An audit full-process end-to-end automation system based on agent cooperation

Abstract

This invention provides an end-to-end automated auditing system based on agent collaboration, belonging to the field of auditing technology. The system includes agents for task understanding, data analysis, anomaly detection, root cause analysis, report generation, and rectification tracking. Specifically, the task understanding agent parses natural language instructions to generate structured configurations; the data analysis agent extracts and cleans data and generates statistical feature values; the anomaly detection agent generates a list of suspected anomalies using preset rules and models; the root cause analysis agent constructs local relational subgraphs based on knowledge graphs and outputs root cause analysis results; and the audit result generation agent maps the results to intermediate data objects to generate audit report documents. The rectification tracking agent dispatches rectification task orders, and upon receiving feedback, reads the original anomaly rule script or original algorithm model file used to generate the list of suspected anomalies, performs automated regression testing on the rectified data, and calculates the risk reduction rate. This invention achieves standardized workflow and closed-loop verification of auditing processes, improving audit efficiency and rectification quality.

Description

Technical Field

[0001] This invention relates to the field of computer data processing technology, specifically to an end-to-end automated auditing system based on intelligent agent collaboration. Background Technology

[0002] As businesses expand and digitalization increases, the focus of auditing has shifted from traditional paper documents to massive amounts of electronic business data. Modern auditing typically relies on computer-aided auditing systems, which connect the auditee's financial and business systems via software platforms deployed on server clusters or in the cloud. These systems aim to assist professionals in extracting key information from complex data, performing compliance checks, risk assessments, and issue tracking to ensure the compliance and security of business operations.

[0003] In existing technological applications, audit information systems are typically built as comprehensive tool platforms that include data collection, data analysis, and results display functions. Auditors create audit projects through a terminal interface, configure data query conditions and analysis rules, and the system performs batch processing operations on business data according to preset logic scripts, outputting any discovered anomalies in report form. Subsequent root cause investigations, report writing, and rectification management are usually completed step-by-step by auditors using the basic data output by the system in different functional modules or independent office software.

[0004] However, existing auditing systems lack a unified and intelligent global process control and resource scheduling mechanism when facing complex auditing tasks involving multiple stages and models. Data interaction between functional modules within the system often relies on static interface calls or manual import / export, lacking dynamic orchestration capabilities based on task dependencies and real-time computing resource status. When the system processes multiple high-load auditing tasks simultaneously, the inability to automatically prioritize and allocate resources based on task urgency and data flow can easily lead to blocking of critical computing tasks and competition for system resources. This results in low efficiency in data flow between processing stages and fails to achieve fully automated closed-loop operation from task instruction reception to final result verification. Summary of the Invention

[0005] This invention primarily addresses the technical problems of fragmented data flow at each stage of the existing audit process, reliance on manual experience for rectification and verification, and the lack of an automated closed-loop verification mechanism.

[0006] The first aspect of this invention provides an end-to-end automated auditing system based on intelligent agent collaboration.

[0007] The system includes a data storage and management module, a task understanding agent, a data analysis agent, an anomaly detection agent, a root cause analysis agent, an audit result generation agent, and a rectification tracking agent.

[0008] The task understanding agent is used to parse audit task instructions in natural language. This module extracts parameters such as audit object, audit period, and audit objective through natural language processing algorithms, and matches the business rule set in the audit knowledge base according to the audit intent category to generate a structured task configuration file containing specific task parameters and risk assessment benchmarks.

[0009] The data analysis agent is used to extract raw business data from the auditee's information system through a data interface unit, based on a structured task configuration file. This module performs deduplication, missing value imputation, and field mapping operations on the raw business data, transforming it into standardized data records that conform to a preset model, and generating statistical feature values ​​based on statistical dimensions.

[0010] Anomaly detection agents are used to detect statistical feature values ​​using preset rules and machine learning models, calculate the deviation between data features and the benchmark model, mark records with deviations exceeding preset thresholds as anomalies, and generate a list of suspicious anomalies.

[0011] The root cause analysis agent is used to perform correlation analysis on a list of suspicious anomalies. This module utilizes graph database technology, using the audit entity identifiers in the list of suspicious anomalies as central anchor points, to retrieve neighbor nodes and related edges within a preset depth range in the audit knowledge graph, construct a local correlation subgraph, and output root cause analysis results data containing causal inferences.

[0012] The audit result generation agent maps statistical feature values, a list of anomalies, and root cause analysis results to a unified intermediate data object. This intermediate data object uses a hierarchical tree structure to store text and numerical fields. This module traverses the standard report template file, parses dynamic content placeholders, and replaces the dynamic content placeholders with data from the intermediate data object to generate the audit report document.

[0013] The rectification tracking agent is used to execute automated regression testing logic. This module parses audit report documents to dispatch rectification task orders. Upon receiving rectification feedback, this module reads the original anomaly rule script or original algorithm model file used to generate the anomaly list and extracts entity feature dimensions from the original anomaly records. Based on the entity feature dimensions, this module locates the data subset to be verified in the rectified business data and calls the original anomaly rule script or original algorithm model file to perform operations on the data subset to be verified, generating a review risk value. This module determines the effectiveness of the rectification by calculating the decrease or change rate of the risk value.

[0014] In a preferred embodiment, the system further includes a central scheduling agent, which uses weighted scoring logic to calculate the execution priority of each functional node. The weighted scoring logic is as follows: calculate the reciprocal of the estimated execution time of the current node, multiply the reciprocal by a first preset weight coefficient to obtain a first value; calculate the number of out-degrees of the current node, multiply the number of out-degrees by a second preset weight coefficient to obtain a second value; add the first value and the second value to obtain a priority value. The system prioritizes scheduling the node with the highest priority value.

[0015] In a preferred embodiment, the pattern matching unit in the root cause analysis agent calculates the similarity between the local association subgraph and the abnormal topology template in the pre-set risk topology library. The similarity calculation logic is as follows: the proportion of nodes with the same attributes and the proportion of edges with the same connection relationship between the local association subgraph and the abnormal topology template are counted, and the proportions of the number of nodes and the proportion of the number of edges are weighted and combined according to a preset strategy to generate a graph pattern matching degree value.

[0016] In a preferred embodiment, the algorithm inference unit of the anomaly detection agent uses an autoencoder model for anomaly scoring. The scoring logic is as follows: standardized feature values ​​are constructed into an input vector, mapped to a low-dimensional latent space, and reconstructed into an output vector by a decoder; the vector distance between the input vector and the output vector is calculated as the reconstruction error; the reconstruction error is normalized to obtain the algorithm anomaly score. The result aggregation unit performs a weighted summation of the rule risk value and the algorithm anomaly score to generate a comprehensive risk score.

