Intelligent enterprise internal control management method and system based on workflow

Abstract

The invention relates to the technical field of enterprise internal control management, and particularly discloses an intelligent enterprise internal control management method and system based on workflow, and the method comprises the steps: firstly processing a purchase order file, extracting business information, approval information and supplier information from the purchase order file, and generating an authorization certificate associated with the purchase order file; when compliance examination is carried out, the system obtains an authorization certificate associated with a to-be-examined purchase order file, and screens out a set of compliance examination rules matched with the authorization certificate from a preset compliance rule base according to the authorization certificate. And finally, evaluating the purchase order file according to the screened compliance auditing rule and outputting a result. In the scheme, the authorization voucher is used as a carrier containing specific business situation information, so that the system can identify and distinguish different situations such as general purchasing and special purchasing, and the situation that legally authorized exceptional operations are misjudged as illegal behaviors can be avoided.

Description

Technical Field

[0001] This application relates to the field of enterprise internal control management technology, and more specifically, to an intelligent enterprise internal control management method and system based on workflow. Background Technology

[0002] In modern large-scale manufacturing enterprises, workflow-based intelligent internal control management systems have been widely adopted to improve operational efficiency and compliance. However, in practical applications, especially in specific business scenarios involving cutting-edge technology research and development that require "special approval procurement," enterprises often need to procure non-standard, experimental specialty materials or customized components. These materials and their suppliers may not be on the enterprise's regular list of qualified suppliers, but to avoid hindering the agility of research and development, enterprises typically establish "special approval procurement" processes, allowing the legal bypassing of certain regular control points after obtaining high-level authorization.

[0003] However, such "special case" authorization exceptions are often misjudged as "violations" by systems based on stricter rule sets in downstream auditing and compliance monitoring, resulting in a large number of invalid alerts. For example, when the audit module scans according to the core rule that "all purchase orders must be from suppliers listed in the 'Qualified Suppliers Directory'", it will mark the authorized special purchase as "high risk - serious violation" and generate an alert.

[0004] This conflict between different internal business logics forces managers to invest additional manual labor in tracing, explaining, and verifying these "irregular" transactions to justify their legitimacy. This not only reduces management efficiency but also disrupts the closed loop of internal control. The system's inability to automatically understand and handle these "authorized exceptions" significantly diminishes its intelligence, leading to new and more complex communication costs and manual verification work.

[0005] There is currently no effective technical solution to the above problems. Summary of the Invention

[0006] This application aims to address the technical problems mentioned in the background section by providing a workflow-based intelligent enterprise internal control management method and system, which aims to resolve the conflict between authorized exceptions such as special R&D procurement and strict audit rules in the prior art.

[0007] To address the aforementioned problems, the solution proposed in this application is as follows: As one aspect of this application, a workflow-based intelligent enterprise internal control management method is provided for compliance checks on enterprise purchase orders, including: Process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files, generate corresponding authorization vouchers, and associate the generated authorization vouchers with the corresponding purchase order files; When conducting a compliance review of purchase order documents already entered in the company's internal purchase order database, obtain the authorization credentials associated with the purchase order document to be reviewed; Based on the authorization documents of the purchase order documents to be inspected, a set of compliance audit rules matching the corresponding authorization documents is selected from the preset compliance rule base; The corresponding purchase order documents to be inspected are evaluated based on the selected compliance audit rules, and the evaluation results are output.

[0008] Furthermore, the preset compliance rule base includes a first rule base for compliance review of purchase order documents under general circumstances and a second rule base for compliance review of purchase order documents under exceptional circumstances. The distinction between general and exceptional circumstances lies in the purchase type and the reviewer.

[0009] Furthermore, the steps of processing the purchase order files entered into the enterprise's internal purchase order database, reading business information, approval information, and supplier information from the purchase order files, generating corresponding authorization certificates, and associating the generated authorization certificates with the corresponding purchase order files specifically include: Extract primary data, including project number, material description, and purchase type, from the business information in the read purchase order file; Extract secondary data, including the identity information of the approvers at the set levels and the approval time, from the approval information in the obtained purchase order documents; Extract third-party data, including supplier name, supplier legal representative, and supplier unified social credit code, from the supplier information in the obtained purchase order documents; The extracted first, second, and third data are combined to form a standardized data structure, which serves as an authorization credential associated with the purchase order document.

[0010] Furthermore, the authorization certificate also includes the following processing: Generate a validity period for the authorization document associated with the purchase order document; and A digital signature of the authorization document associated with the purchase order file is generated using a symmetric encryption algorithm.

[0011] Furthermore, the step of selecting a set of compliance audit rules matching the corresponding authorization document from a preset compliance rule base based on the authorization document of the purchase order document to be inspected specifically includes: Verify the validity of the authorization documents in the purchase order documents to be inspected; When the authorization certificate is valid, extract the business context information, including the purchase type and approver, from the authorization certificate, and select and apply a set of compliance audit rules that match the business context information.

[0012] Furthermore, the step of verifying the validity of the authorization documents in the purchase order documents to be inspected specifically includes: The authorization certificate in the purchase order document to be inspected is decrypted, and the original data, digital signature and validity information of the purchase order document associated with the authorization certificate are read. The hash value obtained from decrypting the digital signature and the hash value calculated using an asymmetric encryption algorithm from the original data in the purchase order document are compared for consistency. If the hash values ​​match, the authorization certificate is considered valid. The current date is also obtained and recorded. If the validity period information of the decrypted authorization certificate does not cover the current date, the authorization certificate is considered valid.

[0013] Furthermore, the step of extracting business context information, including the purchase type and approver, from the authorization certificate, and selecting and applying a set of compliance review rules that match the business context information, specifically includes: After obtaining the business context information contained in the authorization credential, the business context information is parsed to identify the hierarchical relationships and combined scenarios existing in the business context information; Based on the identified hierarchical relationships and combined contexts, a rule-based decision path is constructed; Based on the rule-based decision path, select and apply a set of compliance rules that match the business context information.

