External audit apparatus, external audit system, external audit method, and external audit program

Abstract

To provide an external audit apparatus and system thereof, configured to always audit a wide range of transactions of a company without requiring manual work, and report a result of the audio early to prevent unauthorized transactions of the company from spreading.SOLUTION: An external audio apparatus connected to an audited company and a financial institution using a network line includes: a transaction information acquisition unit which acquires transaction information of the audited company; a balance information acquisition unit which acquires balance information of the audited company from the financial institution; an ordinary transaction information generation unit which accumulates the transaction information and the balance information to generate ordinary transaction information of the audited company; a determination unit which determines whether there is the transaction information and / or the balance information that deviates from the ordinary transaction information; an anomaly information generation unit which generates anomaly information when there is a deviation from the ordinary transaction information; and a reporting unit which reports the anomaly information to the audited company.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an external audit device, an external monitoring system, an external audit method, and an external audit program, and more particularly to an external audit device, an external monitoring system, an external audit method, and an external audit program for supporting corporate audit work. [Background technology]

[0002] Falsifying accounting information to make companies appear to be performing well (window dressing), and fraudulent acts, including accounting, by company employees still exist. Furthermore, the more sophisticated the cover-up, the longer it takes to discover. If a company's fraudulent acts are discovered, many problems will arise, including a loss of credibility for the company itself, a deterioration in relationships with business partners, and, if the company is listed, delisting, affecting many stakeholders, including the company's employees, investors in the company, and banking partners.

[0003] Currently, internal audits are conducted within companies, and audits of companies are also conducted by external auditing firms. However, it is not easy to detect fraudulent activity among the huge number of daily transactions and payments. In addition, constant internal and external monitoring and auditing are not possible. For example, it takes time to obtain payment records from the bank (financial institution) with which a company does business. Internal and external audits require a lot of manpower. Even if transaction details can be obtained, detailed information cannot be confirmed. Since the financial institutions also obtain records manually, there is a possibility of errors. For this reason, the reality is that audits are limited to partially extracted cases, rather than all transactions.

[0004] Therefore, measures have been considered to automatically detect fraudulent financial management within a company. For example, a user information management device has been proposed that detects transactions with a predetermined transaction pattern as abnormal transactions based on transaction information related to cash transactions and user information of users linked to the transaction information (see Patent Document 1).

[0005] The user information management device of Patent Document 1 is expected to be effective to a certain extent in detecting abnormal transactions in companies that use the device. However, the user information management device of Patent Document 1 is limited to detecting fraudulent acts by employees of the company, and does not support detection of major fraudulent acts by the company itself or its departments. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2019-164662 A Summary of the Invention [Problem to be solved by the invention]

[0007] The present invention has been made in consideration of the above points, and provides an external auditing device, system, method, and program that is capable of constantly auditing a wide range of a company's transactions without relying on human power, and that notifies the company of the audit results at an early stage to prevent the spread of fraudulent transactions by the company. [Means for solving the problem]

[0008] In other words, the external monitoring device of the embodiment is connected to the audited company and the audited company's financial institution via a network line, and is characterized by comprising a transaction information acquisition unit that acquires transaction information of the audited company from the audited company, a balance information acquisition unit that acquires balance information of the audited company from the audited company's financial institution, a normal transaction information generation unit that accumulates transaction information and balance information and generates normal transaction information of the audited company, a determination unit that determines whether there is either or both of the transaction information and balance information of the audited company that deviates from the normal transaction information, an abnormality information generation unit that generates abnormality information if either or both of the transaction information and balance information of the audited company deviates from the normal transaction information, and a reporting unit that reports the abnormality information to the audited company.

[0009] Furthermore, a blocking detection unit may be provided that detects blocking of access between the audited company and a financial institution with which it does business, or between the audited company and an external monitoring device, and the reporting unit may report the detected blocking of access to the audited company as abnormal information.