[0017] A second aspect of the present invention provides an end-to-end automated method for the entire audit process.

[0018] The method includes the following steps: receiving audit task instructions in natural language form and parsing them to generate a structured task configuration file; extracting raw business data from the auditee's information system and generating statistical feature values ​​based on the structured task configuration file; detecting the statistical feature values ​​using preset rules and machine learning models to generate an anomaly list; constructing a local relational subgraph in the audit knowledge graph based on the anomaly list and performing graph traversal to generate root cause analysis result data; mapping the statistical feature values, the anomaly list, and the root cause analysis result data to intermediate data objects, and assembling and generating an audit report document based on the intermediate data objects; dispatching rectification task orders based on the audit report document and reading the original anomaly rule script or original algorithm model file used when generating the anomaly list; and performing automated regression testing on the rectified business data using the original anomaly rule script or original algorithm model file to calculate the decrease in risk values.

[0019] A third aspect of the present invention provides an electronic device.

[0020] The electronic device includes a processor and a memory, the memory storing computer program instructions, and the processor executing the computer program instructions to implement the end-to-end automated audit process as described above.

[0021] A fourth aspect of the present invention provides a non-volatile computer-readable storage medium.

[0022] The storage medium stores computer program instructions, which, when executed by a processor, implement the end-to-end automated audit process described above.

[0023] The technical solution provided by this invention automatically performs regression testing on the rectified data by reading the original detection logic, and verifies the rectification effect by using the change ratio of the review risk value. This achieves closed-loop management of the audit rectification process and ensures the consistency and traceability of the rectification verification conclusions.

[0024] This invention provides an end-to-end automated auditing system based on intelligent agent collaboration. It offers the following advantages: 1. This invention constructs an audit workflow instance based on a directed acyclic graph through a central scheduling intelligent agent. It uses weighted scoring logic, which includes the reciprocal of execution time and the number of out-degrees, to calculate the execution priority of functional nodes. The instruction distribution unit sends start instruction packages to each functional module according to the task queue status. At the same time, it controls the data storage and management module to perform standardized data flow between each stage. This realizes the fully automated scheduling of audit tasks from understanding and analysis to report generation, effectively solving the blocking problem caused by system resource competition when multiple tasks are running in parallel, and ensuring the timing accuracy and resource utilization efficiency of audit job execution.

[0025] 2. This invention constructs local relational subgraphs in a knowledge graph using an audit entity identifier as an anchor point through a root cause analysis agent. It then uses a path traversal algorithm to detect closed-loop structures or attribute-sharing associations and calculates the graph pattern matching degree between the local relational subgraphs and the abnormal topology templates in a pre-set risk topology library. This enables automated, in-depth analysis of complex violation patterns, uncovering structural risk characteristics hidden behind discrete transactions. It avoids potential underreporting issues that may occur with single-dimensional statistical detection and provides auditors with root cause inference results supported by a chain of evidence.

[0026] 3. This invention, through a rectification tracking intelligent agent, reads the original anomaly rule script or original algorithm model file when generating the list of anomalies after receiving rectification feedback, extracts entity feature dimensions, locates the data subset to be verified in the rectified business data, performs automated regression testing on the data subset, and calculates the decrease in risk values. This achieves standardization and quantitative evaluation of the audit rectification verification process, eliminates the subjective differences of manual review, ensures that the rectified business data strictly conforms to the initially set compliance benchmarks, and completes the closed-loop management of audit business. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the overall method of the present invention; Figure 2 This is a diagram of the overall system module architecture of the present invention. Detailed Implementation

[0028] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example

[0029] Please see the appendix Figure 1 -Appendix Figure 2 This invention provides an end-to-end automated auditing system based on intelligent agent collaboration. The end-to-end automated auditing system runs in an electronic device or server cluster containing a processor and memory, and is used to execute data processing logic from receiving audit tasks to verifying rectification results.

[0030] The end-to-end automated auditing system mainly includes: a central dispatch agent, a data storage and management module, a task understanding agent, a data analysis agent, an anomaly detection agent, a root cause analysis agent, an audit result generation agent, and a rectification tracking agent. Each of these modules is constructed from computer program instructions, stored in memory, and executed by a processor. Signal transmission and data exchange between modules occur via an internal bus, message queue, or application programming interface.

[0031] The central scheduling agent, acting as the system's command distribution center, establishes communication connections with the task understanding agent, data analysis agent, anomaly detection agent, root cause analysis agent, audit result generation agent, rectification tracking agent, and data storage and management module. The central scheduling agent contains a state machine or workflow engine, used to read the execution status identifiers of each module and send start or termination commands to the corresponding modules according to the preset audit workflow timing logic.

[0032] The data storage and management module serves as the system's shared data exchange area, storing raw data, intermediate process data, and final result data involved in the entire audit process. This module includes an audit data center and a data interface unit. The audit data center, built on a relational database or distributed file system, is used for persistent storage of structured data and unstructured documents. The data interface unit provides standardized data read / write protocols for data access by the task understanding agent, data analysis agent, anomaly detection agent, root cause analysis agent, audit result generation agent, and rectification tracking agent.

[0033] The task understanding agent receives natural language audit task instructions input through the user terminal. The agent runs natural language processing algorithms to extract entities and classify intents from the audit task instructions, extracting parameters such as the audit object, audit period, and audit objective. It then calls upon the audit knowledge base to generate a structured configuration file containing specific task parameters and risk assessment benchmarks.

[0034] The data analysis agent starts upon receiving a trigger signal from the central scheduling agent. Based on a structured configuration file, the agent sends data request commands to the audited entity's business systems via the data interface unit. The agent then executes pre-defined cleaning rules, transformation logic, and aggregation algorithms to convert the raw data into a standardized dataset.

[0035] The anomaly detection agent receives a standardized dataset output by the data analysis agent. The anomaly detection agent loads a pre-trained machine learning model or statistical analysis rules and calculates feature values ​​on the standardized dataset. The anomaly detection agent calculates the deviation between the data features and the baseline model, marks records with deviation values ​​exceeding a preset threshold as anomalies, and generates a list of suspicious anomalies containing feature descriptions of the anomalies.

[0036] The root cause analysis agent performs correlation analysis on the list of suspicious points output by the anomaly identification agent. Utilizing graph database technology, combined with a pre-built audit knowledge graph and causal reasoning algorithms, the root cause analysis agent retrieves business entity nodes and operation logs that are associated with the suspicious points. The agent constructs a path mapping from the anomaly to its potential causes and outputs the root cause analysis results.

