Intelligent compliance auditing system and method based on hybrid cloud architecture

Abstract

The application discloses an intelligent compliance auditing system and method based on a hybrid cloud architecture, belongs to the technical field of compliance auditing, and comprises a rule engine module, a secure transmission module, a secure execution module and an analysis output module. The application can automatically convert into executable rules within 24 hours after the policy is issued, and adopts SM2+SM4 (or RSA+AES) double encryption to guarantee transmission safety, meet the data safety compliance requirements of the financial industry, realize compliance management and control in the whole life cycle, reduce repeated investment of enterprises, and save maintenance cost by more than 60%.

Description

Technical Field

[0001] This invention relates to the field of compliance auditing technology, and in particular to an intelligent compliance auditing system and method based on a hybrid cloud architecture. Background Technology

[0002] With the increasing complexity and frequent updates to financial industry regulatory policies, enterprises face the challenge of ever-increasing compliance requirements in their daily operations. Existing compliance management models largely rely on manual retrieval, interpretation, and post-event sampling audits, resulting in low efficiency, insufficient coverage, and significant delays, making it difficult to promptly identify potential risks. Furthermore, the diverse sources and formats of policy documents, with some content published as images, increase the complexity of information processing. Enterprises often lack unified rule management mechanisms and automated processing methods in compliance checks, contract review, and risk assessment, leading to incomplete risk identification, inconsistent rule implementation, and insufficient data utilization. With the development of artificial intelligence, natural language processing, big data analytics, and cloud computing technologies, their integration into compliance management and audit scenarios has become an inevitable trend.

[0003] Existing intelligent compliance audit systems and methods based on hybrid cloud architecture rely on manual or semi-automatic methods to convert policy texts into executable rules. This results in a timeframe of several days or even weeks from policy release to system deployment, making it difficult to meet the urgent needs of financial businesses for real-time compliance. In terms of data security, traditional systems mostly use single encryption methods or standard transmission protocols, which are insufficient to fully cover the security requirements of data flow between public and private clouds in a hybrid cloud environment, posing compliance risks. Furthermore, existing intelligent compliance audit systems and methods based on hybrid cloud architecture involve significant duplication of investment in building and updating compliance rule bases, and professional compliance personnel are scarce, leading to continuously rising human and time costs. Therefore, we propose an intelligent compliance audit system and method based on hybrid cloud architecture. Summary of the Invention

[0004] The purpose of this invention is to address the deficiencies in the existing technology by proposing an intelligent compliance audit system and method based on a hybrid cloud architecture.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: The intelligent compliance audit system based on a hybrid cloud architecture includes a rule engine module, a secure transmission module, a secure execution module, and an analysis output module. The rule engine module is used to acquire and preprocess various policy documents in real time, then extract compliance information from the policy documents to generate executable structured rules; The secure transmission module is used to encrypt and package executable structured rules, and to update and backtrack executable structured rules in an orderly manner. The security execution module is used to receive the encryption rule packet, decrypt the encryption rule packet, and then perform a three-stage audit. The analysis output module is used to perform multi-dimensional analysis of the full audit data over the past 6 to 12 months and generate a visual report based on the results of the multi-dimensional analysis.

[0006] As a further aspect of the present invention, the specific steps for the rule engine module to generate executable structured rules are as follows: S1.1: Monitor the official websites of various regulatory agencies in real time at a set frequency using web crawler technology, and connect with the regulatory policy release platform via API interface to subscribe to policy update notifications to obtain policy documents in PDF, Word and HTML formats. The set frequency is once per hour. The official websites of various regulatory agencies include the China Securities Regulatory Commission and stock exchanges. S1.2: Convert policy documents of different formats into a unified text format, and use OCR technology to extract the text content from the policy documents in image format. Then, convert the uneditable image text into editable electronic text. At the same time, use preset text filtering rules to remove irrelevant content in each policy document and retain the policy provisions. Then, identify the chapter division and clause hierarchy of each policy document to build a structured document framework. S1.3: A pre-trained BERT model is used to semantically encode each pre-processed policy document, and the CRF sequence labeling algorithm is combined to perform named entity recognition to identify the corresponding compliance entities in each policy document; S1.4: Extract the numerical limits, time requirements, prohibitions, and mandatory requirements of each compliance element from each policy document, match each compliance element with the corresponding preset template, and then fill in the specific values ​​and conditions of each compliance element into the corresponding positions in the successfully matched preset template. S1.5: Construct the check conditions, calculation formulas, and verification logic of the rules, and encapsulate the check conditions, calculation formulas, and verification logic of the rules to generate executable structured rules, wherein the executable structured rules are generated by matching the extracted compliance elements with preset rule templates.