[0010] Furthermore, a change detection unit may be provided that detects changes to the transaction information after it has been acquired by the transaction information acquisition unit, and the reporting unit may report the detected changes to the transaction information as abnormal information to the audited company.

[0011] Furthermore, the reporting unit may report the abnormal information to the audited company and the contracted auditing firm.

[0012] Furthermore, the normal transaction information generating unit may accumulate transaction information and balance information over a predetermined period of time to generate the normal transaction information.

[0013] Furthermore, the normal transaction information generation unit may be equipped with a machine learning unit, and the machine learning unit may accumulate transaction information and balance information over a predetermined period of time to generate the normal transaction information.

[0014] Additionally, the transaction information may include the audited company's payment records, inventory records, order records, income statement records, or balance sheet records.

[0015] If the audited company has subsidiaries or equity method affiliates, the transaction information acquisition unit may acquire transaction information of the audited company's subsidiaries or equity method affiliates. Effect of the Invention

[0016] According to the external audit device of the present invention, the device is connected to the audited company and the financial institution of the audited company via a network line, and includes a transaction information acquisition unit that acquires transaction information of the audited company from the audited company, a balance information acquisition unit that acquires balance information of the audited company from the financial institution, a normal transaction information generation unit that accumulates transaction information and balance information to generate normal transaction information of the audited company, a determination unit that determines whether there is any or both of the transaction information and balance information of the audited company that deviates from the normal transaction information, an abnormality information generation unit that generates abnormality information when either or both of the transaction information and balance information of the audited company deviates from the normal transaction information, and a reporting unit that reports the abnormality information to the audited company. This makes it possible to constantly audit a wide range of transactions of the company without relying on human labor, and to report the results of the audit to the company early to prevent the spread of fraudulent transactions of the company. In addition, the same effect is expected in the external audit system, the external audit method, and the external audit program. [Brief description of the drawings]

[0017] [Figure 1] 1 is a schematic diagram showing a configuration of an external audit system including an external audit device. [Diagram 2] FIG. 2 is a schematic block diagram showing the configuration of an external auditing device. [Diagram 3] 2 is a schematic block diagram showing the functional parts of an external auditing device. FIG. [Figure 4] FIG. 13 is a schematic diagram showing acquisition of transaction information and acquisition of balance information. [Diagram 5] FIG. 13 is a schematic diagram showing normal transaction information consisting of (A) the number of products sold, (B) inventory records, and (C) balance information, and (D) the number of products sold, (E) inventory records, and (F) balance information in an abnormal situation. [Figure 6] FIG. 2 is a schematic diagram showing transaction information and balance information. [Figure 7] 13 is a display screen showing an example of a notification of abnormality information. [Figure 8] FIG. 13 is a schematic diagram showing access blocking. [Figure 9] FIG. 13 is a schematic diagram showing the generation of normal transaction information by a machine learning unit. [Figure 10] FIG. 13 is a schematic diagram of another embodiment of an audited company. [Figure 11] 1 is a first flowchart illustrating the process of an external auditing method. [Figure 12] 13 is a second flowchart illustrating the process of the external audit method. [Figure 13] 13 is a third flowchart illustrating the process of the external audit method. [Figure 14] 4 is a fourth flowchart illustrating the process of the external audit method. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] The external audit system of the embodiment is equipped with an external monitoring device, and audits and monitors the audited company's transactions, accounting, and other internal fraudulent activities from outside the audited company. Then, when fraud is predicted or in the early stages of fraud, a specified report is made to the audited company and even to the auditing corporation. In this way, attention is drawn to the possibility of fraud, or measures are taken by the company against fraudulent activities that are discovered in the early stages.

[0019] The schematic configuration of an external audit system 1 according to an embodiment is shown in the schematic diagram of Figure 1. In the external audit system 1, an audited company 3 and a financial institution 4 with which the audited company 3 does business are connected via a network line Nt, and the audited company 3 and the financial institution 4 are further connected to an external audit device 2 via the network line Nt. In this way, each location is interconnected via the network line Nt.