[0037] The audit results generation agent is used to summarize and process the results. It reads structured configuration files, a list of anomalies, and root cause analysis data, and uses a Natural Language Generation (NLG) algorithm to populate the data into the corresponding slots of a pre-defined audit report template. The agent then generates an audit report document containing audit conclusions and rectification recommendations.

[0038] The rectification tracking agent is used to execute post-audit management logic. It parses the rectification suggestion text in the audit report document, generates a pending rectification task list containing responsibility and deadline fields, and sends the task list to the associated responsible party account. The rectification tracking agent periodically polls the status of the rectification task list and triggers a verification subroutine when the status is updated to "completed," generating a rectification result verification report.

[0039] During system operation, the central scheduling agent controls the data flow, so that the data output by the preceding functional modules is written into the data storage and management module and read as the input data of the subsequent functional modules, thus forming a data-driven sequential execution path.

[0040] Furthermore, the end-to-end automated audit system connects to external user terminals and the auditee's information system via network communication interfaces. The user terminals provide a human-computer interface for inputting commands and displaying reports. The auditee's information system, acting as an external data source, responds to data requests and transmits raw business data to the data storage and management module.

[0041] The human interaction interface of this system is an independent functional module deployed in the business logic processing layer. It establishes communication connections with the data storage and management module and various intelligent agents. The specific functions are implemented as follows: Preset audit node definitions: The system pre-sets 3 types of core audit nodes as trigger points for human interaction, including: task understanding completion node, anomaly identification completion node, and root cause analysis completion node; Interactive function implementation: (1) Task understanding completion node: The manual interaction interface displays the structured task configuration file, which supports auditors to confirm, modify or supplement the audit object, scope, key points and constraints. The modified parameters are automatically synchronized to the data storage and management module to update the audit context; Anomaly identification completion node: The human interaction interface displays a list of suspicious anomalies, allowing auditors to mark the status as "confirmed anomaly", "excluded from misjudgment", or "pending verification". For anomalies marked as "pending verification", additional verification notes can be added. This status and notes will serve as input parameters for the root cause analysis agent. Root cause analysis completion node: The human interaction interface displays the root cause analysis results data and evidence chain index, supporting auditors to confirm or revise the conclusions of cause inference. The revised conclusions will be synchronized to the audit result generation agent for adjusting the content of the audit report. Interaction process: The human interaction interface provides a visual operation interface through the user terminal. All interaction operations generate operation logs, which are stored together with audit context data in the data storage and management module, supporting full traceability.

[0042] This invention provides an end-to-end automated audit process method. This method is applied to the aforementioned end-to-end automated audit system to perform full-cycle processing from audit task input, execution, reporting to rectification closure and model optimization.

[0043] The end-to-end automation method for the entire audit process includes steps S100 to S700.

[0044] Step S100: Receive audit task instructions and generate a structured task configuration. The task understanding agent receives audit task instructions in natural language text format transmitted from the user terminal via a communication interface. The task understanding agent runs a natural language processing algorithm to parse the audit task instructions, extracting the audit object entity, audit time range, and audit target intent. Based on the parsed audit object entity and audit target intent, the task understanding agent matches the preset association rules in the audit knowledge base of the data storage and management module to generate a structured task configuration file. The structured task configuration file includes data collection range parameters, risk assessment benchmark indicators, and execution parameters for subsequent functional modules. The task understanding agent transmits the structured task configuration file to the data storage and management module for persistent storage.

[0045] Step S200: Data acquisition and processing are performed based on the structured task configuration. After receiving the write completion signal of the structured task configuration file, the central scheduling agent sends a start signal to the data analysis agent. The data analysis agent reads the structured task configuration file from the data storage and management module and establishes a data reading channel with the audited entity's information system through the data interface unit. The data analysis agent extracts raw business data within a specified range according to the structured task configuration file and performs deduplication, missing value imputation, and field mapping operations. The data analysis agent converts the processed data into a standardized dataset conforming to a preset schema definition and writes the standardized dataset into the data storage and management module.

[0046] Step S300: Perform anomaly detection based on the standardized dataset. After the standardized dataset is written, the central scheduling agent sends a start signal to the anomaly detection agent. The anomaly detection agent reads the standardized dataset from the data storage and management module. The anomaly detection agent calls a preset statistical analysis model or machine learning model to vectorize the data records in the standardized dataset and calculate feature values. The anomaly detection agent compares the feature values ​​with a preset benchmark model or threshold range. The anomaly detection agent filters out records whose deviation values ​​exceed the threshold range, generates an anomaly list containing an anomaly record index and deviation feature descriptions, and stores the anomaly list in the data storage and management module.

[0047] Step S400: Perform root cause analysis based on the list of suspected anomalies. The central scheduling agent sends a start signal to the root cause analysis agent. The root cause analysis agent reads the list of suspected anomalies and, for each anomaly record in the list, retrieves the associated business entity nodes and historical operation log nodes in the audit knowledge graph. The root cause analysis agent runs a graph traversal algorithm or a causal reasoning algorithm to calculate the path weights between the anomaly nodes and potential cause nodes, establishing path mappings. The root cause analysis agent generates root cause analysis result data containing causal inference conclusions and evidence chain indexes, and stores the root cause analysis result data in the data storage and management module.

[0048] Step S500: Generate an audit report document. The central scheduling agent sends a start signal to the audit result generation agent. The audit result generation agent retrieves the structured task configuration file, the list of suspicious points, and the root cause analysis results from the data storage and management module. The audit result generation agent retrieves a report template that matches the audit objective, uses a natural language generation algorithm to convert the retrieved data into text descriptions, and maps and fills the text descriptions into preset slots in the report template. The audit result generation agent generates an electronic audit report document containing audit conclusions, detailed problem descriptions, and rectification suggestions, and displays it through the user terminal.

[0049] Step S600: Perform rectification tracking and verification. The rectification tracking agent parses the rectification suggestion section of the electronic audit report document, extracting the rectification action instructions, the responsible object ID, and the deadline timestamp. The rectification tracking agent generates a rectification task sheet and sends it to the terminal corresponding to the responsible object ID. The rectification tracking agent polls the status flag of the rectification task sheet. When the status flag of the rectification task sheet is updated to "submitted," the rectification tracking agent triggers a verification subroutine, sends instructions to the data analysis agent to re-collect real-time business data, and calls preset compliance check rules for comparison, generating a rectification result verification report.