[0014] Furthermore, the step of parsing the business context information to identify the hierarchical relationships and combined scenarios existing in the business context information includes: Receive the business context information contained in the authorization credential; The business context information is decomposed in a structured manner to identify independent context elements within the business context information; The independent context elements are prioritized using a preset business priority matrix; A hierarchical business context structure is constructed based on the independent context elements after priority ranking, in order to identify the hierarchical relationships and combined contexts existing in the business context information.

[0015] Furthermore, the construction of a hierarchical business context structure based on the independent context elements after priority ranking, in order to identify the hierarchical relationships and combined contexts existing in the business context information, specifically includes: Perform domain semantic interpretation and risk meaning assessment on independent contextual elements to generate interpretation results with domain labels; Based on the preset cross-domain priority matrix and conflict resolution rules, the system adjudicates contextual elements that have the same semantics but different domain interpretations, so as to output a unified semantic interpretation. Based on the adjudicated context elements and their unified semantics and priorities, a hierarchical business context structure is constructed to identify the hierarchical relationships and combined contexts existing in the business context information.

[0016] As a second aspect of this application, a workflow-based intelligent enterprise internal control management system includes: The authorization certificate generation module is used to process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files and process them to generate corresponding authorization certificates, and associate the generated authorization certificates with the corresponding purchase order files; The authorization credential acquisition module is used to acquire the authorization credential associated with the purchase order file to be reviewed when conducting a compliance review of the purchase order file already entered in the enterprise's internal purchase order database. The rule filtering module is used to filter a set of compliance audit rules that match the corresponding authorization documents from a preset compliance rule library based on the authorization documents of the purchase order documents to be inspected. The compliance assessment module is used to assess the corresponding purchase order documents to be inspected based on the selected compliance audit rules and output the assessment results.

[0017] This application presents a workflow-based intelligent enterprise internal control management method and system. By introducing an authorization credential mechanism, it effectively addresses the misjudgment problem caused by rigid rules in existing internal control management systems when handling authorized exceptions such as "specially approved purchases." Specifically, the system first processes the purchase order document, extracting business information, approval information, and supplier information, and generating an authorization credential associated with the purchase order document. During compliance review, the system retrieves the authorization credential associated with the purchase order document to be reviewed and, based on this credential, selects a set of compliance review rules from a pre-set compliance rule library that match the authorization credential. Finally, the system evaluates the purchase order document based on the selected compliance review rules and outputs the results. In this solution, the authorization credential, as a carrier of specific business context information, enables the system to identify and distinguish between different scenarios such as general purchases and specially approved purchases, thereby avoiding misjudging legitimate authorized exceptions as violations. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a workflow-based intelligent enterprise internal control management method provided in this application embodiment; Figure 2 A system architecture block diagram of a workflow-based intelligent enterprise internal control management system provided in this application embodiment; Attached reference numerals: 100, Intelligent Enterprise Internal Control Management System; 101, Authorization Certificate Generation Module; 102, Authorization Certificate Acquisition Module; 103, Rule Filtering Module; 104, Compliance Assessment Module. Detailed Implementation

[0019] To better illustrate the present invention, the invention will now be described in further detail with reference to the accompanying drawings.

[0020] It should be understood that, in order to make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0021] Existing workflow-based intelligent internal control management methods or systems often misjudge authorized exceptions as violations when handling compliance checks of enterprise purchase orders, especially in exceptional situations such as "specially approved purchases," resulting in a large number of invalid alerts. This internal business logic conflict forces managers to invest additional manual labor in tracing, interpreting, and verifying, which not only reduces management efficiency but also breaks the closed loop of internal control management. The system cannot automatically understand and process "authorized exceptions," significantly reducing its level of intelligence and leading to more complex communication costs and manual verification work.

[0022] Therefore, the actual technical problem addressed by this application is how to avoid the conflict between authorized exceptions such as special R&D procurement and strict audit rules.

[0023] The following description uses at least one specific embodiment as an example. In this embodiment: Firstly, such as Figure 1 As shown, a workflow-based intelligent enterprise internal control management method is used to perform compliance checks on enterprise purchase orders, including: Step S1: Process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files, generate corresponding authorization vouchers, and associate the generated authorization vouchers with the corresponding purchase order files; Step S2: When conducting a compliance review of the purchase order documents already entered in the enterprise's internal purchase order database, obtain the authorization credentials associated with the purchase order documents to be reviewed; Step S3: Based on the authorization certificate of the purchase order document to be inspected, select a set of compliance audit rules that match the corresponding authorization certificate from the preset compliance rule library; Step S4: Evaluate the corresponding purchase order documents to be inspected according to the selected compliance audit rules, and output the evaluation results.

[0024] The workflow-based intelligent enterprise internal control management method proposed in this embodiment aims to optimize the compliance check process for enterprise purchase orders.

[0025] "Purchase order documents" refer to various electronic documents generated and stored in the purchase order database during the procurement process, containing detailed procurement information. "Business information" typically covers the specific details of the procurement project, such as project number, material description, and procurement type. "Approval information" records the approval process and results of the purchase order, including the identity of the approver, approval level, and approval time. "Supplier information" refers to detailed information about suppliers related to the procurement, such as supplier name, legal representative, and unified social credit code. "Authorization certificate" is one of the core concepts of this application; it is a processed and associated data structure used to prove the compliance or special authorization of a specific purchase order. "Compliance rule base" is a pre-set set of rules containing various compliance audit standards required for enterprise internal control management. "Compliance audit rules" are evaluation standards selected from the compliance rule base and applicable to specific purchase orders.