[0020] A publicly known internet line is used for the network line Nt connecting each part. In addition, a dedicated line may be installed and operated to ensure data transmission between the audited company 3, the financial institution 4, and the external audit device 2.

[0021] The audited company 3 is a so-called company that uses the services of the external audit system 1 to have its internal transactions, accounting, and other irregularities audited and monitored through an external audit device 2 located outside the audited company 3, and can be a listed or unlisted company. The form of the company can also be a joint-stock company, a limited liability company, a limited liability company, or any other form. Furthermore, organizations that have legal entities such as incorporated associations, incorporated foundations, medical corporations, agricultural corporations, etc. are also included. In addition, as will be described later, if the audited company 3 has subsidiaries or equity method affiliates, the subsidiaries or equity method affiliates of the audited company 3 are also included in the audited company 3.

[0022] The financial institutions 4 are financial institutions that handle current or ordinary deposits of the audited company 3, and are mainly banks. Furthermore, financial institutions such as credit unions and credit associations can also be included in the financial institutions 4. The number of financial institutions 4 is not limited to one bank, and may be multiple banks.

[0023] The external audit device 2 has a function of acquiring transaction information of the audited company 3 from the audited company 3, and further acquiring balance information of the audited company 3 from its financial institutions 4, and cross-checking the two. It also has a function of notifying the audited company 3 if an abnormal transaction is detected. The external audit device 2 will be described in detail using Figure 2 onwards.

[0024] As shown in the schematic diagram of Figure 1, the audited company 3, the financial institution 4, and the external audit device 2 are mutually connected by a network line Nt. Here, various data such as deposits and withdrawals are transmitted from the audited company 3 to the financial institution 4 using, for example, API (Application Programming Interface) authentication, etc., to enhance the safety of mutual data exchange (security of data transmission). Appropriate consent is also set when transmitting various data from the audited company 3 to the external audit device 2. Then, balance information of the audited company 3 recorded in the financial institution 4 is provided from the financial institution 4 to the external audit device 2.

[0025] Furthermore, as can be seen from the schematic diagram of Fig. 1, the abnormality information that is the judgment result in the external audit device 2 is reported to the audited company 3 and the contracted auditing corporation 5. The abnormality information that is the judgment result is then communicated to the person in charge of internal audits 6 of the audited company 3, and further to a certified public accountant 7 that belongs to the auditing corporation 5 and is in charge of the audited company 3. In the figure, a server 5a is connected to the auditing corporation 5.

[0026] The external audit system 1 of the embodiment is configured with an external audit device 2 and an audit corporation 5 separately. In the illustrated external audit system 1, the external audit device 2 of the system provides external audit services to a plurality of audited companies 3 and a plurality of audit corporations 5. Alternatively, the audit corporation 5 itself may be equipped with the external audit device 2, and the audit corporation 5 may use the external audit device 2 to audit the audited companies 3 (client companies) that it is responsible for.

[0027] As shown in the schematic block diagram of Fig. 2, the external audit device 2 is, in terms of hardware, a computer unit 10 equipped with an input / output interface 11 (I / O buffer), ROM 12, RAM 13, storage unit 14, CPU 15, etc. In terms of software, it is realized by an external audit program loaded into main memory, etc. The external audit device 2 (computer unit 10) is specifically any of various electronic computers (computing resources) such as a personal computer (PC), a mainframe, a workstation, a cloud computing system, etc.

[0028] When each functional unit of the external auditing device 2 (computer unit 10) in Figures 1 and 2 is realized by software, the external auditing device 2 is realized by executing instructions of a program, which is software that realizes each function. The recording medium that stores this program may be a "non-transitory tangible medium," such as a CD, DVD, semiconductor memory, or programmable logic circuit. In addition, this program may be supplied to the external auditing device 2 of the external auditing system 1 via any transmission medium (communication network, broadcast waves, etc.) that can transmit the program.