[0050] Step S700: Execute feedback and model optimization. After the rectification result verification report is generated, the central scheduling agent triggers the data storage and management module to perform data archiving. The data storage and management module marks the audit task instructions, anomaly list, root cause analysis results, and rectification result verification report from this audit process as labeled historical training samples. The central scheduling agent invokes the incremental learning algorithm, using the labeled historical training samples to update the weight matrix or expand the rule base of the task understanding agent's natural language processing algorithm model and the anomaly recognition agent's machine learning model, and stores the updated model parameters in the audit data center.

[0051] During the execution of steps S100 to S700, the central scheduling agent acts as the process control hub, activating each functional module sequentially according to the preset workflow logic order. The data output of the previous functional module is stored in the data storage and management module and is called as the input parameter of the next functional module, realizing the serial processing and flow of audit data.

[0052] This invention provides a central scheduling agent, which serves as the logical operation unit of an end-to-end automated audit system and is used to orchestrate and schedule audit tasks based on the theory of directed acyclic graphs.

[0053] The central scheduling intelligent agent includes a task planning unit, an instruction distribution unit, a status monitoring unit, and an exception handling unit. These units reside in the server's memory space and are executed by the processor to implement their logical functions.

[0054] The task planning unit receives a structured task configuration file from the task understanding agent. Internally, the task planning unit stores a business process template library containing multiple predefined sequences of audit job nodes and their dependencies. Based on the audit objective intent in the structured task configuration file, the task planning unit retrieves a matching business process template from the library and instantiates it as an audit workflow instance.

[0055] The audit workflow instance constructed by the task planning unit is defined using a directed acyclic graph (DAG) data structure. In the audit workflow instance, the nodes of the graph map to specific functional modules executing tasks, and the directed edges map to the pre- and post-dependent constraints that task execution must follow. The task planning unit performs a topology sorting algorithm on the audit workflow instance, transforming the mesh-like graph structure into a linear task execution queue. The topology sorting algorithm ensures that in the task execution queue, the index position of any task is after the index positions of all its pre-dependent tasks.

[0056] The instruction distribution unit sends control signals to each functional module based on the task execution queue. The instruction distribution unit reads the task execution queue. When the status indicators of all the preceding dependent nodes of the current node in the task execution queue are in the completed state, the instruction distribution unit parses the configuration parameters of the current node and encapsulates them into a JSON-formatted startup instruction package. The startup instruction package contains the storage address index of the input data in the data storage and management module, the reserved write address index of the output data, and the algorithm model call parameters. The instruction distribution unit sends the startup instruction package to the corresponding execution interfaces of the data analysis agent and the anomaly recognition agent via the internal message bus.

[0057] During instruction distribution, if multiple nodes simultaneously meet the startup conditions but system computing resources are limited, the instruction distribution unit needs to calculate the execution priority of each node. As one embodiment of the present invention, the instruction distribution unit uses a weighted scoring logic to calculate the priority.

[0058]

[0059] in, This indicates the estimated execution time of the current node. This represents the number of out-degrees of the current node (i.e., the number of subsequent nodes that depend on the current node). and These are preset weighting coefficients. The weighted scoring logic ensures that tasks with shorter execution times and greater impact on subsequent processes are prioritized for scheduling. The instruction distribution unit selects the node with the highest priority value to send the startup instruction package first.

[0060] The status monitoring unit maintains a global status table, recording the lifecycle status of each node in the audit workflow instance. Node status includes: pending scheduling, running, successful, failed, and timeout. The status monitoring unit updates the global status table by listening for callback events in the message queue. When the data analysis agent or anomaly detection agent completes its computation task, it sends a completion signal containing the task ID to the status monitoring unit. Upon receiving the completion signal, the status monitoring unit updates the status of the corresponding node in the global status table to successful and triggers the instruction distribution unit to scan the task execution queue.

[0061] The exception handling unit is used to handle interruption logic during execution. When the status monitoring unit detects that a node in the global status table has been updated to a failed or timed-out state, the exception handling unit is activated. The exception handling unit reads a preset error recovery strategy library. If the error type is identified as network fluctuation or insufficient resources, the exception handling unit executes retry logic, instructing the instruction distribution unit to resend the startup instruction packet and counting the number of retries. If the number of retries exceeds a preset threshold or the error type is identified as a data format error, the exception handling unit marks the audit workflow instance as suspended and generates an alarm log, sending it to the user terminal.

[0062] This invention provides a data storage and management module, which serves as the data persistence layer of an end-to-end automated audit system and is used to perform storage, index building, and access control of heterogeneous audit data.

[0063] The data storage and management module mainly includes: an audit data center, a data interface unit, and a data governance unit. The audit data center, data interface unit, and data governance unit are deployed within the storage media and storage controller of the server cluster, and transmit signals via an internal data bus.

[0064] The audit data center employs a hybrid storage architecture, comprising a relational database cluster, a distributed file system, and a graph database. The relational database cluster stores structured data, including financial details, business transaction records, and standardized datasets generated by data analytics agents from the auditee's information systems. The relational database cluster uses predefined table structures to store the structured data in a row-oriented manner and establishes multi-dimensional indexes.

[0065] Distributed file systems are used to store unstructured data, including scanned contract documents, email archives, multimedia evidence files, and audit reports. Distributed file systems manage the mapping between file paths and physical storage blocks through a metadata server, supporting the writing and reading of large binary objects.

[0066] The graph database is used to store the audit knowledge graph. It stores audit entities and their relationships in the form of nodes and edges. Audit entities include company nodes, personnel nodes, account nodes, and counterparty nodes; relationships include equity control edges, fund transfer edges, and kinship edges. The graph database is configured with a graph traversal query engine for root cause analysis agents to perform multi-hop relational queries.

[0067] The data interface unit acts as a data exchange gateway within the system. It encapsulates read and write operation instructions for the audit data center and provides a unified standard application programming interface (API) to the outside world. When a task understanding agent, an anomaly detection agent, or an audit result generation agent initiates a data request, the data interface unit receives the request parameters, parses them into corresponding database query statements or file system operation instructions, and converts the query results into JSON or XML format before returning them to the requester.

[0068] The data interface unit maintains an internal database connection pool to manage connection sessions with the audited entity's information systems. The data interface unit has a built-in protocol adapter that supports JDBC, ODBC, and proprietary interface protocols of specific ERP systems. Through the protocol adapter, the data interface unit performs conversion mapping from heterogeneous data protocols to internal standard formats, enabling business function modules to access heterogeneous data sources through a unified interface.

