An audit risk early warning system based on three-mode verification and agent cooperation

Abstract

The present application relates to the technical field of financial audit, and discloses an audit risk early warning system based on three-mode verification and agent cooperation, which comprises a data access layer, a feature extraction layer, an entity feature verification and monitoring layer, a triangular logic judgment algorithm, a risk prompt, an adaptive abnormality monitoring algorithm, an agent cooperation layer, an application interaction layer, and an audit report download interface. The present application can accurately capture hidden financial problems that are hidden by splitting orders and rounding up in an unsupervised manner, thereby reducing the false negative rate.

Description

Technical Field

[0001] This invention relates to the field of financial auditing technology, and more specifically, to an audit risk early warning system based on trimodal verification and intelligent agent collaboration. Background Technology

[0002] As enterprises deepen their digital transformation, the amount of data from audit targets is growing exponentially, exhibiting significant multi-source and heterogeneous characteristics. Financial auditing is no longer limited to verifying structured accounts; it also requires cross-validation of massive amounts of unstructured data. However, existing intelligent auditing technologies mostly focus on automating single processes, making it difficult to address complex and multifaceted financial issues that are often concealed.

[0003] Current technologies cannot overcome the modal barriers between visual (invoice images), semantic (contract text), and numerical (ERP entries) data. For example, existing systems cannot automatically verify whether the payment terms stipulated in the contract match the actual financial recording time, nor can they detect dual contracts (one for genuine invoices and one for fraudulent business contracts), making it difficult to identify logical problems caused by semantic separation between unstructured vouchers and structured accounts. Statistical and machine learning methods are often derived in a simple sequential manner, lacking interaction and mapping between features, resulting in blind spots for single anomaly detection algorithms when dealing with manipulated data. The output of existing systems is unstructured; auditors cannot directly know which accounting principle the anomaly violates, nor can they quickly generate compliant audit working papers, leading to uninterpretable audit results and low efficiency in audit document generation.

[0004] For example, Chinese invention patent CN121071710A discloses an automated data cleaning and anomaly identification method for financial auditing, which includes extracting fields using regular expressions, repairing missing numerical data using LSTM, identifying abnormal transactions based on the isolated forest algorithm combined with business rules, constructing a risk assessment matrix to classify risk levels, and recording the audit evidence chain and storing it on the blockchain.

[0005] However, this solution primarily relies on regular expressions for field extraction, making it unable to understand the complex semantics of contract terms and difficult to detect logical risks arising from discrepancies between contract terms and actual execution. Although an isolated forest approach is introduced, its core judgment logic still heavily depends on manually set business thresholds, making it vulnerable to exploitation by fraudsters who test the boundaries of the rules.

[0006] For example, Chinese invention patent CN117745082A discloses a method, system, and device for monitoring abnormal financial data based on Benford's Law, including obtaining the probability of each first digit of the original financial data; dividing it into first financial data and second financial data; calculating the second result through the correlation coefficient to determine whether the original financial data conforms to Benford's Law; and calculating the KS value and cutoff value in the original financial data.

[0007] However, this approach focuses solely on the statistical regularities of the numbers themselves, completely ignoring the business context behind them. If fraudsters meticulously construct false data conforming to Benford's Law, the approach will be completely ineffective. It also lacks attribution capability. It can only tell auditors that some data is problematic, but it cannot pinpoint which invoice or contract is faulty, lacking micro-level evidence to support its claims.

[0008] For example, the publication number CN120220158A discloses a method and system for early warning and management of procurement kickback risks based on multimodal intelligent auditing, as well as electronic devices and computer-readable storage media, which includes parsing invoice images; generating multimodal consistency difference values ​​to determine the authenticity of invoices; constructing time-series subgraphs; using a time-series risk scoring model to verify risks and implement disposal strategies.

[0009] However, the CLIP application of this solution primarily addresses the consistency between invoice images and text, i.e., the authenticity of the invoice itself. It fails to resolve cross-document business logic consistency checks between invoices, contracts, and accounts. For example, the invoice might be genuine, but the contract is fake, or the account period might be incorrect.

[0010] No effective solutions have yet been proposed to address the problems in the relevant technologies. Summary of the Invention

[0011] To address the problems in related technologies, this invention proposes an audit risk early warning system based on trimodal verification and agent collaboration, in order to overcome the aforementioned technical problems existing in the existing related technologies.

[0012] Therefore, the specific technical solution adopted by the present invention is as follows:

[0013] An audit risk early warning system based on trimodal verification and agent collaboration includes:

[0014] The data access layer is used to extract features from invoice images, purchase contracts and ERP entries in the audit target using the recognition model to obtain entity features, which include visual features, semantic features and numerical features.

[0015] The verification and monitoring layer receives entity feature data from the data access layer and uses a triangular logic judgment algorithm to perform multimodal verification on the entity features to obtain risk warnings. It uses an adaptive anomaly monitoring algorithm to monitor the audit target, identify modified data and generate an abnormal clue list, and dynamically provides task prompt words through the RAG generation engine.

[0016] The intelligent agent collaboration layer, connected to the verification and monitoring layer, is used to complete the features of entity features using a reconnaissance intelligent agent based on the list of abnormal clues and task prompts, perform multi-hop reasoning on the audit target using a reasoning intelligent agent to obtain audit conclusions, and perform clause mapping on the audit conclusions using a document intelligent agent to obtain an audit report.

[0017] The application interaction layer interacts with the intelligent agent collaboration layer to form a visual view based on the audit report and risk warning using the audit early warning dashboard;

[0018] The data access layer, verification and monitoring layer, intelligent agent collaboration layer, and application interaction layer form a closed loop to achieve risk warning for financial auditing.