[0029] The memory unit 14 of the external audit device 2 (computer unit 10) is a known storage device such as an HDD or SSD. The memory unit 14 stores various data, information, an external audit program, various data required to execute the program, and the like. In addition, each functional unit that executes various calculations, computations, and the like is a computing element such as a CPU 15. In addition, input devices such as a keyboard and a mouse, display devices such as a display, output devices that output data, and the like are also connected to an appropriate input / output interface 11 of the computer unit 10.

[0030] As shown in the schematic block diagram of Fig. 3, the functional units in the CPU 101 of the external auditing device 2 (computer unit 10) include a transaction information acquisition unit 110, a balance information acquisition unit 120, a normal transaction information generation unit 130, a judgment unit 140, an interruption detection unit 150, an change detection unit 160, an abnormality information generation unit 170, a reporting unit 180, and a machine learning unit 190. The operation and execution of the external auditing device 2 is realized in software terms by an external auditing program loaded into the main memory, etc.

[0031] The external audit device 2 in the external audit system 1 will be described with reference to FIG. 4 and subsequent drawings.

[0032] The transaction information acquisition unit 110 acquires transaction information 30 of the audited company 3 from the audited company 3. The transaction information 30 is various information generated by the business activities of the audited company 3, and specifically includes settlement records 31 (cash, deposits, accounts receivable, accounts payable, prepaid expenses, advance payments, etc.) of purchases or sales of goods or services, inventory records 32 (inventory) existing in the warehouse of the audited company 3, order records 33 of goods or services, and accounting materials such as the profit and loss statement 34 (P / L) and balance sheet 35 (B / S) of the audited company 3, as shown in the schematic diagram of FIG. 4. In addition, the transaction information 30 includes information on the quantity and amount of purchases, sales, issuances, and bond issues of various financial products such as securities (stocks), bonds (public and corporate bonds), and financial derivatives, as well as information on the type and amount of taxes (various taxes such as income tax, corporate tax, consumption tax, and local tax).

[0033] For example, if the audited company 3 is a manufacturing company, the inventory records 32 will include the quantity of products (finished products, semi-finished products, work in progress), the amount of raw materials purchased for product manufacturing, the number of products shipped, and the number of items in stock. The profit and loss statement 34 (P / L) and balance sheet 35 (B / S) of the audited company 3 are recorded for each month if the settlement is monthly, every three months if the settlement is quarterly, every six months if the settlement is half-yearly, and at the end of the term if the settlement is full year.

[0034] The transaction information 30 of the audited company 3 reflects the daily business activities of the audited company 3. Therefore, by subjecting the transaction information 30 of the audited company 3 to constant auditing, it is useful for discovering fraudulent business activities, and even detecting it at an early stage.

[0035] The balance information acquisition unit 120 acquires balance information 40 of the audited company 3 from the transaction financial institution 4. The transaction financial institution 4 is in a position to manage the current account of the audited company 3. Therefore, the transaction financial institution 4 can grasp the payment information of the audited company 3. Therefore, by constantly tracking the balance information 40 of the audited company 3, it becomes possible to monitor any unnatural deposits and withdrawals that are different from normal business activities. Of course, if there are multiple transaction financial institutions 4, the balance information 40 of each bank is acquired.

[0036] The normal transaction information generating unit 130 accumulates the transaction information 30 and the balance information 40 to generate the normal transaction information 50 of the audited company. As shown in Fig. 4, the transaction information 30 (31 to 35) from the audited company 3 and the balance information 40 from the financial institution 4 are transmitted (acquired) to the external audit device 2. The normal transaction information 50 referred to here is information that links (links) the general business activities of the audited company 3, such as the sale of products and provision of services, and the purchase or sale of assets (movable property, real estate), with the deposits and withdrawals of money associated with the activities, making it possible to grasp the content of the business activities and the amounts of deposits and withdrawals.

[0037] The judgment unit 140 judges whether there is any one or both of the transaction information 30 and the balance information 40 of the audited company 3 that deviates from the normal transaction information 50.