[0007] As a further aspect of the present invention, the specific steps of the secure transmission module for the orderly updating and backtracking of executable structured rules are as follows: S2.1: Based on executable structured rules, construct a rule package and generate a dedicated symmetric key corresponding to the rule package. Then, use an asymmetric encryption algorithm to perform asymmetric encryption on the dedicated symmetric key corresponding to the rule package. S2.2: Encrypt the entire content of the executable structured rule using a symmetric encryption algorithm, and use the hash value of the encrypted rule content for integrity verification; S2.3: Use semantic versioning to assign a corresponding semantic version number to the encrypted rule package, analyze the differences between the encrypted rule content and the local historical rule content of each enterprise, and extract and transmit the changed content in the rule package; S2.4: When transmitting rule packages, upload historical version traceability information to each enterprise's local system simultaneously, identify the dependency relationship between the current rule package to be transmitted and the historical rule content of each enterprise's local system, add a dependency list to the rule package, and mark the rule version and function information that the current rule depends on. S2.5: After the transmission is completed, each enterprise's local system checks whether the dependency rules exist and the versions match based on the dependency list. If there are any missing or incompatible versions, the system will promptly prompt for supplementary transmission.

[0008] As a further aspect of the present invention, the specific steps for the security execution module to perform the three-stage audit are as follows: S3.1: Download the encrypted rule package sent by the secure transmission module to the local preset isolation environment of each enterprise, and call the cloud public key stored locally by each enterprise to decrypt and verify the digital signature attached to the rule package. Then recalculate the hash value in the downloaded encrypted rule package and compare it with the original hash value in the rule package. If the two are consistent, it proves that the rule package has not been tampered with during the transmission process. S3.2: Scan the rule package before decryption using local antivirus software to check for hidden malicious programs or abnormal code. Then, use the private key of the asymmetric algorithm held locally by each enterprise to decrypt the corresponding exclusive symmetric key that was encrypted by the asymmetric algorithm in the rule package. Then, use the corresponding exclusive symmetric key to decrypt the encrypted rule content and restore the executable structured rules. After that, integrate the decrypted new rules into the local rule base according to the corresponding semantic requirements, while retaining the historical rule versions. S3.3: Receive business cooperation plans and contract templates submitted by business departments of various enterprises, call the compliance rules corresponding to various cooperation plans in the local rule base of each enterprise, identify whether there are potential risk points in various cooperation plans that are inconsistent with the compliance rules, and then calculate the overall risk value based on the preset rule weights and the degree of violation, and output a pre-inspection report containing compliance suggestions and risk warnings; S3.4: Real-time acquisition of node data during the local contract signing process of each enterprise, real-time verification of each node data, verification of customer information, amount and term in the signed contract, and real-time detection of abnormal behavior in the signing process. If an abnormality is found, a warning message is sent to compliance management personnel and business leaders through local message notification. S3.5: Retrieves all signed contract data from each enterprise's business database, supports batch import, and calls all rules in each enterprise's local rule base. Using distributed parallel processing technology, it verifies the complete content, signing process, and business execution records of each contract one by one to identify any violations. It also classifies the identified violations according to their severity and clarifies the rectification requirements, responsible departments, and rectification deadlines for each type of violation, generating a compliance analysis report.