[0019] Preferably, the data access layer includes:

[0020] The visual feature extraction unit is used to extract key-value pairs from the invoice image using a preset OCR model to obtain visual features;

[0021] The semantic feature extraction unit is used to extract clause entities from the procurement contract using the named entity recognition model to obtain semantic features.

[0022] The numerical feature extraction unit is used to call up structured financial data in real time and convert it into JSON format to extract numerical features including voucher number, posting date, debit amount and summary fields.

[0023] Preferably, the verification monitoring layer includes:

[0024] The mapping table unit is used to obtain the original field names in the entity features, process the original field names to obtain the original field vectors, and construct the mapping relationship table using the vector similarity retrieval method.

[0025] The triangulation verification unit is used to perform numerical verification, temporal verification, and consistency verification on entity features, and to provide risk warnings based on the verification results and risk level.

[0026] The anomaly monitoring unit is used to obtain the transaction amount set of the audit target, calculate the Benford deviation factor corresponding to the transaction amount set, use the Benford deviation factor as a prior parameter to correct the anomaly evaluation model based on the isolation forest, use the corrected anomaly evaluation model to monitor and analyze the transaction amount set, identify the corrected data and generate an anomaly clue list.

[0027] The RAG generation unit is used to acquire trigger signals and generate structured task prompts based on a preset audit knowledge base and prompt word templates.

[0028] Preferably, the mapping table unit includes:

[0029] The field acquisition module is used to obtain the original field names of visual features, semantic features, and numerical features;

[0030] The field processing module is used to clean and segment the original field names to obtain standardized field names;

[0031] The field vector module is used to calculate standardized field names using a pre-defined FinBERT model to obtain the original field vector;

[0032] The similarity calculation module is used to calculate the cosine similarity between the original field vector and the standard vector in the standard audit field vector library in real time, based on a pre-configured standard audit field vector library.

[0033] The mapping determination module is used to determine the mapping table based on cosine similarity and a preset threshold strategy.

[0034] Preferably, the triangulation verification unit includes:

[0035] The numerical verification module is used to calculate the absolute difference between visual features and numerical features. It uses a preset threshold judgment method to judge the absolute difference. If the absolute difference exceeds the preset threshold, it provides a risk warning of discrepancy in amount.

[0036] The time-series verification module, based on a mapping table, extracts time nodes from visual, semantic, and numerical features, respectively, after field alignment and time format normalization. It then verifies these time nodes using preset business time-series rules and provides corresponding risk warnings based on the risk level and verification results.

[0037] The entity consistency verification module is used to obtain entity vectors of invoice images, purchase contracts and goods images using a preset retrieval model, calculate the semantic distance between entity vectors using the cosine similarity formula to obtain a similarity score, compare the similarity score with a preset threshold, and provide a risk warning if the similarity score is lower than the threshold.

[0038] Preferably, the anomaly monitoring unit includes:

[0039] The deviation calculation module is used to obtain the set of transaction amounts of the audit target during the audit period, extract the first significant digit of each amount element in the transaction amount set, count the actual distribution frequency of the first digit, and compare the actual distribution frequency with the theoretical distribution frequency corresponding to Benford's Law to calculate the Benford deviation factor.

[0040] The correction module is used to dynamically correct the anomaly evaluation model based on the isolation forest by using the Benford deviation factor as a prior parameter, so as to obtain the corrected anomaly evaluation model.

[0041] The anomaly detection module is used to detect anomalies in the transaction amount set using the modified anomaly evaluation model, identify abnormal transaction behaviors, and generate an anomaly clue list based on the abnormal transaction behaviors.

[0042] Preferably, the RAG generation unit includes:

[0043] The knowledge base encoding module is used to encode knowledge fragments within a pre-built audit knowledge base to obtain semantic vectors;

[0044] The retrieval module is used to encode and process the received trigger signal to obtain a query vector, and then use the query vector to perform a similarity search on the audit knowledge base to obtain related knowledge fragments.

[0045] The generation module is used to concatenate related knowledge fragments with the current task context and combine them with preset prompt word templates to generate structured task prompt words using a large language model.

[0046] The communication module is used for asynchronous communication via a message bus and for distributing task prompts in conjunction with trigger signals.

[0047] Preferably, the intelligent agent collaboration layer includes:

[0048] The investigation unit is used to call the completion tool to complete the features of entities based on the list of abnormal clues and task prompts, obtain the corresponding heterogeneous evidence fragments, and encapsulate the heterogeneous evidence fragments into an initial evidence package.

[0049] The reasoning unit is used to decompose the audit target using a reasoning agent, obtain interconnected logical nodes, and perform multi-hop reasoning based on the logical nodes to obtain audit conclusions.

[0050] The document unit is used to map the audit conclusions and legal provisions based on the initial evidence package and audit conclusions, combined with a preset retrieval model, to obtain the audit report.

[0051] Preferably, the inference unit includes:

[0052] The initial suspicion module is used to generate an initial suspicion path for the audit target based on task prompts, and to perform preliminary thinking steps on the audit matters according to preset audit rules;

[0053] The context extension analysis module is used to trigger the context extension thinking step based on the initial thinking step, and to perform background analysis and historical transaction distribution analysis on the related entities of the audit matter;

[0054] The conflict semantic fusion module is used to perform logical collision analysis on evidence with abnormal correlations or semantic conflicts based on the analysis results, and to obtain audit conclusions.

[0055] Preferably, the document unit includes:

[0056] The evidence anchoring module is used to construct an evidence anchoring set based on the initial evidence package and audit conclusions;

[0057] The regulatory vector retrieval module is used to transform the evidence anchor set into evidence vectors using a retrieval model, retrieve the regulatory vectors using a pre-set audit regulatory vector database, calculate the semantic similarity between the regulatory vectors and the evidence vectors, and obtain the legal and regulatory provisions corresponding to the evidence anchor set.

[0058] The instruction construction module is used to generate standardized task instructions based on task prompts, preset templates, evidence anchoring sets, and legal provisions.