[0038] The anomaly information generating unit 170 generates anomaly information 60 (see FIG. 5 and FIG. 6) when either or both of the transaction information 30 and the balance information 40 of the audited company 3 deviates from the normal transaction information 50.

[0039] The reporting unit 180 reports the abnormality information 60 to the audited company 3 .

[0040] When generating regular transaction information 50 in the external auditing device 2, the schematic diagram of Fig. 5 is referred to. In the form of Fig. 5, as an example, transaction information 30 and balance information 40 are accumulated over one accounting year (12 months) up to the previous term as a predetermined period, and the trends of the number of products sold, the number of shipments, and the balance are shown. 1Q, 2Q, 3Q, and 4Q in the figure indicate quarters.

[0041] FIG. 5(A) shows the annual trend of the number of product sales (sales settlement record 31) included in the transaction information 30 from the audited company 3. FIG. 5(B) shows the annual trend of the inventory record 32. In the case of seasonal products, production is increased before the period when sales increase, and inventory is increased. FIG. 5(C) shows the annual trend of the balance information 40. In the case of actual sales, bill settlement is more common as accounts receivable than cash settlement. Therefore, there is a time lag of about three months between the time when sales are recorded and the time when the actual bill is issued and is deposited. The number of product sales, inventory record, and balance information (average up to the previous period) in FIG. 5(A), (B), and (C) become the normal transaction information 50 of the audited company 3 under normal circumstances. The transaction information 30 and balance information 40 are accumulated over a predetermined period, and for example, in the case of the number of product sales, the average for each month is obtained by comparing it with the previous period, the period before last, etc. The same applies to the inventory record and balance information. In this way, the fluctuations over multiple accounting years are mitigated, and the normal transaction information 50 of the audited company 3 is generated.

[0042] Figures 5(D), (E), and (F) correspond to the items of merchandise sales, inventory records, and balance information in Figures 5(A), (B), and (C). Both show annual trends from the beginning to the end of the term. Figure 5(D) shows the annual trend of merchandise sales (sales settlement records 31) for the current term. Sales are favorable because they are higher than those in Figure 5(A). In addition, the balance information 40 in Figure 5(F) has also increased. In this case, the performance of the audited company 3 is expected to improve. However, according to the inventory records 32 in Figure 5(E), there is little change from Figure 5(B). The dashed lines in Figures 5(D), (E), and (F) show the regular transaction information in Figures 5(A), (B), and (C), and are used to clearly indicate the difference.

[0043] In the case of Figure 5, since there have been no major changes in inventory records other than the price increase of the product unit price of the audited company 3, it is possible that the products have not actually been shipped, but that invoices have simply been manipulated, and there is suspicion of fraudulent accounting practices such as circular transactions led by the audited company 3. Although not shown in the figure, transaction information 30 on the amount of raw material purchases is also taken into consideration in the verification. It is possible that while the actual product sales volume is the same as in previous years, product shipments have been increased on the books and recorded as sales.

[0044] Therefore, the judgment unit 140 compares "the normal transaction information 50 (averaged over several years) of the audited company 3 when the product sales, inventory records, and balance information in Figures 5(A), (B), and (C) are normal" with "the product sales, inventory records, and balance information in Figures 5(D), (E), and (F) (with doubts about a certain period)". The inventory record (Figure 5(E)) has not changed significantly from the inventory record (Figure 5(B)) in the normal transaction information. However, the product sales (Figure 5(D)) and the balance information (Figure 5(F)) have increased significantly. The inventory record should have progressed accordingly. In other words, there is a contradiction between the product sales and inventory (the transaction information deviates from the normal transaction information). Specifically, the difference between the product sales and balance information for the same month included in the normal transaction information 50 and the product sales and balance information in Figures 5(D) and (F) is calculated. This then reveals a contradiction, as an increase in inventory records that should actually appear does not exist.