[0026] The intelligent enterprise internal control management method of this application achieves compliance checks on enterprise purchase orders through the following process: First, the purchase order files entered into the company's internal purchase order database are processed. Business information, approval information, and supplier information are read from these files, and corresponding authorization credentials are generated. These authorization credentials are then associated with the corresponding purchase order files. In practice, purchase order files can exist in various formats, such as PDF, XML, or structured database records. Different parsers can be used to read the business information, approval information, and supplier information from these files. Further processing, such as data cleaning and standardized formatting, is then applied to create a standardized data structure that serves as the authorization credential. This authorization credential is then associated with the original purchase order file. This association can be achieved by including a unique identifier for the purchase order file in the authorization credential or by adding a field to the purchase order database to store a reference to the authorization credential.

[0027] Secondly, when conducting compliance reviews of purchase order documents already entered in the company's internal purchase order database, the system retrieves the authorization credential associated with the purchase order document to be reviewed. When a compliance review of a specific purchase order document is required, the system first identifies the document. Then, based on a pre-defined association mechanism, the system retrieves the unique authorization credential associated with that purchase order document from the purchase order database or a dedicated authorization credential storage area. For example, the system can look up the corresponding authorization credential record in the authorization credential table based on the purchase order document's ID.

[0028] Next, based on the authorization certificate of the purchase order document to be inspected, a set of compliance audit rules matching the corresponding authorization certificate is selected from the preset compliance rule base. After obtaining the authorization certificate, the system will parse the key information contained in the authorization certificate, such as purchase type, approval level, and special authorization identifier. This information will be used as filtering conditions to select the most suitable compliance audit rules for the current purchase order from the preset compliance rule base. For example, if the authorization certificate indicates that this is a "specially approved purchase" order, the system will prioritize filtering the rule set applicable to special approved purchases rather than regular purchase rules. The compliance rule base is a database that contains compliance rules and their matching conditions for different scenarios.

[0029] Finally, the system evaluates the corresponding purchase order documents to be inspected based on the selected compliance audit rules and outputs the evaluation results. Once matching compliance audit rules are selected, the system will use these rules to evaluate the purchase order documents. The evaluation process may include checking whether the supplier is on the qualified list, whether the purchase amount exceeds the authority, and whether the approval process is complete, etc.

[0030] The workflow-based intelligent enterprise internal control management method proposed in this application is based on the principle of introducing the core mechanism of "authorization certificate" to realize intelligent and refined management of compliance checks on enterprise purchase orders. In particular, it can effectively avoid the misjudgment problem of traditional systems when dealing with the "authorized exception" scenario.

[0031] Specifically, when a purchase order document is entered into the company's internal purchase order database, the system proactively processes it, extracting key business information, approval information, and supplier information. This standardized information is then used to generate a unique "authorization certificate." This certificate not only contains the core data of the purchase order but may also include special authorization identifiers, such as approval information for "specially approved purchases." The generated authorization certificate is then closely linked to the original purchase order document, ensuring that each purchase order has its corresponding, authenticated "identity." When a compliance review of an entered purchase order document is required, the system first retrieves the authorization certificate associated with that document. The system then parses the information in the certificate, such as the purchase type, approval level, and whether special authorization exists. Based on this, a set of compliance review rules precisely matching the authorization certificate is selected from a pre-set compliance rule library. For an authorized "specially approved purchase" order, the system will no longer apply strict regular purchase rules but instead apply a set of compliance rules specifically designed for specially approved purchases, ensuring that compliance checks fully consider the actual business context and authorization status of the purchase order. Finally, the system evaluates the corresponding purchase order documents to be inspected based on the selected compliance audit rules and outputs the evaluation results.

[0032] Based on the above implementation method, a set of compliance review rules matching the corresponding authorization certificate is selected from the preset compliance rule base according to the authorization certificate of the purchase order document to be inspected. However, in actual enterprise internal control management, the compliance review of purchase orders often faces complex and ever-changing business scenarios, such as different purchase types and different approval personnel permissions. If the compliance rule base lacks refined classification and management, it may lead to low rule screening efficiency, or even rule misuse or omission, affecting the accuracy and efficiency of compliance assessment.

[0033] In response, this application further proposes to optimize the structure of the compliance rule base, namely, the preset compliance rule base includes a first rule base for compliance review of purchase order documents under general circumstances and a second rule base for compliance review of purchase order documents under exceptional circumstances. The distinction between general and exceptional circumstances lies in the purchase type and the reviewer.

[0034] Specifically, the pre-defined compliance rule base is designed with a hierarchical or categorized structure to improve the granularity and applicability of rule management. The first rule base is specifically used to store and manage compliance review rules for the company's daily, standardized procurement processes and orders. These rules are generally applicable to most procurement scenarios and have high universality. For example, for routine office supply procurement and low-value material procurement, rules in the first rule base can be used for quick and automated review. The second rule base is used to handle procurement order documents that deviate from the routine process or have special risks, i.e., exception scenarios. Exception scenarios may include, but are not limited to, large-value procurement, special material procurement, emergency procurement, procurement involving specific suppliers, or procurement conducted by reviewers at specific levels or departments. The rules in the second rule base are usually more stringent and detailed, or require manual review.

[0035] The distinction between general and exceptional scenarios lies in the procurement type and the reviewer. Specifically, the procurement type refers to the category of goods or services procured, such as raw material procurement, equipment procurement, service procurement, and engineering procurement. Different procurement types may correspond to different compliance requirements and risk levels. The reviewer refers to the identity, level, or department of the person responsible for approving the procurement order, such as the Chief Technology Officer, Chief Financial Officer, or legal department representative. Reviewers with different permissions may trigger different compliance review paths or rule sets. By identifying and judging these two key dimensions—procurement type and reviewer—the system can intelligently categorize the procurement order documents to be reviewed into general or exceptional scenarios, thereby selecting and applying the corresponding rule base for review.

[0036] By dividing the pre-defined compliance rule base into a first rule base and a second rule base, and using procurement type and reviewer as criteria to distinguish between general and exceptional scenarios, the selection and application of compliance rules become more precise and efficient. When the system obtains the authorization certificate for a procurement order document to be reviewed, it first parses the procurement type and reviewer information contained in the certificate. Based on this information, it can determine whether the procurement order document falls under a general or exceptional scenario. If it is determined to be a general scenario, matching compliance review rules are preferentially selected from the first rule base; if it is determined to be an exceptional scenario, more stringent or specific compliance review rules are selected from the second rule base. This partitioned management and scenario-based rule selection mechanism avoids the drawback of applying a single set of universal rules in all scenarios.