[0059] The report generation module is used to generate audit reports according to task instructions, and to establish source representations or hyperlinks for the cited legal and regulatory provisions in the audit reports.

[0060] The beneficial effects of this invention are as follows:

[0061] 1. A three-modal consistency verification mechanism based on visual features of invoices, semantic features of contracts, and financial features of accounts was constructed, which solved the problem of identifying logical problems across documents and achieved a leap from single-point anti-counterfeiting to full-chain compliance verification.

[0062] 2. A multi-agent collaborative architecture is introduced. Utilizing thought chain technology, a system similar to that of human experts is constructed that dynamically adjusts detection strategies based on clues, rather than mechanically executing preset rules. Through the autonomous planning capabilities of the agents, adaptive deep penetration into complex financial problem scenarios is achieved. Hidden logical loopholes can be discovered through logical reasoning without the need to pre-build complex knowledge graphs.

[0063] 3. An independent RAG generation engine was constructed as a shared algorithm resource for the core algorithm layer. Through the retrieval-enhanced generation mechanism, the dynamic injection of audit knowledge and the precise driving of intelligent agent tasks are realized. This solves the problem that traditional fixed prompt words cannot adapt to complex and ever-changing audit scenarios and improves the task execution flexibility of intelligent agents.

[0064] 4. An automated audit report generation method based on evidence anchoring and retrieval enhancement technologies was constructed. A large language model was used to semantically align risk clues discovered during verification with accounting standards, generating an audit report that includes facts of violations, qualitative basis, and rectification recommendations.

[0065] 5. The deviation factor of the numerical distribution calculated by Benford's Law is used as a prior weight and dynamically injected into the construction process of the Isolation Forest algorithm, solving the problem of insufficient sensitivity of the traditional Isolation Forest algorithm to data manipulation. By introducing statistical priors, the system can accurately capture hidden financial problems that are concealed by splitting orders and rounding up in an unsupervised manner, thereby reducing the underreporting rate. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is an overall architecture diagram of an audit risk early warning system based on trimodal verification and intelligent agent collaboration according to an embodiment of the present invention;

[0068] Figure 2 This is a flowchart of a triangulation judgment verification unit in an audit risk early warning system based on trimodal verification and intelligent agent collaboration according to an embodiment of the present invention;

[0069] Figure 3 This is a flowchart of the audit report generation process in an audit risk early warning system based on trimodal verification and intelligent agent collaboration according to an embodiment of the present invention. Detailed Implementation

[0070] To further illustrate the various embodiments, the present invention provides accompanying drawings, which are part of the disclosure of the present invention. These drawings are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementation methods and the advantages of the present invention. The components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0071] According to an embodiment of the present invention, an audit risk early warning system based on trimodal verification and agent collaboration is provided.

[0072] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments, such as... Figure 1 As shown, an audit risk early warning system based on trimodal verification and agent collaboration according to an embodiment of the present invention includes:

[0073] The data access layer is used to extract features from invoice images, purchase contracts and ERP entries in the audit target using the recognition model to obtain entity features, which include visual features, semantic features and numerical features.

[0074] In a preferred embodiment, the data access layer includes:

[0075] The visual feature extraction unit is used to extract key-value pairs from the invoice image using a preset OCR model to obtain visual features;

[0076] It should be noted that the visual feature extraction unit also receives photos of goods entering the warehouse uploaded by the enterprise's logistics or warehousing system, and uses a large language model to identify the names of the goods in the pictures as visual evidence from the physical side.

[0077] The semantic feature extraction unit is used to extract clause entities from the procurement contract using the named entity recognition model to obtain semantic features.

[0078] The numerical feature extraction unit is used to call up structured financial data in real time and convert it into JSON format to extract numerical features including voucher number, posting date, debit amount, and summary fields. Among them, ERP entries refer to the structured accounting entries used in the Enterprise Resource Planning (ERP) system to record each economic transaction, including elements such as voucher number, posting date, debit / credit direction, transaction amount, and transaction summary.

[0079] Specifically, firstly, an OCR model is used to extract key key-value pairs from the invoice image to obtain visual features V. img :

[0080] ;

[0081] In the formula, For invoice codes, The date on which the invoice was issued. Name of goods or taxable services This is the total amount including tax.

[0082] Secondly, the BIO method is used to label the data, and the labeled data is used to train the named entity recognition model (pre-trained BERT-BiLSTM-CRF). The procurement contract is input into the named entity recognition model to extract key clause entities and obtain semantic features V. txt :

[0083] ;

[0084] In the formula, For contract number, As a condition of delivery, The contract signing date, Payment terms.

[0085] It should be noted that, It is an API based on a large language model that parses payment terms in procurement contracts into structured rules, such as: payment within 30 days of signing.

[0086] Finally, extract the numerical feature V from the ERP entries. erp :

[0087] ;

[0088] In the formula, For voucher number, For the accounting date, For the summary field, This refers to the amount incurred on the debit side.

[0089] It should be further explained that the API interface connects to the enterprise's ERP management system, accessing structured financial data in real time. The data is uniformly converted to JSON format. ERP entries refer to structured accounting entries in the Enterprise Resource Planning (ERP) system used to record each economic transaction, including elements such as voucher number, posting date, debit amount, and summary field. OCR deployment uses a DBNet (Differentiable Binarization Network) text detection model and a CRNN (Convolutional Recurrent Neural Network) character recognition model. NLP semantic units are deployed using a BERT-BiLSTM-CRF-based named entity recognition model to process unstructured text data such as purchase contracts, meeting minutes, and audit regulations.

[0090] The verification and monitoring layer receives entity feature data from the data access layer, uses a triangular logic judgment algorithm to perform multimodal verification on entity features, obtains risk warnings, uses an adaptive anomaly monitoring algorithm to monitor audit targets, identifies modified data and generates an abnormal clue list, and dynamically provides task prompt words through the RAG generation engine.