[0045] From this comparison, the determination unit 140 generates a determination result that "there is a deviation from the normal transaction information." Then, the abnormality information generation unit 170 generates the product sales volume, inventory record, and balance information in Figures 5(D), (E), and (F) as abnormality information 60 for the audited company 3 as evidence of the deviation from the normal transaction information.

[0046] When generating the normal transaction information 50, it is possible to record a comparison of the transaction information 30 and the balance information 40 on a daily and hourly basis, rather than using the predetermined period shown in FIG. 5. For example, the schematic diagram in FIG. 6 shows the number of products sold (sales settlement record 31) included in the transaction information 30 of the audited company 3 on a certain day (yy / zz / 20xx). Also, the balance information 40 of the financial institution 4 with which the transaction is made on the same day is shown. In this example, the combination of the number of products sold (sales settlement record 31) included in the transaction information 30 of the audited company 3 on that day (yy / zz / 20xx) and the balance information 40 becomes the normal transaction information 50.

[0047] When the number of products sold is paid for in cash, the amount (sales price x number of products sold) is added to the balance information 40 as sales at the same time as the sale. Naturally, the sales price and number of products sold are known. If the corresponding sales amount does not exist in the balance information 40, there is a possibility of unfair cheap selling or fictitious transactions. Specifically, the actual normal sales amount is known, and abnormalities can be detected from the difference between the balance information in which an increase in the actual normal sales amount is expected and the actual balance information. Records of such comparisons between the transaction information 30 and balance information 40 in daily business activities are also generated as abnormality information 60 for the audited company 3.

[0048] The reporting unit 180 of the external audit device 2 reports to the audited company 3, which is the client, the results of deviations from the normal transaction information 50 detected by the judging unit 140, and the abnormal information 60. The reporting unit 180 may also report the results of deviations and the abnormal information 60 to the auditing firm 5 that has a contract with the audited company 3, in addition to the audited company 3. The auditing firm 5 then contacts the person in charge of internal audits 6 of the audited company 3, and further contacts the certified public accountant 7 that belongs to the auditing firm 5 and is in charge of the audited company 3.

[0049] As an example of a report (example of a display screen) from the reporting unit 180, Fig. 7(A) corresponds to the example of a report of a fraudulent act discovered through tracking over a specified period of time in the above-mentioned Fig. 5. A message "Warning! Please check the sales quantity, inventory, and accounts receivable of product PP of AAA Company from month bb to month cc of year 20aa" appears on the display device (not shown) of the terminal of the person in charge of internal audits 6 of the audited company 3 or the certified public accountant 7 in charge of the audited company 3.

[0050] Also, Figure 7(B) corresponds to an example of a report of fraudulent activity that was discovered from tracking on a certain day in Figure 6. The message "Warning! Please check the sales volume of product QQ of BBB Co. on yy / zz / 20xx" appears on the display device (not shown) of the terminal of the person in charge of internal audits 6 of the audited company 3 or the certified public accountant 7 in charge of the audited company 3.

[0051] In this way, the facts of fraud occurring in the audited company 3, signs of fraud, etc. are shared among the audited company 3 and other related parties, making it possible to quickly address the fraud issue. Even if the external audit device 2 itself is installed inside the auditing firm 5, deviation results and abnormality information 60 are reported in the same way.

[0052] The external audit system 1 (external audit device 2) of the embodiment includes a blockage detection unit 150 and an alteration detection unit 160.

[0053] The interruption detection unit 150 detects the interruption of access between the audited company 3 and its financial institution 4, or between the audited company 3 and the external audit device 2. In the external audit system 1 of the embodiment, the audited company 3, financial institution 4, and external audit device 2 are mutually connected by a network line Nt (see FIG. 1). If an access interruption (X in the figure) occurs between the audited company 3 and its financial institution 4, as in the schematic diagram of FIG. 8, no record of deposits and withdrawals during that time (balance information 40) will remain at the financial institution 4, and the audited company 3 may have made some deposits and withdrawals that it wishes to keep secret.