[0069] The data governance unit is responsible for performing data security control and lifecycle management. Before data is written to the audit data center, the data governance unit calls an encryption algorithm library to convert sensitive fields into ciphertext. Based on access control lists or role-based access control models, the data governance unit verifies the authorization credentials of the module or user initiating the data request and blocks unauthorized access requests.

[0070] Furthermore, the data governance unit implements a multi-tenant data isolation strategy. To ensure that data from different audited entities remains physically or logically isolated, the data governance unit establishes a mapping routing table between the unique identifiers of the audited entities and storage partitions. When data is written, the data governance unit reads the unique identifier of the data from the audited entity and routes the data to a separate database schema or physical storage partition according to the mapping routing table. This isolation strategy ensures that data query operations targeting a specific audited entity are performed only within the corresponding storage partition, preventing cross-access or unauthorized reads.

[0071] The data governance unit is also configured with a regular backup strategy to generate data snapshots and store them on an off-site disaster recovery server to ensure the integrity and availability of audit data.

[0072] This invention provides a task understanding agent, which serves as an entry component for audit workflows and is used to convert unstructured natural language instructions into machine-executable structured task configuration files.

[0073] The task-understanding agent mainly consists of a text preprocessing unit, a semantic parsing unit, a knowledge matching unit, and a configuration generation unit. These units are constructed from computer program code and run in the server's processor environment.

[0074] The text preprocessing unit receives audit task instruction text from the user terminal. The text preprocessing unit loads a pre-defined stop word list and an audit terminology thesaurus. The text preprocessing unit performs word segmentation on the audit task instruction text, removing non-textual noise characters and stop words. Based on the audit terminology thesaurus, the text preprocessing unit maps and replaces non-standard abbreviations in the audit task instruction text with standard terms, generating a standardized word sequence.

[0075] The semantic parsing unit receives standardized word sequences and performs entity extraction and intent recognition. The semantic parsing unit invokes a pre-trained sequence labeling model to extract key audit elements from the standardized word sequences. These key audit elements include: the name of the audited entity, the audit period, the business area, and specific audit concerns.

[0076] Simultaneously, the semantic parsing unit executes intent classification logic. The semantic parsing unit converts the standardized word sequence into an input feature vector using a word embedding algorithm. The semantic parsing unit maps the input feature vector to a predefined high-dimensional vector space and calculates the spatial distance metric or similarity value between the input feature vector and each predefined intent prototype vector. The semantic parsing unit selects the category corresponding to the intent prototype vector with the highest similarity value or the closest spatial distance, determining it as the audit intent category to which the audit task instruction belongs.

[0077] The knowledge matching unit connects to the audit knowledge base in the data storage and management module. Based on the audit intent category and key audit elements, the knowledge matching unit retrieves the corresponding business rule set from the audit knowledge base. The business rule set includes: data collection scope definition, key field validation rules, default parameters for anomaly thresholds, and legal and regulatory reference entries.

[0078] The knowledge matching unit executes integrity verification logic. It checks whether the extracted audit key elements meet the minimum parameter set requirements for initiating the business rule set. If any necessary parameters are missing, the knowledge matching unit generates a parameter completion request signal and returns it to the user terminal; if the parameters are complete, the knowledge matching unit combines the audit key elements with the business rule set and passes it to the configuration generation unit.

[0079] The configuration generation unit is used to construct structured task configuration files. It reads the pre-set SQL query templates and analysis model configuration templates corresponding to the audit intent categories. The configuration generation unit populates the corresponding slots in the pre-set SQL query templates and analysis model configuration templates with audit key elements as parameters, generating standard JSON or XML format documents. The structured task configuration file explicitly defines: the data extraction logic that the data analysis agent needs to execute, the algorithm model identifiers that the anomaly detection agent needs to load, and the report template indexes that the audit result generation agent needs to call. The configuration generation unit writes the generated structured task configuration file to the data storage and management module and sends a task ready signal to the central scheduling agent.

[0080] This invention provides a data analysis intelligent agent, which serves as a data processing component in an end-to-end automated audit system, and is used to perform data extraction, data cleaning, format conversion, and feature index calculation.

[0081] The data analysis intelligent agent mainly includes: a data extraction unit, a data cleaning unit, a data transformation unit, and a feature calculation unit. These units are constructed from computer program instructions and configured to run on a server's processor.

[0082] Upon receiving the start signal from the central scheduling agent, the data extraction unit reads the structured task configuration file from the data storage and management module. The data extraction unit parses the data acquisition range parameters in the structured task configuration file, which include the data source connection address, the list of target data table names, the start and end points of the time window, and field filtering conditions. The data extraction unit then uses the channel provided by the data interface unit to send a data query request to the audited entity's information system. To prevent memory overflow, the data extraction unit employs a paginated query logic, retrieving the original business data stream in batches by setting offset parameters and limit parameters in the query statement.

[0083] The data cleaning unit receives the raw business data stream and performs data quality governance operations. Based on preset field constraint rules, the data cleaning unit scans the raw business data stream for null fields, malformed fields, and duplicate records. For null null fields, the data cleaning unit performs mean-filling or zero-filling operations; for duplicate records, the data cleaning unit calculates the hash digest value of each data record, identifies and removes duplicate data rows by comparing the hash digest values, and generates an intermediate dataset.

[0084] The data conversion unit is used to unify the storage format of multi-source heterogeneous data. It loads a predefined standard audit data model, which defines a unified field naming convention, data type definitions, and an encoding dictionary mapping table. The unit establishes a mapping relationship between the original business fields and the fields of the standard audit data model, converting the intermediate dataset into standardized data records conforming to the model. For example, the unit converts date strings of different formats into long integer timestamps and non-standard business status codes into system-defined enumeration values.

[0085] The feature calculation unit is used to construct multi-dimensional audit features based on standardized data records. The feature calculation unit performs aggregation calculations on the standardized data records according to the statistical dimensions specified in the structured task configuration file, generating statistical feature values. These statistical feature values ​​include the total transaction amount, transaction frequency, maximum transaction amount, and year-on-year and month-on-month change rates within a specified time window.

[0086] The management and analysis functions of the data analysis intelligence agent specifically refer to the verification of compliance of standardized data records in business processes, analysis of the achievement of management indicators, and evaluation of cross-departmental collaboration efficiency based on the needs of audit business management. Business process compliance verification: By comparing the business operation nodes and approval process nodes in standardized data records with the preset management process specifications in the audit knowledge base, business operations that are not executed in accordance with the prescribed process (such as transactions without approval records, operations exceeding authority, etc.) are identified. Management indicator achievement analysis: Extract key management indicator data (such as budget execution rate, task completion time, error rate, etc.) from standardized data records, compare them with preset management target thresholds, and generate indicator achievement analysis results; Cross-departmental collaboration efficiency assessment: Based on departmental association identifiers in data records, the average duration of cross-departmental business processes and the number of node delays are statistically analyzed to identify collaboration efficiency bottlenecks. Management analysis results, statistical analysis results, and model analysis results are collectively incorporated into a standardized dataset as input for subsequent anomaly identification.