[0091] It should be noted that the verification and monitoring layer is... Figure 1 The core algorithm layer in the process.

[0092] In a preferred embodiment, the verification monitoring layer includes:

[0093] The mapping table unit is used to obtain the original field names in the entity features, process the original field names to obtain the original field vectors, and construct the mapping relationship table using the vector similarity retrieval method.

[0094] The triangulation verification unit is used to perform numerical verification, temporal verification, and consistency verification on entity features, and to provide risk warnings based on the verification results and risk level.

[0095] The anomaly monitoring unit is used to obtain the transaction amount set of the audit target, calculate the Benford deviation factor corresponding to the transaction amount set, use the Benford deviation factor as a prior parameter to correct the anomaly evaluation model based on the isolation forest, use the corrected anomaly evaluation model to monitor and analyze the transaction amount set, identify the corrected data and generate an anomaly clue list.

[0096] The RAG generation unit is used to acquire trigger signals and generate structured task prompts based on a preset audit knowledge base and prompt word templates.

[0097] In a preferred embodiment, the mapping table unit includes:

[0098] The field acquisition module is used to obtain the original field names of visual features, semantic features, and numerical features;

[0099] The field processing module is used to clean and segment the original field names to obtain standardized field names;

[0100] The field vector module is used to calculate standardized field names using a pre-defined FinBERT model to obtain the original field vector;

[0101] The similarity calculation module is used to calculate the cosine similarity between the original field vector and the standard vector in the standard audit field vector library in real time, based on a pre-configured standard audit field vector library.

[0102] The mapping determination module is used to determine the mapping table based on cosine similarity and a preset threshold strategy.

[0103] Specifically, the FinBERT pre-trained model, which has been adjusted based on a large-scale corpus in the financial field, is used as a base. The pre-trained model is trained using the masked language model task to enhance the model's semantic understanding of specific audit terms such as lending direction and customer codes.

[0104] Obtain the original field names of visual features, semantic features, and numerical features, and clean and segment the original field names (e.g., using jieba) to obtain standardized field names. Input these standardized field names into the trained FinBERT model to obtain the output of the last hidden layer. Then, use an average pooling strategy to calculate the mean of all token output vectors to obtain the original field vector.

[0105] Furthermore, vector similarity retrieval is used to dynamically construct and adapt mapping relationships. Internally, the system maintains a standard audit field vector library based on the Faiss index, and calculates the cosine similarity between newly added original field vectors and the standard vectors in real time. The expression for this cosine similarity is:

[0106] ;

[0107] In the formula, For the original field vector, For standard audit field vectors, Scoring the cosine similarity. For vectors And the magnitude of vector y.

[0108] The similarity score is determined according to a hierarchical strategy. In this embodiment, the preferred strategy is:

[0109] Fields with scores higher than 0.9 are automatically mapped, while those with scores between 0.7 and 0.9 are automatically pushed to a manual composite queue.

[0110] Furthermore, this invention incorporates an incremental learning mechanism, using manually corrected field mapping pairs by auditors as positive sample pairs, and constructing comparative learning training data based on these pairs; for each confirmed mapping relationship... The system uses this pairing as a positive sample, while simultaneously sampling fields from a standard field library that do not match 'a' to form a negative sample set. It utilizes FinBERT as the encoder to map field text into semantic vector representations and constructs a contrastive learning objective function by maximizing the similarity between positive sample pairs and minimizing their similarity to negative samples. In its implementation, all parameters at the bottom layer of FinBERT are frozen, and only the parameters of the top-level Transformer layer are updated for fine-tuning. A periodic incremental training strategy is employed to avoid overfitting and catastrophic forgetting.

[0111] In a preferred embodiment, the triangulation verification unit includes:

[0112] The numerical verification module is used to calculate the absolute difference between visual features and numerical features. It uses a preset threshold judgment method to judge the absolute difference. If the absolute difference exceeds the preset threshold, it provides a risk warning of discrepancy in amount.

[0113] The time sequence verification module is used to extract time nodes from visual features, semantic features and numerical features based on the mapping table, respectively after field alignment and time format normalization, to verify the time nodes using preset business time sequence rules, and to provide corresponding risk warnings based on the risk level and verification results.

[0114] The entity consistency verification module is used to obtain entity vectors of invoice images, purchase contracts and goods images using a preset retrieval model, calculate the semantic distance between entity vectors using the cosine similarity formula to obtain a similarity score, compare the similarity score with a preset threshold, and provide a risk warning if the similarity score is lower than the threshold.

[0115] It should be noted that the triangular logic decision algorithm in this invention refers to a comprehensive decision mechanism composed of three types of decision logic: numerical verification, timing verification, and consistency verification.

[0116] Specifically, such as Figure 2 As shown, the total amount including tax is read from the visual features of the invoice. Debit entries in ERP numerical characteristics The system calculates the absolute difference between the two values ​​and compares it with a preset tolerance threshold. If the absolute difference exceeds the tolerance threshold, a risk warning is provided indicating that the transaction amount is inconsistent with the actual amount.

[0117] It should be noted that the tolerance threshold is not a fixed constant. It adopts a combination of absolute and relative thresholds. On the one hand, a minimum absolute error threshold (preferably 0.1 in this embodiment) is set to tolerate rounding and OCR recognition errors. On the other hand, a relative error ratio threshold (preferably 0.1% of the transaction amount in this embodiment) is set. The larger value between the minimum absolute error threshold and the relative error ratio threshold is used as the actual tolerance threshold.