[0037] Based on the above implementation method, a method is proposed to process purchase order files entered into the enterprise's internal purchase order database, read business information, approval information, and supplier information from the purchase order files, generate corresponding authorization certificates, and associate the generated authorization certificates with the corresponding purchase order files. Specifically, the steps of processing purchase order files entered into the enterprise's internal purchase order database, reading business information, approval information, and supplier information from the purchase order files, generating corresponding authorization certificates, and associating the generated authorization certificates with the corresponding purchase order files can be further refined as follows.

[0038] The steps of processing purchase order files entered into the enterprise's internal purchase order database, reading business information, approval information, and supplier information from the purchase order files, generating corresponding authorization certificates, and associating the generated authorization certificates with the corresponding purchase order files specifically include: Extract primary data, including project number, material description, and purchase type, from the business information in the read purchase order file; Extract secondary data, including the identity information of the approvers at the set levels and the approval time, from the approval information in the obtained purchase order documents; Extract third-party data, including supplier name, supplier legal representative, and supplier unified social credit code, from the supplier information in the obtained purchase order documents; The extracted first, second, and third data are combined to form a standardized data structure, which serves as an authorization credential associated with the purchase order document.

[0039] Specifically, the first data refers to the key business elements extracted from the business information of the purchase order documents, including the project number, material description, and purchase type. The project number uniquely identifies a purchase project; the material description provides detailed information about the purchased materials; and the purchase type categorizes the purchase activity, such as whether it is a routine purchase, an urgent purchase, or a special purchase. The second data refers to the approval process-related elements extracted from the approval information of the purchase order documents, including the identity information of the approvers at each level and the approval time. The identity information of the approvers at each level identifies the specific personnel responsible for approving the purchase order and their position in the approval chain; the approval time records the exact time the approval action occurred. The third data refers to the supplier identification elements extracted from the supplier information of the purchase order documents, including the supplier name, the supplier's legal representative, and the supplier's unified social credit code. The supplier name identifies the supplier; the supplier's legal representative confirms the supplier's legal entity; and the supplier's unified social credit code is the supplier's unique legal identifier.

[0040] Furthermore, the extracted first, second, and third data are combined to form a standardized data structure. The purpose is to ensure that authorization documents for different purchase orders have a unified format and content standard, thereby facilitating subsequent automated processing, storage, and comparison. This standardized data structure can adopt, for example, JSON (JavaScript Object Notation), XML (Extensible Markup Language), or other predefined data formats to ensure data readability, parsability, and interoperability. Thus, this standardized data structure, as the authorization document associated with the purchase order document, provides a data foundation for subsequent compliance reviews.

[0041] By structuring purchase order documents, primary, secondary, and tertiary data are extracted from their business information, approval information, and supplier information. These data are core elements for procurement compliance review. Combining these key data points into a standardized data structure ensures that all core information related to purchase orders is captured completely and accurately, and stored in a uniform format. This standardized processing method enables subsequent compliance audit systems to efficiently parse and utilize these authorization credentials, avoiding review difficulties or errors caused by inconsistent data formats or missing information, thus laying a solid foundation for subsequent compliance assessments.

[0042] Based on the above implementation method, although it is proposed to combine the extracted first data, second data and third data into a standardized data structure as an authorization certificate associated with the purchase order document, in practical applications, this authorization certificate may face the problem of being tampered with or still being used after it expires, thereby affecting the accuracy and reliability of compliance review.

[0043] In this regard, the authorization certificate also includes the following processing: Generate an expiry date for the authorization document associated with the purchase order document; and generate a digital signature for the authorization document associated with the purchase order document using a symmetric encryption algorithm.

[0044] Specifically, setting a validity period for an authorization certificate involves setting a start and end date for the certificate to limit its validity to a specific time period. For example, the validity period could be set to one year from the date of generation, or it could be matched with the execution cycle of a purchase order. The purpose is to ensure the timeliness of the authorization certificate and prevent the misuse of expired certificates.

[0045] Using an asymmetric encryption algorithm to calculate the hash value of the authorization credential and derive a digital signature from that hash value can be understood as performing integrity verification and identity authentication on the authorization credential. Specifically, first, the entire content of the authorization credential is hashed to generate a fixed-length hash value. Then, this hash value is encrypted using a private key to generate a digital signature. This digital signature is stored or transmitted along with the authorization credential. Its purpose is to ensure that the authorization credential is not tampered with during transmission and storage, and to verify the authenticity of its origin.

[0046] By generating an expiration date for authorization credentials, these credentials automatically expire after a preset timeframe, effectively preventing compliance risks arising from the continued use of expired credentials. Simultaneously, by using an asymmetric encryption algorithm to calculate the hash value of the authorization credential and generate a digital signature, any tampering with the content of the authorization credential will change its hash value, causing digital signature verification to fail. It is precisely the existence of the digital signature that effectively guarantees the integrity and authenticity of the authorization credential, ensuring that the authorization credential used in subsequent compliance reviews is reliable and tamper-proof.

[0047] In some preferred embodiments, when an enterprise's internal system generates a new purchase order document, the system generates a corresponding authorization certificate based on the business information, approval information, and supplier information of the purchase order document. When generating this authorization certificate, the system automatically sets a validity period, for example, 90 days from the date of generation. Simultaneously, the system uses a preset private key to hash the entire content of the authorization certificate and generate a digital signature. This validity period information and digital signature are stored as part of the authorization certificate along with the purchase order document. During subsequent compliance reviews, the review system first verifies whether the validity period of the authorization certificate covers the current date and uses the corresponding public key to verify the digital signature to ensure that the authorization certificate has not been tampered with and is still valid. Only authorization certificates that pass these two verifications will be used for subsequent compliance rule screening and evaluation, thereby ensuring the rigor and reliability of the compliance review.