[0009] The intelligent compliance audit method based on a hybrid cloud architecture includes the following specific steps: Ⅰ: Real-time acquisition and preprocessing of policy documents in different formats from the official websites of regulatory agencies, extraction of compliance information from policy documents in different formats, and generation of executable structured rules; II: Encrypt and package executable structured rules and manage their versions; III: Receive and decrypt encrypted rule packets, update the local rule base, and perform a three-stage audit; IV: Analyze audit data and generate visual reports.

[0010] As a further aspect of the present invention, the specific steps for generating the visualization report in step IV are as follows: S4.1: Extract full audit data for the past 6 to 12 months, and use time series analysis to statistically analyze the changes in core indicators by time dimension. Compare the statistical results with the preset risk stability threshold, mark the abnormal trend range that exceeds the preset risk stability threshold, and combine the changes in regulatory policies and business volume fluctuations during the same period to conduct a preliminary analysis of the causes of the trend. S4.2: Extract multi-dimensional attribute data for each violation record from each audit data, and use the association mining algorithm to analyze the multi-dimensional attribute data. Set the minimum support and minimum confidence to mine the potential associations of each multi-dimensional attribute data. Manually review the mined potential associations and finally output the compliance risk association rule table. S4.3: Construct a risk prediction model and divide the full audit data of the past 6 to 12 months into a training set and a validation set. Input the training set into the risk prediction model, and the risk prediction model processes the training set data. When the risk prediction model processes the data layer by layer to the preset round, and after each round of training, calculate the loss value of the corresponding risk prediction model output through the cross-entropy function. When the loss value is greater than the preset threshold, the decision model is retrained; otherwise, it means that the decision model training is complete. Then, collect the current business data of each enterprise and import it into the trained risk prediction model. Through forward propagation, output the compliance risk prediction results for the next 1 to 3 months. S4.4: Adopt industry compliance reporting standards to build a reporting framework, fill the audit data into the reporting framework, list the information of each violation record on the reporting framework, generate a standardized compliance report, obtain risk data in the three-stage audit, draw a heat map based on a two-dimensional table, and provide compliance improvement suggestions, clarifying rectification responsibilities and time nodes.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention utilizes web crawlers and API interfaces to monitor the official websites of various regulatory agencies in real time, acquiring policy documents in PDF, Word, and HTML formats. It then employs OCR technology and preset text filtering rules to extract valid clauses, constructing a structured document framework. Next, it uses the BERT model and CRF algorithm for semantic encoding and named entity recognition, simultaneously extracting compliance elements such as numerical restrictions, time requirements, and prohibitions. These compliance elements are then matched against preset templates to generate executable structured rules. Based on these executable structured rules, a rule package is constructed. This rule package is protected by both symmetric and asymmetric encryption. After adding a hash value and digital signature to the encrypted rule package, it is transmitted to each enterprise's local isolated environment for verification and decryption, and the local environment of each enterprise is updated. The rule base allows enterprises to access it in real time for compliance checks and risk warnings during business cooperation and contract signing. After contract execution, it supports batch verification of violations and generates compliance analysis reports. Subsequently, it performs time series and correlation mining analysis on 6-12 months of audit data, combines it with a trained risk prediction model to output future risk estimates, and finally generates standardized compliance reports and visual heat maps, clearly defining rectification requirements and division of responsibilities. It can automatically be converted into executable rules within 24 hours after policy release. At the same time, it uses SM2+SM4 (or RSA+AES) dual encryption to ensure transmission security, meet the data security compliance requirements of the financial industry, realize full lifecycle compliance management, reduce redundant investment by enterprises, and save maintenance costs by more than 60%. Attached Figure Description

[0012] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0013] Figure 1 This is a system block diagram of the intelligent compliance audit system based on a hybrid cloud architecture proposed in this invention; Figure 2 This is a flowchart of the intelligent compliance audit method based on a hybrid cloud architecture proposed in this invention. Detailed Implementation

[0014] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Example 1

[0015] Reference Figure 1 The intelligent compliance audit system based on a hybrid cloud architecture includes a rule engine module, a secure transmission module, a secure execution module, and an analysis output module. The rules engine module is used to acquire and preprocess various policy documents in real time, extract compliance information from these policy documents, and generate executable structured rules.