[0087] To ensure that statistical feature values ​​with different dimensions are suitable for subsequent machine learning models, the feature calculation unit performs numerical normalization on the statistical feature values. The feature calculation unit calculates the arithmetic mean and standard deviation of the statistical feature values ​​over the historical sample period. The feature calculation unit then subtracts the arithmetic mean from the current statistical feature value and divides it by the standard deviation to obtain the dimensionless standardized feature value. Alternatively, the feature calculation unit uses a max-min scaling algorithm to map the statistical feature values ​​to a closed interval between zero and one.

[0088] The data analysis agent generates a standardized dataset containing standardized data records and standardized feature values, which is then transmitted and saved to the data storage and management module via a storage write interface. After the write operation is confirmed, the data analysis agent sends a processing completion signal to the central scheduling agent.

[0089] This invention provides an anomaly identification intelligent agent, which serves as a logical operation component of an end-to-end automated auditing system. It is used to identify violations and nonlinear distribution differences in business activities based on standardized datasets.

[0090] The anomaly detection agent comprises a model management unit, a rule execution unit, an algorithm inference unit, and a result aggregation unit. These units are constructed from computer program code, reside in server memory, and are executed by the processor.

[0091] The model management unit is configured to initialize the detection environment. Upon receiving a startup command packet from the central scheduling agent, the model management unit parses the algorithm model call parameters within the startup command packet. Based on the algorithm model call parameters, the model management unit retrieves the corresponding pre-trained model files and business rule sets from the data storage and management module. The pre-trained model files include isolated forest models, autoencoder models, or graph neural network models. The business rule set includes explicit numerical thresholds and logical mutual exclusion constraints.

[0092] The rule execution unit performs compliance checks based on deterministic logic. It iterates through each standardized data record in the standardized dataset. The unit extracts the target field value from each record and compares it to a threshold value in the business rule set using logical operators (greater than, less than, equal to, or not equal to). When the comparison triggers a preset violation condition, the unit generates a rule violation identifier containing the rule number.

[0093] The algorithm inference unit is used to identify anomalous distributions that do not conform to statistical regularities. The inference unit receives standardized feature values ​​generated by the data analysis agent and constructs these standardized feature values ​​into an input vector. With an autoencoder model loaded, the inference unit maps the input vector to a low-dimensional latent space and then reconstructs it into an output vector using a decoder. The inference unit calculates the vector distance between the input and output vectors, defining this vector distance as the reconstruction error. Data records with reconstruction errors greater than a preset anomaly threshold are marked as suspected anomalies, and a normalized algorithmic anomaly score is output based on the magnitude of the reconstruction error.

[0094] The result aggregation unit integrates the outputs of the rule execution unit and the algorithm inference unit. Since the rule execution unit outputs discrete logical judgments, while the algorithm inference unit outputs continuous probability scores, the result aggregation unit performs risk fusion calculations. The result aggregation unit maps rule violation identifiers to numerical rule risk values. It reads preset rule weight coefficients and algorithm weight coefficients, performs weighted summation or nonlinear logical synthesis calculations on the rule risk values ​​and algorithm anomaly scores, and generates a comprehensive risk score for each data record. The result aggregation unit sorts the abnormal data based on the comprehensive risk scores and assigns risk level labels. Finally, the result aggregation unit writes the constructed anomaly risk list containing risk level labels into the data storage and management module and triggers the root cause analysis agent.

[0095] This invention provides a root cause analysis agent, which serves as the correlation analysis logic component of an end-to-end automated auditing system. After the anomaly identification agent identifies abnormal data, it performs graph traversal and topology calculation based on knowledge graph technology.

[0096] The root cause analysis agent comprises a graph query unit, a path traversal unit, a pattern matching unit, and an interpretation generation unit. These units are constructed from computer program code and run in the server's processor environment.

[0097] The graph query unit establishes a mapping connection between abnormal data and the audit knowledge graph. It receives an abnormal risk list generated by the anomaly identification agent, extracts audit entity identifiers from the list (including unique supplier codes, employee IDs, or bank account numbers), and connects to the graph database in the audit data center via a data interface unit. Using the extracted audit entity identifiers as the central anchor point, the unit performs a K-hop neighbor query to retrieve all neighbor nodes and associated edges within a preset depth range, constructing a local relational subgraph.

[0098] The path traversal unit is used to perform multi-hop association analysis in local association subgraphs. It employs depth-first search or breadth-first search algorithms to track fund flow paths or equity control paths. The unit detects the existence of closed-loop structures within the paths, where funds flow from the starting entity node, pass through several intermediate entity nodes, and ultimately return to the starting entity node in a circular transfer pattern. Simultaneously, the unit detects attribute-sharing associations by comparing attribute values ​​of different nodes to identify non-directly connected node pairs that share the same physical address, contact number, or legal representative.

[0099] The pattern matching unit is used to determine the structural causes of anomalies. The unit loads a pre-set risk topology library containing known anomalous topology templates, corresponding to patterns such as "breaking down large transactions into smaller ones," "profit-sharing" related-party transactions, or "fake invoice" gang activities. The unit calculates the similarity between local related subgraphs and each anomalous topology template in the risk topology library. To quantify graph similarity, the unit counts the number of nodes with completely identical attributes and the number of edges with identical connections between the local related subgraphs and the anomalous topology templates. The unit calculates the percentage of identically matched nodes and edges, and then weights these percentages according to a pre-set weighting strategy to generate a graph pattern matching score. The unit identifies anomalous topology templates with a graph pattern matching score greater than a pre-set matching threshold as the root cause of the anomaly.

[0100] The interpretation and generation unit converts the graph analysis results into natural language descriptive text. It extracts the key paths identified by the path traversal unit and the abnormal topology template names determined by the pattern matching unit. The unit then calls a predefined text template, filling the corresponding slots with key node names, relationship types, and fund flow data to generate the root cause analysis report text.

[0101] The root cause analysis agent writes the analysis result package, which includes local correlation subgraph data and root cause analysis report text, into the data storage and management module, and sends a data ready signal to the audit result generation agent.

[0102] This invention provides an audit result generation intelligent agent, which serves as a document building component in an end-to-end automated audit system. This agent is used to compile structured analytical data and unstructured textual conclusions into standardized audit working papers or audit report documents that comply with auditing standards.