[0118] Furthermore, the key time nodes after mapping (i.e., contract signing date, invoice issuance date, actual financial payment date, and contractually agreed payment deadline) are extracted, and the contract signing date, invoice issuance date, actual financial payment date, and contractually agreed payment deadline are verified using a preset business sequence. The expression for this business sequence is as follows:

[0119] ;

[0120] In the formula, The contract signing date, The date of invoice issuance. The actual date of financial payment. The payment deadline stipulated in the contract.

[0121] Risk warnings are provided based on the risk level, specifically:

[0122] If the actual payment date is earlier than the invoice issuance date ( If this occurs, a "payment before invoice" risk warning will be generated.

[0123] If the actual payment date is earlier than the contract signing date ( If so, a compliance warning for "payment without contract" will be generated;

[0124] If the actual payment date is later than the agreed deadline ( If the payment is overdue, it is marked as "overdue payment" or a potential risk of misappropriation of funds.

[0125] Using the Roberta model, the entity vector of the goods name (Item) is obtained from the invoice image. img ), the entity vector of the goods name extracted from the purchase contract (Item) txt The text discusses various topics, including: identifying the names of goods images using a large language model; encoding goods images using the Roberta model to obtain semantic vectors for goods entities (Items). act ).

[0126] Among them, the cosine similarity formula is used to calculate the pairwise similarity of items. img Item txt and Item act The semantic distance is calculated as follows:

[0127] ;

[0128] ;

[0129] ;

[0130] In the formula, Scoring the cosine similarity. This is the entity vector of the goods name in the invoice image. This is the entity vector for the goods name in the contract. For cargo entity semantic vectors, For vectors sum vector The model, For vectors sum vector The model, For vectors sum vector The model.

[0131] The calculated similarity score is compared with a preset threshold. In this embodiment, the preferred threshold is 0.75, with a range of [0.7, 0.85]. The tolerance for semantic similarity can be adjusted according to the business scenario. If the similarity score is lower than the preset threshold, it indicates that there is a significant semantic conflict between the goods listed on the invoice and the services agreed in the contract. Such transactions are judged as mismatched goods and the risk level is raised to high risk. Auditors are prompted to focus on verifying whether there is any behavior of obtaining funds by purchasing physical goods and falsely listing service fees.

[0132] It should be noted that the Roberta model is a robust pre-trained language model that is deeply optimized based on the BERT model by increasing the amount of training data, extending the training time, removing the next sentence prediction (NSP) task, and adopting dynamic masking.

[0133] In a preferred embodiment, the anomaly monitoring unit includes:

[0134] The deviation calculation module is used to obtain the set of transaction amounts of the audit target during the audit period, extract the first significant digit of each amount element in the transaction amount set, count the actual distribution frequency of the first digit, and compare the actual distribution frequency with the theoretical distribution frequency corresponding to Benford's Law to calculate the Benford deviation factor.

[0135] The correction module is used to dynamically correct the anomaly evaluation model based on the isolation forest by using the Benford deviation factor as a prior parameter, so as to obtain the corrected anomaly evaluation model.

[0136] The anomaly detection module is used to detect anomalies in the transaction amount set using the modified anomaly evaluation model, identify abnormal transaction behaviors, and generate an anomaly clue list based on the abnormal transaction behaviors.

[0137] Specifically, first, extract the total transaction amount set of the target entity during the audit period: Extract the first significant digit of each monetary element in the set, and calculate the first significant digit. The actual distribution frequency is compared with the theoretical distribution frequency defined by Benford's Law. Finally, the Benford deviation factor is calculated by calculating the chi-square statistic, and its calculation expression is as follows:

[0138] ;

[0139] In the formula, This is the Benford deviation factor, where d is the first significant digit. The actual distribution frequency of the first significant digit. The theoretical distribution frequency of the first significant digit.

[0140] The Benford deviation factor is used as a prior parameter to dynamically modify the anomaly assessment model based on isolation forest. It should be noted that the traditional isolation forest algorithm mainly measures the degree of anomaly by the ratio between the average path length h(x) of a sample in an isolation tree and the expected value c(n) of the average path length for a given sample size n. The anomaly assessment model based on isolation forest is based on the isolation forest algorithm proposed by Liu et al. in 2008. It recursively constructs multiple isolation trees by randomly selecting features and split values, and uses the average path length of a sample in an isolation tree to measure the degree of anomaly.

[0141] This invention, based on the isolated forest anomaly score formula, constructs an adaptive sensitivity adjustment mechanism according to the Benford deviation factor, the calculation expression of which is as follows:

[0142] ;

[0143] In the formula, E(h(x)) is the average path length of the sample x in the constructed isolated forest. The preset risk adjustment weighting coefficient, The hyperbolic tangent function is used to... Mapping to a normalized interval ensures gradient stability. c(n) is the expected average path length of the binary search tree when the sample size is n, and its calculation formula is c(n) = 2H(n-1) - 2(n-1) / n, where H(i) is the harmonic number. This is the Benford deviation factor. These are abnormal scores.

[0144] When the entire transaction amount set exhibits a high degree of deviation (i.e.) When the value is relatively large, the denominator in the above formula will decrease due to the influence of prior factors, thereby adaptively increasing the outlier scores of all sample points without changing the physical characteristics. This mechanism effectively solves the problem of insufficient ability of traditional algorithms to identify non-outlier financial problems. Even if the amount is split or small-amount high-frequency transactions are created to hide the abnormal transaction behavior in the normal data cluster in terms of spatial characteristics, the system can still automatically lower the judgment threshold and increase the detection sensitivity based on the prior characteristics of the set that violate statistical laws, thereby accurately capturing the modified abnormal transaction behavior.

[0145] Selecting outlier scores For transaction records exceeding the preset anomaly detection threshold Threshold, an anomaly clue list is generated. Threshold is the final anomaly detection threshold of the modified anomaly evaluation model. In this embodiment, Threshold is preferably 0.6, with a value range of [0.5, 0.7]. It can be dynamically adjusted according to the risk tolerance of the audit business. When the audit target is a high-risk industry, Threshold can be lowered to 0.5 to improve detection sensitivity; when the audit data scale is large and the false alarm tolerance is low, Threshold can be raised to 0.7 to reduce the false alarm rate.