[0016] Specifically, web crawling technology is used to monitor the official websites of various regulatory agencies in real time at a set frequency. An API interface is used to connect with the regulatory policy release platform to subscribe to policy update notifications and obtain policy documents in PDF, Word, and HTML formats. The set frequency is once per hour. The official websites of various regulatory agencies include the China Securities Regulatory Commission (CSRC) and stock exchanges. Policy documents in different formats are converted into a unified text format, and OCR technology is used to extract the text content from image-formatted policy documents. Uneditable image text is then converted into editable electronic text. Pre-set text filtering rules are used to remove irrelevant content from each policy document, retaining only the policy provisions. Then, the chapter divisions and clause hierarchy of each policy document are identified to construct a structured document framework. A pre-trained BERT model is used to semantically encode the pre-processed policy documents, converting the input... Each policy document is converted into a semantic vector representation, and named entity recognition is performed using the CRF sequence labeling algorithm to identify the corresponding compliance entities in each policy document. The parameters of the BERT model and CRF sequence labeling algorithm are set as follows: learning rate = 2e-5, batch size = 16, and maximum sequence length = 512. Numerical restrictions, time requirements, prohibitions, and mandatory requirements are extracted from each policy document to form compliance elements. These compliance elements are then matched with corresponding preset templates. The specific values ​​and conditions of each compliance element are filled into the corresponding positions in the successfully matched preset templates to construct the rule's check conditions, calculation formulas, and verification logic. These check conditions, calculation formulas, and verification logic are then encapsulated to generate executable structured rules. These executable structured rules are generated by matching the extracted compliance elements with preset rule templates.

[0017] It should be further explained that the specific form of converting the input policy documents into semantic vector representations is as follows: in, This indicates the policy document being entered. This represents a semantic vector representation; The specific formula for named entity recognition using the CRF sequence labeling algorithm is as follows: in, Indicates the first Entity label at each location, This represents the input sequence.

[0018] It should be further explained that the specific form of structured rules is as follows: in, Indicates the extraction of elements. Represents a rule template. Represents a knowledge base. This indicates the generation rule.

[0019] The secure transmission module is used to encrypt and package executable structured rules, and to update and backtrack executable structured rules in an orderly manner.

[0020] Specifically, based on executable structured rules, a rule package is constructed, and a unique symmetric key corresponding to the rule package is generated. Then, an asymmetric encryption algorithm public key is used to encrypt the unique symmetric key corresponding to the rule package. The entire content of the executable structured rules is encrypted using a symmetric encryption algorithm, and a hash calculation is performed on the encrypted rule content to generate a unique hash value, which is added to the rule package. A digital signature is then added to the encrypted rule package, and semantic version control is used to assign a corresponding semantic version number to the encrypted rule package. The differences between the encrypted rule content and the local historical rule content of each enterprise are analyzed, and the changed content in the rule package is extracted and transmitted. When transmitting the rule package, historical version traceability information is uploaded to each enterprise's local system simultaneously, and the dependency relationship between the current rule package to be transmitted and the local historical rule content of each enterprise is identified. A dependency list is added to the rule package, marking the rule version and function information that the current rule depends on. After the transmission is completed, each enterprise's local system checks whether the dependent rules exist and match the version according to the dependency list. If there are any missing or incompatible versions, a prompt is made to supplement the transmission.

[0021] The security execution module is used to receive the encryption rule packet, decrypt the encryption rule packet, and then perform a three-stage audit.