[0103] The audit result generation agent includes: a data aggregation unit, a visualization rendering unit, a document assembly unit, and a distribution management unit. These units are constructed from computer program code and run in the server's processor environment.

[0104] The data aggregation unit is configured to perform structured aggregation of multi-source results. Upon receiving a data-ready signal from the root cause analysis agent, the data aggregation unit retrieves the full audit result data associated with the current audit task ID from the data storage and management module. The full audit result data includes: task background information generated by the task understanding agent, statistical feature values ​​generated by the data analysis agent, an anomaly risk list generated by the anomaly identification agent, and the root cause analysis report text generated by the root cause analysis agent. The data aggregation unit maps the full audit result data to a unified intermediate data object. The intermediate data object uses a hierarchical tree structure to store text and numeric fields, with each field corresponding to a unique key.

[0105] The visualization rendering unit is used to convert numerical data into graphical objects. It reads statistical characteristic values ​​and anomaly distribution data from intermediate data objects. The unit then calls the graphics rendering engine and generates corresponding visualization charts based on preset chart configuration parameters. These charts include line charts displaying capital trends, pie charts showing the proportion of anomalies, and snapshots of local knowledge graphs showing relationships. The unit converts the generated visualization charts into binary data streams in bitmap or vector format and injects these binary data streams into the corresponding chart nodes of the intermediate data objects.

[0106] The document assembly unit generates the final delivery document. Based on the audit intent category of the audit task, the unit loads the corresponding standard report template file from the template library. The standard report template file contains a fixed document structure, format style definitions, and pre-defined dynamic content placeholders. These dynamic content placeholders are enclosed in pre-defined special delimiters (such as double curly braces or angle brackets). The document assembly unit iterates through the standard report template file, parsing the identifiers within the dynamic content placeholders. Using the identifiers as indexes, the unit searches for the corresponding key-value pairs in intermediate data objects. The unit then replaces the dynamic content placeholders in the standard report template file with the matched text content or binary data stream. Finally, the unit performs document format rendering, generating an audit report file in PDF, Word, or HTML format.

[0107] The distribution management unit executes the report archiving and notification process. It stores the generated audit report file in the document management partition of the data storage and management module and generates a unique access link pointing to the audit report file's storage path. The distribution management unit updates the status of the current audit task to "completed." It then sends a task completion notification signal to the user terminal through the data interface unit; this notification signal includes the unique access link to the audit report file.

[0108] This invention provides a rectification tracking intelligent agent, which serves as a feedback processing component of an end-to-end automated audit system. It is used to monitor the rectification implementation of audit issues and evaluate the effectiveness of the rectification results.

[0109] The rectification tracking intelligent agent mainly includes: a task dispatch unit, a feedback collection unit, a performance verification unit, and a status management unit. These units are constructed from computer program instructions, stored in the server's memory, and executed by the processor.

[0110] The task dispatch unit is used to convert the list of abnormal risks into rectification work orders. The task dispatch unit receives the final audit report data confirmed by the audit result generation agent. The task dispatch unit parses the final audit report data, extracting the unique identifier of the abnormal record, the responsible department code, and the suggested rectification deadline. The task dispatch unit generates a rectification work order based on a preset work order template. The rectification work order includes a problem description field, a rectification requirement field, and a timestamp parameter. The task dispatch unit sends the rectification work order notification to the corresponding responsible person's account in the audited entity's information system via a message interface.

[0111] The feedback collection unit manages the submission process of rectification evidence data. It provides a standardized data upload interface. The unit receives rectification feedback data packages submitted by responsible parties through this interface. These packages include rectification description text, credential image files, and snapshots of the rectified business data. The unit performs a hash calculation on the rectification feedback data package to generate a digital fingerprint and adds a timestamp indicating the time of receipt. Finally, the unit associates the rectification feedback data package with the corresponding rectification work order to ensure the integrity of the evidence data.

[0112] The performance verification unit is used to perform data-driven review of rectification effectiveness. To achieve automated regression testing, the performance verification unit reads the original anomaly rule scripts or original algorithm model files associated with the rectification work order. The performance verification unit extracts entity feature dimensions from the original anomaly records, including organization code, transaction type code, and business scenario identifier. Based on these entity feature dimensions, the performance verification unit locates and extracts the subset of data to be verified from the post-rectification business data snapshot received by the feedback collection unit, or from the newly added data partitions in the data storage and management module.

[0113] The performance verification unit calls the original anomaly rule script or original algorithm model file, performs calculations on the subset of data to be verified, and generates a review risk value. The performance verification unit compares the initial risk value before rectification with the review risk value, and calculates the decrease or change rate of the risk value.

[0114] The status management unit is used to determine the progress of rectification work orders. It compares the decrease or change rate calculated by the performance verification unit with a preset compliance acceptance threshold. When the decrease or change rate meets the compliance acceptance threshold, the status management unit determines the rectification is effective, marks the rectification work order as "closed," and archives the rectification record. When the decrease or change rate does not meet the compliance acceptance threshold, the status management unit determines the rectification is substandard, marks the rectification work order as "secondary rectification," and returns the review results to the task dispatch unit, triggering a new round of rectification notification process.

[0115] This invention provides an electronic device configured to perform the aforementioned end-to-end automated audit process. The electronic device can be a server, server cluster, cloud computing node, or high-performance workstation.

[0116] Electronic devices include: processors, memory, communication interfaces, connection buses, and input / output interfaces. The processor, memory, communication interfaces, and input / output interfaces communicate and exchange electrical signals with each other via the connection bus.

[0117] A processor, as the arithmetic and control component of an electronic device, is configured to execute computer program instructions. A processor can be a central processing unit (CPU), graphics processing unit (GPU), tensor processor, field-programmable gate array (FPGA), or application-specific integrated circuit (ASIC). Processors perform statistical computation tasks in data analysis agents, machine learning inference tasks in anomaly detection agents, and graph traversal computation tasks in root cause analysis agents.

[0118] Memory is used to store computer-executable instructions and non-volatile data. Memory includes high-speed random access memory and non-volatile memory. Memory stores the operating system and program code for the end-to-end automated auditing system. Specifically, the memory is divided into a program storage area and a data storage area. The program code stored in the program storage area corresponds to the functional logic of the task understanding agent, data analysis agent, anomaly detection agent, root cause analysis agent, audit result generation agent, and rectification tracking agent.