[0048] In practical applications, when the above-mentioned compliance audit rules are selected from the preset compliance rule base based on the authorization certificate of the purchase order document to be inspected, if the validity of the authorization certificate is not fully verified, or the business context information contained therein is not accurately parsed and utilized, the selected compliance audit rules may be inaccurate or even have the risk of being tampered with, thereby affecting the reliability and security of compliance review.

[0049] In this regard, the step of selecting a set of compliance audit rules that match the corresponding authorization document from a preset compliance rule base based on the authorization document of the purchase order document to be inspected specifically includes: Verify the validity of the authorization documents in the purchase order documents to be inspected; When the authorization certificate is valid, extract the business context information, including the purchase type and approver, from the authorization certificate, and select and apply a set of compliance audit rules that match the business context information.

[0050] Specifically, verifying the validity of authorization documents in the purchase order documents to be inspected refers to checking the authenticity and timeliness of the authorization documents before rule screening. This ensures that subsequent compliance reviews are based on reliable authorization documents, avoiding compliance risks caused by forged, altered, or expired documents.

[0051] Specifically, when the authorization credential is valid, extracting business context information from it, including the purchase type and approver, refers to parsing key data closely related to the business scenario from the verified authorization credential. The purchase type can include, but is not limited to, "routine purchase," "urgent purchase," and "bulk purchase," while the approver can specify the approval level or role. This information forms the basis for identifying specific business scenarios.

[0052] In practical applications, selecting and applying a set of compliance review rules that match the business context information means dynamically matching and activating the most suitable set of compliance review rules from a pre-set compliance rule library based on extracted business context information such as the purchase type and approver. For example, for orders that are "specially approved purchases" and approved by the "Chief Technology Officer," a more lenient set of rules or rules with specific exemption clauses may be applied; while for "bulk purchases" submitted by "ordinary employees," a more stringent and comprehensive set of rules may be required.

[0053] In some preferred embodiments, suppose an enterprise receives a new purchase order document associated with an authorization credential. When conducting a compliance review of this purchase order document, the system first obtains the authorization credential and verifies its validity. Specifically, the system checks whether the digital signature of the authorization credential is valid and whether its expiration date covers the current date. If the verification passes, it indicates that the authorization credential is authentic and has not expired. Subsequently, the system extracts business context information from the valid authorization credential, for example, identifying the purchase order type as "bulk equipment purchase" and the approver as "department director." Based on this business context information, the system selects a set of compliance review rules specifically for "bulk equipment purchases" approved by a "department director" from a pre-defined compliance rule base. This set of rules may include strict requirements for supplier qualifications, upper limits on purchase amounts, and additional approval processes for specific equipment purchases. Finally, the system evaluates the purchase order document according to these selected rules and outputs the corresponding evaluation results.

[0054] In addition, the specific steps for verifying the validity of the authorization documents in the purchase order documents to be inspected include: The authorization certificate in the purchase order document to be inspected is decrypted, and the original data, digital signature and validity information of the purchase order document associated with the authorization certificate are read. The hash value obtained from decrypting the digital signature and the hash value calculated using an asymmetric encryption algorithm from the original data in the purchase order document are compared for consistency. If the hash values ​​match, the authorization certificate is considered valid. The current date is also obtained and recorded. If the validity period information of the decrypted authorization certificate does not cover the current date, the authorization certificate is considered valid.

[0055] Specifically, the authorization certificate in the purchase order document to be inspected is decrypted, and a preset encryption key is used to reverse-engineer the authorization certificate to obtain the original information contained within it. This original information includes the original data of the purchase order document associated with the authorization certificate, the digital signature, and the validity period information. The original data of the purchase order document refers to the various business information, approval information, and supplier information that constitute the core content of the purchase order; the digital signature is an encrypted credential used to verify the integrity and authenticity of the authorization certificate; and the validity period information limits the time frame for the use of the authorization certificate.

[0056] Furthermore, the hash value obtained by decrypting the digital signature and the hash value calculated using an asymmetric encryption algorithm on the original data of the purchase order document are compared for consistency. This aims to verify the integrity and tamper-proof nature of the authorization document. Specifically, the digital signature is generated by encrypting the hash value of the authorization document using an asymmetric encryption algorithm; decrypting the digital signature restores the original hash value. Simultaneously, the hash value of the original data in the purchase order document to be checked is recalculated. If these two hash values ​​match, it indicates that the authorization document and its associated purchase order document have not been illegally modified after the digital signature was generated, thus ensuring the integrity and authenticity of the data.

[0057] Furthermore, the current date is acquired and recorded. If the expiration date information after decryption of the authorization certificate does not cover the current date, the authorization certificate is considered valid. This aims to ensure that the authorization certificate remains within its predetermined validity period during compliance review. The validity period information can be a start date and an end date, or a generation date plus a validity duration. By comparing the current date with the validity period information of the authorization certificate, it can be determined whether the certificate has expired. Only within the validity period is the authorization certificate considered valid, thus avoiding the use of outdated or invalid certificates for compliance review.

[0058] In some of the embodiments described above in this application, a set of compliance review rules matching the business context information is proposed for selection and application. However, in its implementation, traditional simple rule matching methods may fail to fully identify the hierarchical relationships and combined effects between different contextual elements when faced with complex business contexts, resulting in inaccurate rule selection and application. For example, when there are multiple overlapping combinations of procurement type and approver identity, and different combinations correspond to different compliance requirements, simple matching may miss certain specific compliance risk points or incorrectly apply inapplicable rules, thereby affecting the accuracy and effectiveness of compliance review.

[0059] In response, a further proposal was made to conduct in-depth analysis of business context information to identify its internal hierarchical relationships and combined scenarios, and to construct rule decision-making paths accordingly, thereby achieving more accurate selection and application of compliance audit rules.