[0022] Specifically, the encrypted rule packets sent by the secure transmission module are downloaded to each enterprise's pre-set isolated environment. The cloud public key stored locally by each enterprise is then used to decrypt and verify the digital signature attached to the rule packet. The hash value in the downloaded encrypted rule packet is recalculated and compared with the original hash value. If they match, it proves the rule packet has not been tampered with during transmission. Using the asymmetric algorithm private key held locally by each enterprise, the corresponding exclusive symmetric key encrypted within the rule packet is decrypted. The corresponding exclusive symmetric key is then used to decrypt the rule content encrypted by the symmetric algorithm, restoring the executable structured rules. The decrypted new rules are then integrated into the local rule base according to the corresponding semantic requirements. Historical rule versions are also retained. The system receives business cooperation plans and contract templates submitted by each enterprise's business departments and calls the compliance rules corresponding to various cooperation plans in each enterprise's local rule base to identify whether any cooperation plans are inconsistent with the compliance rules. The system identifies potential risk points and calculates the overall risk value based on preset rule weights and the severity of violations. It then outputs a pre-inspection report containing compliance recommendations and risk warnings. The system acquires real-time node data from each enterprise's local contract signing process and verifies each node's data in real time, checking customer information, amounts, and terms in the signed contracts. It also detects abnormal behavior during the signing process in real time. If an anomaly is detected, a warning message is sent to compliance management personnel and business leaders via local message notification. The system retrieves all signed contract data from each enterprise's business database, supporting batch import, and calls all rules from each enterprise's local rule base. Using distributed parallel processing technology, it verifies the complete content of each contract, the signing process, and business execution records one by one to identify any violations. The identified violations are categorized by severity, and the corresponding rectification requirements, responsible departments, and rectification deadlines for each type of violation are clearly defined, generating a compliance analysis report.

[0023] The analysis output module is used to perform multi-dimensional analysis of the full audit data over the past 6 to 12 months and generate a visual report based on the results of the multi-dimensional analysis. Example 2

[0024] Reference Figure 2 The intelligent compliance audit method based on a hybrid cloud architecture has the following specific steps: The system acquires and preprocesses policy documents in different formats from the official websites of regulatory agencies in real time, extracts compliance information from these policy documents, and generates executable structured rules.

[0025] Encrypt and package executable structured rules and manage their versions.

[0026] Receive and decrypt encrypted rule packets, update the local rule base, and perform a three-stage audit.

[0027] Analyze audit data and generate visual reports.

[0028] Full audit data from the past 6-12 months was extracted, and time series analysis was used to statistically analyze changes in core indicators over time. The statistical results were compared with preset risk stability thresholds, and abnormal trend intervals exceeding these thresholds were identified. Combined with changes in regulatory policies and business volume fluctuations during the same period, preliminary analysis of the causes of trends was conducted. Multidimensional attribute data for each violation record was extracted from each audit data point, and association mining algorithms were used to analyze these attributes. Minimum support and minimum confidence levels were set to uncover potential associations among the multidimensional attributes. The uncovered potential associations were manually reviewed, and a compliance risk association rule table was finally output. A risk prediction model was constructed, and the full audit data from the past 6-12 months was divided into training and validation sets. The training set was input into the risk prediction model for risk prediction. The model processes the training set data. When the risk prediction model processes the data layer by layer to the preset round, and after each round of training, the loss value output by the corresponding risk prediction model is calculated using the cross-entropy function. If the loss value is greater than the preset threshold, the decision model is retrained; otherwise, the decision model training is complete. Then, the current business data of each enterprise is collected and imported into the trained risk prediction model. Through forward propagation, the compliance risk prediction results for the next 1 to 3 months are output. The report framework is built using industry compliance reporting standards, and the audit data is filled into the report framework. The information of each violation record is listed on the report framework to generate a standardized compliance report. At the same time, the risk data in the three-stage audit is obtained, a heat map is drawn based on a two-dimensional table, and compliance improvement suggestions are provided, clarifying the rectification responsibilities and time nodes.