[0119] The communication interface is used to enable data interaction between electronic devices and the external network environment. The communication interface is either a wired network interface card or a wireless network adapter. Electronic devices establish network connections with the audit data center, the audited entity's information system, and user terminals through the communication interface. The communication interface receives raw business data streams and sends generated audit report files and rectification work order notifications.

[0120] Input / output interfaces are used to connect external display devices and input devices. They transmit the graphical interface signals generated by the processor to the external display device and receive control commands from the keyboard or mouse.

[0121] The interconnect bus is used to transmit address signals, data signals, and control signals between processors, memory, communication interfaces, and input / output interfaces. The interconnect bus adopts an industry-standard architecture, peripheral component interconnection standards, or high-speed serial bus standards.

[0122] When the electronic device is running, the processor reads and executes the program code of the end-to-end automated audit system from memory, enabling the electronic device to perform the following operations: parse the audit task description in natural language to generate a structured task configuration file; extract and clean business data from the auditee's information system; identify abnormal risk items using preset rules and machine learning algorithms; analyze the association paths of abnormal risk items based on knowledge graph technology; generate audit report documents containing visual charts; and monitor feedback data from rectification work orders and calculate the risk reduction rate.

[0123] This invention provides a non-volatile computer-readable storage medium storing computer program instructions. When the computer program instructions are executed by the processor of an electronic device, the electronic device performs the steps included in the aforementioned end-to-end automated auditing process.

[0124] Non-volatile computer-readable storage media include: read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, flash memory, magnetic hard disk drive, or solid-state drive. Specifically, non-volatile computer-readable storage media store functional logic code corresponding to task understanding agents, data analysis agents, anomaly detection agents, root cause analysis agents, audit result generation agents, and rectification tracking agents.

[0125] This invention also provides a computer program product for an end-to-end automated auditing system based on intelligent agent collaboration. The computer program product includes computer program instructions encoded in a non-volatile computer-readable storage medium.

[0126] Regarding the system's deployment architecture, the end-to-end automated audit system adopts a distributed microservice architecture. The system runs on a server cluster consisting of multiple server nodes. The server cluster uses containerization technology, encapsulating the task understanding agent, data analysis agent, anomaly detection agent, root cause analysis agent, audit result generation agent, and rectification tracking agent into independent container instances.

[0127] The server cluster is configured with a service registry and discovery center and a load balancing component. The service registry and discovery center maintains the running status and network addresses of each container instance. The load balancing component receives external requests and distributes them to different container instances based on either a round-robin algorithm or a least connections algorithm.

[0128] Container instances communicate with each other via Remote Procedure Call (RPC) protocols or message queues. Data analysis and anomaly detection agents are deployed on compute-intensive server nodes equipped with graphics processing unit (GPU) accelerators to perform parallel matrix operations and deep learning inference tasks. Task understanding and audit result generation agents are deployed on I / O-intensive server nodes equipped with high-throughput solid-state drives (SSDs) to handle read / write requests generated by text parsing and document rendering.

[0129] The data storage and management module is deployed as an independent data service layer. It uses a distributed file system to store unstructured document data and a graph database cluster to store knowledge graph data. The module is configured with a multi-replica redundancy strategy, which involves synchronously writing data copies to server nodes on different physical racks to ensure the persistence and disaster recovery capabilities of audit data. User terminals access the service interfaces provided by the end-to-end automated audit process via the Hypertext Transfer Protocol.

[0130] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An end-to-end automated auditing system based on agent collaboration, characterized in that, include: Central dispatching intelligent agent, task understanding intelligent agent, data analysis intelligent agent, anomaly detection intelligent agent, root cause analysis intelligent agent, audit result generation intelligent agent, rectification tracking intelligent agent, and audit context management module; The task understanding agent is used to parse audit task-related information and generate a structured task description. The data analysis agent is used to perform analysis and processing on audit business data based on the structured task description, and generate statistical feature values; The anomaly detection agent is used to identify anomalies or risks in the analysis results. The root cause analysis agent is used to perform cause analysis on the identified anomalies; The audit result generating agent is used to generate audit conclusions or audit reports; The aforementioned rectification tracking agent is used to issue rectification notices when the expected results are not achieved; to report rectification progress regularly during the rectification period; and to conduct audit result evaluation after rectification is completed. The audit context management module is used to uniformly store and maintain the task status, analysis results and intermediate results generated during the audit process; Under the unified coordination of the central scheduling agent, each agent completes the audit task based on the information stored in the audit context management module. The execution results of each agent are written into the audit context in a structured form and serve as the input basis for subsequent agent execution.

2. The system according to claim 1, characterized in that, The central scheduling agent determines the execution order or parallel mode of the agent based on at least one of the following factors: audit task dependencies, audit context state, preset priority level rules or weight parameters; During the audit execution process, the central dispatching agent triggers at least one agent to execute again or supplement the execution based on the updated audit context information.

3. The system according to claim 1, characterized in that, The task understanding agent is used to parse the audit task description in natural language form and extract the audit object, audit scope, audit focus or audit constraints.

4. The system according to claim 1, characterized in that, The data analysis agent is used to perform statistical analysis, management analysis, or model analysis on structured data, semi-structured data, or a combination thereof.

5. The system according to claim 1, characterized in that, The anomaly detection agent identifies anomalies or risks in the analysis results based on preset rules, historical models, or statistics.

6. The system according to claim 1, characterized in that, The root cause analysis agent performs reasoning analysis on the causes of anomalies based on anomaly identification results and combined with historical data or business rules in the audit context.

7. The system according to claim 1, characterized in that, The audit context management module is used to provide each agent with an access interface for context information corresponding to the current audit stage, and supports phased backtracking of the audit process.

8. The system according to claim 1, characterized in that, The audit result generation agent generates audit conclusions or audit reports based on the analysis results in the audit context and according to preset generation rules or templates. When the analysis results meet the abnormal conditions, the anomaly identification agent and the root cause analysis agent are scheduled to perform anomaly identification and root cause analysis.

9. The system according to claim 1, characterized in that, Includes the following steps; Step 1: Receive the audited object's data and initialize the audit context; Step 2: The task understanding agent parses the audit task information; Step 3: The central scheduling agent schedules at least one agent to perform audit analysis based on the audit context; Step 4: Obtain the analysis results and update the audit context; Step 5: Generate audit conclusions or audit reports based on the updated audit context; Between steps three and five, at least one agent is triggered to execute again based on the analysis results in the audit context; Each step includes a human interaction interface, which is used to preset audit nodes to confirm, correct or supplement the information in the audit context.

10. The system or method according to any one of claims 1 to 9, characterized in that, The intelligent agent is implemented in the form of a software module, a service unit, or a combination thereof.

Images