[0146] In a preferred embodiment, the RAG generation unit includes:

[0147] The knowledge base encoding module is used to encode knowledge fragments within a pre-built audit knowledge base, obtain semantic vectors, and build an index for retrieval.

[0148] The retrieval module is used to encode and process the received trigger signal to obtain a query vector, and then use the query vector to perform a similarity search on the audit knowledge base to obtain related knowledge fragments.

[0149] The generation module is used to concatenate related knowledge fragments with the current task context and combine them with preset prompt word templates to generate structured task prompt words using a large language model.

[0150] The communication module is used for asynchronous communication via a message bus and for distributing task prompts in conjunction with trigger signals.

[0151] Specifically, the workflow of the RAG generation unit is as follows: First, select the corresponding prompt word template category according to the trigger event type; second, retrieve the top-k knowledge fragments that are most relevant to the semantics of the trigger event from the audit knowledge base (in this embodiment, k is preferably 5); then, semantically concatenate the knowledge fragments, the trigger event context, and the template; finally, generate standardized task prompt words through the large language model and distribute them to the corresponding intelligent agent through the message bus.

[0152] It should be noted that the audit knowledge base includes auditing standards, accounting regulations, industry business rules, and historical audit cases. The knowledge fragments in the knowledge base are encoded into semantic vectors using the Roberta model and indexed for retrieval using the Faiss index.

[0153] The trigger signal refers to the list of abnormal clues output by the verification and monitoring layer, the intermediate reasoning results generated by the agent collaboration layer, or the audit conclusion. When a trigger signal is received, the Top-k similarity retrieval method is used to search the audit knowledge base based on the signal content to obtain the knowledge fragments associated with the trigger signal.

[0154] The intelligent agent collaboration layer, connected to the verification and monitoring layer, is used to complete the features of entities based on the list of abnormal clues using a reconnaissance intelligent agent, perform multi-hop reasoning on the audit target using a reasoning intelligent agent to obtain audit conclusions, and perform clause mapping on the audit conclusions using a document intelligent agent to obtain an audit report.

[0155] It should be noted that the agents communicate asynchronously through a message bus and dynamically adjust the audit strategy based on the thought chain.

[0156] In a preferred embodiment, the agent collaboration layer includes:

[0157] The investigation unit is used to call the completion tool to complete the features of entities based on the list of abnormal clues and task prompts, obtain the corresponding heterogeneous evidence fragments, and encapsulate the heterogeneous evidence fragments into an initial evidence package.

[0158] The reasoning unit is used to decompose the audit target using a reasoning agent, obtain interconnected logical nodes, and perform multi-hop reasoning based on the logical nodes to obtain audit conclusions.

[0159] The document unit is used to map the audit conclusions and legal provisions based on the initial evidence package and audit conclusions, combined with a preset retrieval model, to obtain the audit report.

[0160] In a preferred embodiment, the inference unit includes:

[0161] The initial suspicion module is used to generate an initial suspicion path for the audit target based on task prompts, and to perform preliminary thinking steps on the audit matters according to preset audit rules;

[0162] The context extension analysis module is used to trigger the context extension thinking step based on the initial thinking step, and to perform background analysis and historical transaction distribution analysis on the related entities of the audit matter;

[0163] The conflict semantic fusion module is used to perform logical collision analysis on evidence with abnormal correlations or semantic conflicts based on the analysis results, and to obtain audit conclusions.

[0164] It should be noted that the task prompts are initial suspected path prompts constructed through the RAG generation unit.

[0165] In a preferred embodiment, the document unit includes:

[0166] The evidence anchoring module is used to construct an evidence anchoring set based on the initial evidence package and audit conclusions;

[0167] The regulatory vector retrieval module is used to transform the evidence anchor set into evidence vectors using a retrieval model, retrieve the regulatory vectors using a pre-set audit regulatory vector database, calculate the semantic similarity between the regulatory vectors and the evidence vectors, and obtain the legal and regulatory provisions corresponding to the evidence anchor set.

[0168] The prompt word construction module is used to generate standardized task instructions based on task prompt words, a preset template, an evidence anchoring set, and legal provisions.

[0169] The report generation module is used to generate audit reports according to task instructions, and to establish source representations or hyperlinks for the cited legal and regulatory provisions in the audit reports.

[0170] Specifically, the reconnaissance agent constructs a task description using prompt words based on the list of abnormal clues. In addition, unlike traditional fixed scripts, the reconnaissance agent has autonomous planning capabilities. It dynamically calls OCR visual tools or NLP semantic tools according to the warning type to complete the features of the relevant original contract text, supplementary agreement and invoice images.

[0171] For example, when an invoice amount is detected to be inconsistent with the ERP accounting amount, if the original ERP record only contains debit entries and lacks corresponding contract terms, the detection agent can further call an OCR tool to parse the invoice image and extract fields such as the total amount including tax, invoice date, and names of the buyer and seller; at the same time, it can call an NLP semantic tool to parse the contract text, identify key terms such as the total contract amount, payment terms, whether tax is included, and installment payment arrangements, and align the contract amount with the invoice amount through semantic matching.

[0172] During this process, if the field names are inconsistent, the synonym fields are unified through semantic embedding calculation. In addition, if the tax amount information is missing in the invoice but the tax rate is clearly stipulated in the contract, it can be inferred and supplemented based on the existing fields. The investigation agent will encapsulate the extracted heterogeneous evidence fragments into an initial evidence package and push it to the shared workspace.

[0173] The reasoning agent decomposes the audit target into a series of interconnected intermediate logical nodes and executes a multi-hop reasoning process.