Claims

1. An intelligent compliance audit system based on a hybrid cloud architecture, characterized in that: It includes a rules engine module, a secure transmission module, a secure execution module, and an analysis output module; The rule engine module is used to acquire and preprocess various policy documents in real time, then extract compliance information from the policy documents to generate executable structured rules; The secure transmission module is used to encrypt and package executable structured rules, and to update and backtrack executable structured rules in an orderly manner. The security execution module is used to receive the encryption rule packet, decrypt the encryption rule packet, and then perform a three-stage audit. The analysis output module is used to perform multi-dimensional analysis of the full audit data over the past 6 to 12 months and generate a visual report based on the results of the multi-dimensional analysis.

2. The intelligent compliance audit system based on a hybrid cloud architecture according to claim 1, characterized in that, The specific steps by which the rule engine module generates executable structured rules are as follows: S1.1: Monitor the official websites of various regulatory agencies in real time at a set frequency using web crawler technology, and connect with the regulatory policy release platform via API interface to subscribe to policy update notifications to obtain policy documents in PDF, Word and HTML formats. The set frequency is once per hour. The official websites of various regulatory agencies include the China Securities Regulatory Commission and stock exchanges. S1.2: Convert policy documents of different formats into a unified text format, and use OCR technology to extract the text content from the policy documents in image format. Then, convert the uneditable image text into editable electronic text. At the same time, use preset text filtering rules to remove irrelevant content in each policy document and retain the policy provisions. Then, identify the chapter division and clause hierarchy of each policy document to build a structured document framework. S1.3: A pre-trained BERT model is used to semantically encode each pre-processed policy document, converting each input policy document into a semantic vector representation. The CRF sequence labeling algorithm is then used to perform named entity recognition, identifying the corresponding compliant entities in each policy document. S1.4: Extract the numerical limits, time requirements, prohibitions, and mandatory requirements of each compliance element from each policy document, match each compliance element with the corresponding preset template, and then fill in the specific values ​​and conditions of each compliance element into the corresponding positions in the successfully matched preset template. S1.5: Construct the check conditions, calculation formulas, and verification logic of the rules, and encapsulate the check conditions, calculation formulas, and verification logic of the rules to generate executable structured rules, wherein the executable structured rules are generated by matching the extracted compliance elements with preset rule templates.

3. The intelligent compliance audit system based on a hybrid cloud architecture according to claim 2, characterized in that, The specific steps for the secure transmission module to perform ordered updates and backtracking of executable structured rules are as follows: S2.1: Based on executable structured rules, construct a rule package and generate a dedicated symmetric key corresponding to the rule package. Then, use the public key of an asymmetric encryption algorithm to perform asymmetric encryption on the dedicated symmetric key corresponding to the rule package. S2.2: Encrypt the entire content of the executable structured rule using a symmetric encryption algorithm, and use the hash value of the encrypted rule content for integrity verification; S2.3: Use semantic versioning to assign a corresponding semantic version number to the encrypted rule package, analyze the differences between the encrypted rule content and the local historical rule content of each enterprise, and extract and transmit the changed content in the rule package; S2.4: When transmitting rule packages, upload historical version traceability information to each enterprise's local system simultaneously, identify the dependency relationship between the current rule package to be transmitted and the historical rule content of each enterprise's local system, add a dependency list to the rule package, and mark the rule version and function information that the current rule depends on. S2.5: After the transmission is completed, each enterprise's local system checks whether the dependency rules exist and the versions match based on the dependency list. If there are any missing or incompatible versions, the system will promptly prompt for supplementary transmission.