[0060] Specifically, the steps described above, including extracting business context information such as the purchase type and approver from the authorization document, and selecting and applying a set of compliance review rules that match the business context information, specifically include: After obtaining the business context information contained in the authorization credential, the business context information is parsed to identify the hierarchical relationships and combined scenarios existing in the business context information; Based on the identified hierarchical relationships and combined contexts, a rule-based decision path is constructed; Based on the rule-based decision path, select and apply a set of compliance rules that match the business context information.

[0061] Parsing the business context information to identify hierarchical relationships and combined scenarios refers to the system receiving business context information (such as purchase type, approver, etc.) contained in authorization credentials and performing structured decomposition and semantic analysis on it. The aim is to gain a deeper understanding of the inherent connections between these context elements, such as identifying primary and secondary relationships (hierarchical relationships) among certain context elements, or multiple context elements jointly constituting a specific business scenario (combined scenario). For example, in a "urgent large-amount purchase" scenario, "urgent" and "large-amount" are two independent context elements, but they combine to form a special combined scenario, and "urgent" may have higher priority in some aspects.

[0062] Based on the identified hierarchical relationships and combined scenarios, a rule decision path is constructed. This can be understood as the system dynamically generating a logical flowchart or decision tree to guide the selection and application of compliance rules after identifying the complex structure of the business context. This decision path defines the order and conditions under which different compliance rules should be evaluated and applied in a specific business context. Its purpose is to transform the complex rule matching process into a traceable and interpretable sequential decision-making process, ensuring the integrity of rule application.

[0063] In practical applications, based on the aforementioned rule-based decision path, a set of compliance rules matching the business context information is selected and applied. Specifically, this means the system no longer simply matches rules based on a single condition, but rather progressively filters and applies rules along a pre-constructed decision path. Each node or branch in the decision path may correspond to a specific set of rules or judgment conditions. The system navigates along the path based on the characteristics of the current business context until it finds and applies the set of compliance rules most suitable for the current complex situation. The purpose is to ensure the accuracy of the selected rules and avoid rule omissions or misuse due to the complexity of the context.

[0064] The following is a specific example to illustrate this. Suppose there is a purchase order whose authorization document contains business context information showing that the "Purchase Type" is "Urgent Purchase" and the "Approver" is "Chief Technology Officer".

[0065] First, the system parses the business context information contained in the authorization credential. The system identifies "urgent procurement" and "Chief Technology Officer" as two independent contextual elements. Further, through pre-defined business logic or a knowledge base, the system recognizes that "urgent procurement" typically implies a need for a faster approval process and potential relaxation of certain non-critical restrictions, while the "Chief Technology Officer's" approval authority may be limited by the procurement amount or specific material type. The system thus identifies a specific combined context between "urgent procurement" and "Chief Technology Officer approval," such as "Chief Technology Officer's approval authority in an urgent procurement context."

[0066] Secondly, based on the identified hierarchical relationships and combined scenarios, the system constructs a rule-based decision path. For example, this path might first determine whether it is an "urgent purchase." If so, it enters the "urgent purchase rule set" for preliminary review, which may include rules such as "whether special approval for emergency purchase has been obtained" and "whether it meets the emergency purchase material list." After this, the decision path will further determine the approver's identity. If it is the "Chief Technology Officer," it will review according to the "Chief Technology Officer Approval Authority Rule Set," which may include rules such as "whether the purchase amount exceeds the Chief Technology Officer's approval limit" and "whether higher-level countersigning is required."

[0067] Finally, based on the aforementioned rule-based decision path, the system selects and applies a set of compliance rules that match the business context information. The system first applies compliance rules regarding "urgent procurement," such as checking for the existence of an emergency procurement request and whether it has gone through a special approval channel. Subsequently, guided by the decision path, the system applies compliance rules regarding "Chief Technology Officer's approval authority," such as checking whether the procurement amount is within the Chief Technology Officer's authority or whether additional advanced approval is required. In this way, it ensures that all relevant compliance requirements for the specific combination of "urgent procurement and Chief Technology Officer approval" are systematically checked, thereby achieving an accurate and comprehensive compliance assessment.

[0068] In some of the above embodiments, after obtaining the business context information contained in the authorization credential, the business context information is parsed to identify the hierarchical relationships and combined scenarios existing in the business context information. Specifically, the step of parsing the business context information to identify the hierarchical relationships and combined scenarios existing in the business context information can be further refined as follows.

[0069] The steps described above for parsing the business context information to identify the hierarchical relationships and combined scenarios within the business context information include: Receive the business context information contained in the authorization credential; The business context information is decomposed in a structured manner to identify independent context elements within the business context information; The independent context elements are prioritized using a preset business priority matrix; A hierarchical business context structure is constructed based on the independent context elements after priority ranking, in order to identify the hierarchical relationships and combined contexts existing in the business context information.

[0070] Specifically, the business context information contained in the received authorization credentials refers to the key information extracted by the system from verified and valid authorization credentials that describes the business scenario of the current purchase order document. This information typically includes the purchase type, the approver's identity, etc., and forms the basis for subsequent compliance assessments.

[0071] Furthermore, the business context information is structurally decomposed to identify independent context elements. This can be understood as breaking down the received business context information, which may contain complex descriptions, into a series of minimal, independent, and identifiable components. For example, if the business context information is "urgent procurement, approved by the Chief Technology Officer," then the independent context elements can be decomposed into "procurement type: urgent" and "approver: Chief Technology Officer." The purpose is to simplify complex business contexts into operable atomic units, facilitating subsequent analysis and processing.

[0072] In practical applications, prioritizing these independent contextual elements using a pre-defined business priority matrix refers to assessing and ranking these elements based on pre-set internal rules and importance levels. For example, in certain business scenarios, "purchase type" may have a higher priority than "approver," or a specific "purchase type" may directly influence the selection of subsequent rules. This priority matrix can be configured and adjusted according to the company's actual business needs and risk control priorities, with the aim of ensuring that when multiple contextual elements exist, the factor with the greatest impact on compliance is given priority.

