks, construct a list of evidence collection tasks corresponding to the audit template.

5. The method according to claim 1, characterized in that, The step of retrieving audit evidence text matching the evidence collection task from the business system includes: For the aforementioned evidence collection task, a corresponding client credential authorization request is initiated to the authorization center; the client credential authorization request includes an identity identifier and access permission scope; Receive the security token returned by the authorization center after verifying the client's credential authorization request; Based on the security token, generate the corresponding API call request, and send the API call request for the business system to the API gateway; Receive business data returned by the API gateway that matches the evidence collection task and is invoked from the business system; Extract the audit evidence text of the evidence collection task instruction from the business data.

6. The method according to claim 1, characterized in that, The evidence analysis model includes a large language model; the step of inputting contextual information into the large language model to obtain the evidence analysis results includes: The context information is then filled into the prompt template to obtain the filled template. The filled template is input into the large language model, which generates a summary of the context information based on the filled template, extracts key information from the context information, and performs compliance judgment on the context information to obtain the model analysis results. The model analysis results are correlated with the audit evidence text to obtain the evidence analysis results.

7. An audit data processing device, characterized in that, The device includes: The acquisition module is used to acquire an audit template that matches the audit risk signal from the audit knowledge graph when an audit risk signal is detected, and to determine a corresponding list of evidence collection tasks based on the audit template. The calling module is used to call the audit evidence text that matches the evidence collection task from the business system for each evidence collection task in the evidence collection task list. The retrieval module is used to retrieve audit knowledge that matches the audit evidence text from the audit knowledge graph, and to construct context information based on the audit knowledge and the audit evidence text; The analysis module is used to input contextual information into the evidence analysis model to obtain corresponding evidence analysis results; the evidence analysis results include at least one of the following: a summary of the contextual information, key information, and compliance judgment.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images