4. The intelligent compliance audit system based on a hybrid cloud architecture according to claim 3, characterized in that, The specific steps for the security execution module to perform the three-stage audit are as follows: S3.1: Download the encrypted rule package sent by the secure transmission module to the local preset isolation environment of each enterprise, and call the cloud public key stored locally by each enterprise to decrypt and verify the digital signature attached to the rule package. Then recalculate the hash value in the downloaded encrypted rule package and compare it with the original hash value in the rule package. If the two are consistent, it proves that the rule package has not been tampered with during the transmission process. S3.2: Scan the rule package before decryption using local antivirus software to check for hidden malicious programs or abnormal code. Then, use the private key of the asymmetric algorithm held locally by each enterprise to decrypt the corresponding exclusive symmetric key that is encrypted asymmetrically in the rule package. Then, use the corresponding exclusive symmetric key to decrypt the encrypted rule content and restore the executable structured rules. After that, integrate the decrypted new rules into the local rule base according to the corresponding semantic requirements, while retaining the historical rule versions. S3.3: Receive business cooperation plans and contract templates submitted by business departments of various enterprises, call the compliance rules corresponding to various cooperation plans in the local rule base of each enterprise, identify whether there are potential risk points in various cooperation plans that are inconsistent with the compliance rules, and then calculate the overall risk value based on the preset rule weights and the degree of violation, and output a pre-inspection report containing compliance suggestions and risk warnings; S3.4: Real-time acquisition of node data during the local contract signing process of each enterprise, real-time verification of each node data, verification of customer information, amount and term in the signed contract, and real-time detection of abnormal behavior in the signing process. If an abnormality is found, a warning message is sent to compliance management personnel and business leaders through local message notification. S3.5: Retrieves all signed contract data from each enterprise's business database, supports batch import, and calls all rules in each enterprise's local rule base. Using distributed parallel processing technology, it verifies the complete content, signing process, and business execution records of each contract one by one to identify any violations. It also classifies the identified violations according to their severity and clarifies the rectification requirements, responsible departments, and rectification deadlines for each type of violation, generating a compliance analysis report.

5. A smart compliance audit method based on a hybrid cloud architecture, characterized in that, Includes the following steps: Ⅰ: Real-time acquisition and preprocessing of policy documents in different formats from the official websites of regulatory agencies, extraction of compliance information from policy documents in different formats, and generation of executable structured rules; II: Encrypt and package executable structured rules and manage their versions; III: Receive and decrypt encrypted rule packets, update the local rule base, and perform a three-stage audit; IV: Analyze audit data and generate visual reports.

6. The intelligent compliance audit method based on a hybrid cloud architecture according to claim 5, characterized in that, The specific steps for generating the visualization report described in step IV are as follows: S4.1: Extract full audit data for the past 6 to 12 months, and use time series analysis to statistically analyze the changes in core indicators by time dimension. Compare the statistical results with the preset risk stability threshold, mark the abnormal trend range that exceeds the preset risk stability threshold, and combine the changes in regulatory policies and business volume fluctuations during the same period to conduct a preliminary analysis of the causes of the trend. S4.2: Extract multi-dimensional attribute data for each violation record from each audit data, and use the association mining algorithm to analyze the multi-dimensional attribute data. Set the minimum support and minimum confidence to mine the potential associations of each multi-dimensional attribute data. Manually review the mined potential associations and finally output the compliance risk association rule table. S4.3: Construct a risk prediction model and divide the full audit data of the past 6 to 12 months into a training set and a validation set. Input the training set into the risk prediction model, and the risk prediction model processes the training set data. When the risk prediction model processes the data layer by layer to the preset round, and after each round of training, calculate the loss value of the corresponding risk prediction model output through the cross-entropy function. If the loss value is greater than the preset threshold, the decision model is retrained; otherwise, it means that the decision model training is complete. Then, collect the current business data of each enterprise and import it into the trained risk prediction model. Through forward propagation, output the compliance risk prediction results for the next 1 to 3 months. S4.4: Adopt industry compliance reporting standards to build a reporting framework, fill the audit data into the reporting framework, list the information of each violation record on the reporting framework, generate a standardized compliance report, obtain risk data in the three-stage audit, draw a heat map based on a two-dimensional table, and provide compliance improvement suggestions, clarifying rectification responsibilities and time nodes.

Images