[0073] Therefore, constructing a hierarchical business context structure based on prioritized independent context elements to identify hierarchical relationships and combined contexts within the business context information means that after prioritizing independent context elements, the system organizes these elements into a structure with hierarchical relationships and combinational logic based on these prioritization results. For example, a decision tree or rule chain can be constructed, where high-priority context elements are located at the upper level and low-priority context elements are located at the lower level, and combinational relationships between different context elements can be defined (e.g., the combination of "urgent procurement" and "amount exceeding XX"). The purpose is to clearly demonstrate the complexity and interactions of business contexts, providing accurate input for subsequent rule-based decision path construction.

[0074] By first receiving the business context information contained in the authorization credentials, the system ensures that all subsequent analyses are based on accurate raw data. Subsequently, by structurally decomposing the business context information, complex business scenarios are broken down into easily manageable independent context elements, avoiding misjudgments caused by information redundancy or ambiguity. It is precisely because the independent context elements are prioritized using a pre-defined business priority matrix that the system can identify which factors are more critical in a specific business scenario, thus giving them higher weight or priority in subsequent rule matching. Based on this, a hierarchical business context structure is constructed according to the prioritized independent context elements, enabling the system to clearly identify the hierarchical relationships and combined scenarios within the business context. For example, when the "purchase type" is "urgent," some routine approval processes may need to be skipped, or when the "purchase amount" exceeds a certain threshold, additional review is required even if the "approver" is at a higher level. This hierarchical and combined scenario identification effectively solves the problems of inaccurate rule matching or omission of key risk points that may occur when traditional methods deal with complex and variable business scenarios.

[0075] In some of the above embodiments, when parsing business context information to identify hierarchical relationships and combined scenarios, the aforementioned workflow-based intelligent enterprise internal control management system needs to construct a hierarchical business context structure based on independent context elements after priority ranking. To this end, this application further proposes a specific implementation method for constructing this hierarchical business context structure.

[0076] Furthermore, the construction of a hierarchical business context structure based on the independent context elements after priority ranking, in order to identify the hierarchical relationships and combined contexts existing in the business context information, specifically includes: Perform domain semantic interpretation and risk meaning assessment on independent contextual elements to generate interpretation results with domain labels; Based on the preset cross-domain priority matrix and conflict resolution rules, the system adjudicates contextual elements that have the same semantics but different domain interpretations, so as to output a unified semantic interpretation. Based on the adjudicated context elements and their unified semantics and priorities, a hierarchical business context structure is constructed to identify the hierarchical relationships and combined contexts existing in the business context information.

[0077] Specifically, an independent contextual element refers to the smallest semantic unit structurally decomposed from business contextual information, such as "procurement type is urgent" or "approver level is director." The system performs domain semantic interpretation on these independent contextual elements to clarify their specific meaning and scope of application in specific business domains (such as finance, procurement, and legal affairs). Simultaneously, a risk meaning assessment is conducted to quantitatively or qualitatively determine the compliance risk level that the contextual element may bring; for example, "urgent procurement" may correspond to a higher risk level. Through this process, the system can assign one or more interpretation results with domain labels to each contextual element, such as "procurement type: urgent [high financial risk]" or "approver: director [high authority]."

[0078] The system employs a pre-defined cross-domain priority matrix and conflict resolution rules to handle complex scenarios. In real-world business scenarios, a scenario element may have different interpretations or priorities across different domains, and may even exhibit semantic conflicts. For example, "large-scale procurement" might imply a higher level of approval in the financial domain, while in the procurement domain it might mean a more stringent supplier qualification review. The cross-domain priority matrix defines the relative importance of scenario elements across different domains, while the conflict resolution rules provide a set of logic for arbitrating interpretations when inconsistencies arise, such as "when financial risk conflicts with procurement efficiency, financial risk takes precedence." Through adjudication, the system ensures that each scenario element ultimately receives a unified, clear, and conflict-free semantic interpretation, thereby avoiding ambiguity in subsequent rule matching.

[0079] In practical applications, the aforementioned system constructs a hierarchical business context structure based on the adjudicated context elements and their unified semantics and priorities. This means that the system organizes these interpreted and adjudicated context elements according to their inherent logical relationships and priorities, forming a tree-like or graph-like structure. For example, the system can use "procurement type" as a first-level context, further subdivided into "urgent procurement," "routine procurement," etc.; under "urgent procurement," it can combine other context elements such as "approver level" and "material description" to form more specific second- and third-level contexts. This hierarchical structure can clearly demonstrate the complexity and interrelationships of business contexts, thereby more accurately identifying the hierarchical relationships and combined contexts, providing a foundation for subsequent rule-based decision-making path construction.

[0080] Secondly, such as Figure 2 As shown, a workflow-based intelligent enterprise internal control management system 100 includes: The authorization certificate generation module 101 is used to process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files and process them to generate corresponding authorization certificates, and associate the generated authorization certificates with the corresponding purchase order files. The authorization certificate acquisition module 102 is used to acquire the authorization certificate associated with the purchase order file to be reviewed when conducting a compliance review of the purchase order file already entered in the enterprise's internal purchase order database. The rule filtering module 103 is used to filter a set of compliance audit rules that match the corresponding authorization certificate from a preset compliance rule library based on the authorization certificate of the purchase order document to be inspected. The compliance assessment module 104 is used to assess the corresponding purchase order documents to be inspected according to the selected compliance audit rules and output the assessment results.

[0081] This embodiment presents a workflow-based intelligent enterprise internal control management method and system. By introducing an authorization credential mechanism, it effectively addresses the misjudgment problem caused by rigid rules in existing internal control management systems when handling authorized exceptions such as "specially approved purchases." Specifically, the system first processes the purchase order document, extracting business information, approval information, and supplier information, and generating an authorization credential associated with the purchase order document. During compliance review, the system retrieves the authorization credential associated with the purchase order document to be reviewed and, based on this credential, selects a set of compliance review rules from a pre-set compliance rule library that match the authorization credential. Finally, the system evaluates the purchase order document based on the selected compliance review rules and outputs the results. In this solution, the authorization credential, as a carrier containing specific business context information, enables the system to identify and distinguish between different scenarios such as general purchases and specially approved purchases, thereby avoiding misjudging legitimate authorized exceptions as violations.