[0174] For example, in the first stage, the reasoning agent generates an initial suspicion path driven by internal prompts. For instance, when dealing with large purchases, the agent first performs a "amount-permission comparison" thought step.

[0175] If the amount is found to be abnormally close to the approval threshold, the system does not directly output a conclusion. Instead, it automatically triggers the second-stage context expansion thinking step, instructing the investigation agent to trace the supplier's business background and historical transaction distribution.

[0176] In the third stage, the intelligent agent performs conflict semantic fusion, logically collisions the extracted evidence such as the supplier's registration time being too short and the project manager's phone number being the same, and derives a high-level audit conclusion that the company is suspected of setting up a shell company to embezzle funds based on the logical conflict points after the collision.

[0177] like Figure 3 As shown, after the reasoning agent completes the closed-loop deduction and locks in the audit conclusion, the document agent is responsible for receiving the key evidence anchors and intermediate logical processes generated in the reasoning chain, and mapping the audit conclusion with specific legal and regulatory provisions in combination with the Roberta model to obtain the audit report.

[0178] The specific steps are as follows:

[0179] First, the discrete clues from the investigation and reasoning agents are transformed into structured data objects with legal effect. The objective factual evidence extracted by the investigation agent (initial evidence package), the logical conflict points output by the reasoning agent, and the preliminary judgment of the violation type (audit conclusion) are associated and bound to form an evidence anchoring set.

[0180] Secondly, the Roberta model is used to transform the evidence anchor set into evidence vectors, and a Top-k search is performed on a pre-defined audit regulation vector database to obtain regulation vectors. The semantic similarity between the evidence vectors and the regulation vectors is calculated to extract the legal and regulatory provisions most relevant to the current financial problem scenario.

[0181] Secondly, the system utilizes a four-dimensional template of "role-context-reference basis-task objective" to construct prompt words. Specifically, the system sets the role of the large language model as a senior audit expert, uses the evidence anchoring set as the audit context, uses the legal and regulatory provisions most relevant to the current financial problem scenario as the formatting reference, and finally issues a task instruction to generate standardized audit working papers.

[0182] According to the task instructions, the large language model is driven to generate and output the final audit working papers. While outputting the documents, the source identification marks or hyperlinks of the cited legal provisions are automatically established in the documents to achieve a deep connection between the audit conclusions and the original evidence and legal database.

[0183] The application interaction layer interacts with the intelligent agent collaboration layer to generate a visual view based on the audit report and risk warning using the audit early warning dashboard, and provides an interface for downloading audit reports.

[0184] It should be noted that the audit report generation API provides an interface for downloading audit reports, and the evidence chain visualization module graphically displays the evidence anchoring set generated by the intelligent agent collaboration layer (i.e., the initial evidence package, the logical conflict points output by the reasoning intelligent agent, and the correlation binding results of the audit conclusions) through the audit early warning dashboard, realizing the traceability visualization between the audit conclusions and the original evidence and legal provisions.

[0185] It should be noted that the evidence chain visualization module, as an independent functional component of the application interaction layer, is used to present the logical relationships between the elements in the evidence anchoring set in a graphical way. It complements the risk warning visualization function of the audit early warning dashboard and together constitutes the visualization display system of the application interaction layer. For example, it can use methods based on force-directed graphs, directed acyclic graphs, etc.

[0186] In summary, by employing the technical solutions described above, this invention solves the challenge of identifying logical problems across documents through a three-modal consistency verification mechanism that integrates visual features of invoices, semantic features of contracts, and financial features of accounts. A multi-agent collaborative architecture is introduced. Utilizing thought chain technology, a system similar to human experts dynamically adjusts detection strategies based on clues, rather than mechanically executing preset rules. An automated audit report generation method based on evidence anchoring and retrieval enhancement technologies is constructed. A large language model is used to semantically align risk clues discovered during verification with accounting standards, generating audit reports containing facts of violations, qualitative basis, and rectification suggestions. The numerical distribution deviation factor calculated using Benford's Law is dynamically injected into the construction process of the isolated forest algorithm as a priori weight, solving the problem of insufficient sensitivity of traditional isolated forest algorithms to manipulated data. By introducing statistical priors, the system can accurately capture hidden financial problems that attempt to conceal traces through splitting orders and rounding in an unsupervised manner, thereby reducing the underreporting rate.

[0187] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An audit risk early warning system based on trimodal verification and agent collaboration, characterized in that, include: The data access layer is used to extract features from invoice images, purchase contracts and ERP entries in the audit target using the recognition model to obtain entity features, which include visual features, semantic features and numerical features. The verification and monitoring layer receives entity feature data from the data access layer, uses a triangular logic judgment algorithm to perform multimodal verification on entity features, obtains risk warnings, uses an adaptive anomaly monitoring algorithm to monitor audit targets, identifies modified data and generates an abnormal clue list, and dynamically provides task prompt words through the RAG generation engine. The intelligent agent collaboration layer, connected to the verification and monitoring layer, is used to complete the features of entity features using a reconnaissance intelligent agent based on the list of abnormal clues and task prompts, perform multi-hop reasoning on the audit target using a reasoning intelligent agent to obtain audit conclusions, and perform clause mapping on the audit conclusions using a document intelligent agent to obtain an audit report. The application interaction layer interacts with the intelligent agent collaboration layer to generate a visual view based on the audit report and risk warning, and provides an audit report download interface; The data access layer, verification and monitoring layer, intelligent agent collaboration layer, and application interaction layer form a closed loop to achieve risk warning for financial auditing.

2. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 1, characterized in that, The data access layer includes: The visual feature extraction unit is used to extract key-value pairs from the invoice image using a preset OCR model to obtain visual features; The semantic feature extraction unit is used to extract clause entities from the procurement contract using the named entity recognition model to obtain semantic features. The numerical feature extraction unit is used to call up structured financial data in real time and convert it into JSON format to extract numerical features including voucher number, posting date, debit amount and summary fields.

3. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 1, characterized in that, The verification and monitoring layer includes: The mapping table unit is used to obtain the original field names in the entity features, process the original field names to obtain the original field vectors, and construct the mapping relationship table using the vector similarity retrieval method. The triangulation verification unit is used to perform numerical verification, temporal verification, and consistency verification on entity features, and to provide risk warnings based on the verification results and risk level. The anomaly monitoring unit is used to obtain the transaction amount set of the audit target, calculate the Benford deviation factor corresponding to the transaction amount set, use the Benford deviation factor as a prior parameter to correct the anomaly evaluation model based on the isolation forest, use the corrected anomaly evaluation model to monitor and analyze the transaction amount set, identify the corrected data and generate an anomaly clue list. The RAG generation unit is used to acquire trigger signals and generate structured task prompts based on a preset audit knowledge base and prompt word templates.

4. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 3, characterized in that, The mapping table unit includes: The field acquisition module is used to obtain the original field names of visual features, semantic features, and numerical features; The field processing module is used to clean and segment the original field names to obtain standardized field names; The field vector module is used to calculate standardized field names using a pre-defined FinBERT model to obtain the original field vector; The similarity calculation module is used to calculate the cosine similarity between the original field vector and the standard vector in the standard audit field vector library in real time, based on a pre-configured standard audit field vector library. The mapping determination module is used to determine the mapping table based on cosine similarity and a preset threshold strategy.

5. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 3, characterized in that, The triangulation verification unit includes: The numerical verification module is used to calculate the absolute difference between visual features and numerical features. It uses a preset threshold judgment method to judge the absolute difference. If the absolute difference exceeds the preset threshold, it provides a risk warning of discrepancy in amount. The time sequence verification module is used to extract time nodes from visual features, semantic features and numerical features based on the mapping table, respectively after field alignment and time format normalization, to verify the time nodes using preset business time sequence rules, and to provide corresponding risk warnings based on the risk level and verification results. The entity consistency verification module is used to obtain entity vectors of invoice images, purchase contracts and goods images using a preset retrieval model, calculate the semantic distance between entity vectors using the cosine similarity formula to obtain a similarity score, compare the similarity score with a preset threshold, and provide a risk warning if the similarity score is lower than the threshold.

6. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 3, characterized in that, The anomaly monitoring unit includes: The deviation calculation module is used to obtain the set of transaction amounts of the audit target during the audit period, extract the first significant digit of each amount element in the transaction amount set, count the actual distribution frequency of the first digit, and compare the actual distribution frequency with the theoretical distribution frequency corresponding to Benford's Law to calculate the Benford deviation factor. The correction module is used to dynamically correct the anomaly evaluation model based on the isolation forest by using the Benford deviation factor as a prior parameter, so as to obtain the corrected anomaly evaluation model. The anomaly detection module is used to detect anomalies in the transaction amount set using the modified anomaly evaluation model, identify abnormal transaction behaviors, and generate an anomaly clue list based on the abnormal transaction behaviors.

7. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 3, characterized in that, The RAG generation unit includes: The knowledge base encoding module is used to encode knowledge fragments within a pre-built audit knowledge base, obtain semantic vectors, and build an index for retrieval. The retrieval module is used to encode and process the received trigger signal to obtain a query vector, and then use the query vector to perform a similarity search on the audit knowledge base to obtain related knowledge fragments. The generation module is used to concatenate related knowledge fragments with the current task context and combine them with preset prompt word templates to generate structured task prompt words using a large language model. The communication module is used for asynchronous communication via a message bus and for distributing task prompts in conjunction with trigger signals.

8. The audit risk early warning system based on trimodal verification and agent collaboration according to claim 1, characterized in that, The intelligent agent collaboration layer includes: The investigation unit is used to call the completion tool to complete the features of entities based on the list of abnormal clues and task prompts, obtain the corresponding heterogeneous evidence fragments, and encapsulate the heterogeneous evidence fragments into an initial evidence package. The reasoning unit is used to decompose the audit target using a reasoning agent, obtain interconnected logical nodes, and perform multi-hop reasoning based on the logical nodes to obtain audit conclusions. The document unit is used to map the audit conclusions and legal provisions based on the initial evidence package and audit conclusions, combined with a preset retrieval model, to obtain the audit report.

9. An audit risk early warning system based on trimodal verification and agent collaboration as described in claim 8, characterized in that, The reasoning unit includes: The initial suspicion module is used to generate an initial suspicion path for the audit target based on task prompts, and to perform preliminary thinking steps on the audit matters according to preset audit rules; The context extension analysis module is used to trigger the context extension thinking step based on the initial thinking step, and to perform background analysis and historical transaction distribution analysis on the related entities of the audit matter; The conflict semantic fusion module is used to perform logical collision analysis on evidence with abnormal correlations or semantic conflicts based on the analysis results, and to obtain audit conclusions.

10. An audit risk early warning system based on trimodal verification and agent collaboration as described in claim 8, characterized in that, The document unit includes: The evidence anchoring module is used to construct an evidence anchoring set based on the initial evidence package and audit conclusions; The regulatory vector retrieval module is used to transform the evidence anchor set into evidence vectors using a retrieval model, retrieve the regulatory vectors using a pre-set audit regulatory vector database, calculate the semantic similarity between the regulatory vectors and the evidence vectors, and obtain the legal and regulatory provisions corresponding to the evidence anchor set. The instruction construction module is used to generate standardized task instructions based on task prompts, preset templates, evidence anchoring sets, and legal provisions. The report generation module is used to generate audit reports according to task instructions, and to establish source representations or hyperlinks for the cited legal and regulatory provisions in the audit reports.

Images