[0082] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit them. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure.

Claims

1. A workflow-based intelligent enterprise internal control management method, used for compliance checks on enterprise purchase orders, characterized in that, include: Process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files, generate corresponding authorization vouchers, and associate the generated authorization vouchers with the corresponding purchase order files; When conducting a compliance review of purchase order documents already entered in the company's internal purchase order database, obtain the authorization credentials associated with the purchase order document to be reviewed; Based on the authorization documents of the purchase order documents to be inspected, a set of compliance audit rules matching the corresponding authorization documents is selected from the preset compliance rule base; The corresponding purchase order documents to be inspected are evaluated based on the selected compliance audit rules, and the evaluation results are output.

2. The workflow-based intelligent enterprise internal control management method according to claim 1, characterized in that: The preset compliance rule base includes a first rule base for compliance review of purchase order documents under general circumstances and a second rule base for compliance review of purchase order documents under exceptional circumstances. The distinction between general and exceptional circumstances lies in the purchase type and the reviewer.

3. The workflow-based intelligent enterprise internal control management method according to claim 1, characterized in that, The steps of processing purchase order files entered into the enterprise's internal purchase order database, reading business information, approval information, and supplier information from the purchase order files, generating corresponding authorization certificates, and associating the generated authorization certificates with the corresponding purchase order files specifically include: Extract primary data, including project number, material description, and purchase type, from the business information in the read purchase order file; Extract secondary data, including the identity information of the approvers at the set levels and the approval time, from the approval information in the obtained purchase order documents; Extract third-party data, including supplier name, supplier legal representative, and supplier unified social credit code, from the supplier information in the obtained purchase order documents; The extracted first, second, and third data are combined to form a standardized data structure, which serves as an authorization credential associated with the purchase order document.

4. The workflow-based intelligent enterprise internal control management method according to claim 3, characterized in that, The authorization certificate also includes the following processing: Generate a validity period for the authorization document associated with the purchase order document; and A digital signature of the authorization document associated with the purchase order file is generated using a symmetric encryption algorithm.

5. The workflow-based intelligent enterprise internal control management method according to claim 4, characterized in that, The step of selecting a set of compliance audit rules from a pre-set compliance rule base that matches the corresponding authorization document based on the authorization document of the purchase order document to be inspected specifically includes: Verify the validity of the authorization documents in the purchase order documents to be inspected; When the authorization certificate is valid, extract the business context information, including the purchase type and approver, from the authorization certificate, and select and apply a set of compliance audit rules that match the business context information.

6. The workflow-based intelligent enterprise internal control management method according to claim 5, characterized in that, The steps for verifying the validity of the authorization documents in the purchase order documents to be inspected specifically include: The authorization certificate in the purchase order document to be inspected is decrypted, and the original data, digital signature and validity information of the purchase order document associated with the authorization certificate are read. The hash value obtained from decrypting the digital signature and the hash value calculated using an asymmetric encryption algorithm from the original data in the purchase order document are compared for consistency. If the hash values ​​match, the authorization certificate is considered valid. The current date is also obtained and recorded. If the validity period information of the decrypted authorization certificate does not cover the current date, the authorization certificate is considered valid.

7. The workflow-based intelligent enterprise internal control management method according to claim 5, characterized in that, The steps of extracting business context information, including the purchase type and approver, from the authorization certificate, and selecting and applying a set of compliance review rules that match the business context information, specifically include: After obtaining the business context information contained in the authorization credential, the business context information is parsed to identify the hierarchical relationships and combined scenarios existing in the business context information; Based on the identified hierarchical relationships and combined contexts, a rule-based decision path is constructed; Based on the rule-based decision path, select and apply a set of compliance rules that match the business context information.

8. The workflow-based intelligent enterprise internal control management method according to claim 7, characterized in that, The step of parsing the business context information to identify the hierarchical relationships and combined scenarios existing in the business context information includes: Receive the business context information contained in the authorization credential; The business context information is decomposed in a structured manner to identify independent context elements within the business context information; The independent context elements are prioritized using a preset business priority matrix; A hierarchical business context structure is constructed based on the independent context elements after priority ranking, in order to identify the hierarchical relationships and combined contexts existing in the business context information.

9. The workflow-based intelligent enterprise internal control management method according to claim 8, characterized in that, The construction of a hierarchical business context structure based on priority-ranked independent context elements, in order to identify hierarchical relationships and combined contexts within the business context information, specifically includes: Perform domain semantic interpretation and risk meaning assessment on independent contextual elements to generate interpretation results with domain labels; Based on the preset cross-domain priority matrix and conflict resolution rules, the system adjudicates contextual elements that have the same semantics but different domain interpretations, so as to output a unified semantic interpretation. Based on the adjudicated context elements and their unified semantics and priorities, a hierarchical business context structure is constructed to identify the hierarchical relationships and combined contexts existing in the business context information.

10. A workflow-based intelligent enterprise internal control management system, characterized in that, include: The authorization certificate generation module is used to process the purchase order files entered into the enterprise's internal purchase order database, read business information, approval information and supplier information from the purchase order files and process them to generate corresponding authorization certificates, and associate the generated authorization certificates with the corresponding purchase order files; The authorization credential acquisition module is used to acquire the authorization credential associated with the purchase order file to be reviewed when conducting a compliance review of the purchase order file already entered in the enterprise's internal purchase order database. The rule filtering module is used to filter a set of compliance audit rules that match the corresponding authorization documents from a preset compliance rule library based on the authorization documents of the purchase order documents to be inspected. The compliance assessment module is used to assess the corresponding purchase order documents to be inspected based on the selected compliance audit rules and output the assessment results.

Images