[0054] In addition, if access is blocked (X in the figure) between the audited company 3 and the external audit device 2 (including cases where it is installed within the auditing firm 5), no record of the transaction information 30 during that time will remain at the financial institution 4 with which the audited company 3 does business, and it is possible that the audited company 3 has conducted some kind of transaction that it wishes to keep confidential.

[0055] The very occurrence of access blockage between various locations can be considered extremely unnatural. Therefore, the reporting unit 180 reports the detected access blockage as one aspect of the anomaly information 60 to the audited company 3 and further to the auditing corporation 5. The audited company 3 or auditing corporation 5 that receives such a report can conduct an internal investigation and take measures at the stage when there are few fraudulent transactions or when there are signs of fraud.

[0056] The change detection unit 160 detects changes to the transaction information 30 (31 to 35) after it has been acquired by the transaction information acquisition unit 110. Once a transaction such as the sale or purchase of goods has been concluded at the audited company 3, arbitrary changes to the transaction information 30 should not be permitted unless proper processing such as returns and discounts has been carried out. Therefore, when a change to the transaction information 30 occurs without processing in accordance with the company's internal regulations and accounting rules, there is a high possibility that it is an illegal falsification of transactions or accounting at the audited company 3.

[0057] Therefore, the reporting unit 180 reports the detected change in the transaction information 30 as one aspect of the abnormality information 60 to the audited company 3 and further to the auditing firm 5. The audited company 3 or the auditing firm 5 that receives such a report can conduct an internal investigation and take measures at the stage when there are few illegal falsifications in transactions and accounting or when there are signs of such falsifications.

[0058] As a modified example of the external audit system 1 (external audit device 2) of the embodiment, the normal transaction information generation unit 130 includes a machine learning unit 190. The machine learning unit 190 estimates appropriate transaction volumes and balance volumes from the transaction activities of the audited company 3 by accumulating transaction information 30 and balance information 40 over a predetermined period as shown in Fig. 5. This estimated value is generated as normal transaction information 50. Fig. 9 is a schematic diagram showing an overview of the machine learning unit 190.

[0059] Transaction information 30 of the audited company 3 includes accounting documents such as settlement records 31, inventory records 32, order records 33, and even profit and loss statements 34 and balance sheets 35, which are input to the machine learning unit 190 via the transaction information acquisition unit 110. In addition, balance information 40 of the audited company 3 is input to the machine learning unit 190 from the financial institution 4 through the balance information acquisition unit 120. Based on the various input information, the machine learning unit 190 uses machine learning techniques such as support vector machine (SVM), model tree, decision tree, neural network, multiple linear regression, locally weighted regression, and probabilistic search method to generate normal transaction information 50 as an estimated value.

[0060] For example, when a neural network is used, normal transaction information 50 is generated as the standard transaction activity of the audited company 3 for a given period from transaction information 30, such as settlement records 31, inventory records 32, order records 33, and balance information 40. If a transaction amount deviates from this normal transaction information 50, some kind of fraudulent transaction is suspected. Furthermore, the normal transaction information 50 derived from the above-mentioned Figures 5(A), (B), and (C) and the examples of suspected abnormalities (abnormal information 60) in Figures 5(D), (E), and (F) are also used as data for machine learning.

[0061] By executing machine learning in the machine learning unit 190, it becomes easier to track the individual records, etc., of which there are multiple types in the transaction information 30. When generating normal transaction information 50, there is a tendency for the types of records in the transaction information 30 to be biased. In this regard, machine learning allows for objective estimation, although there is some degree of weighting.

[0062] The corporate structure of the audited company 3 is also diversifying, and in addition to being a single corporate entity, there are cases where the audited company 3 has multiple companies as group companies. In such cases, audits and monitoring are required not only for the audited company 3 but also for the group companies. Currently, consolidated financial statements are applied to group companies due to the control of shares. Therefore, if fraudulent activities or fraudulent accounting are discovered in one company in the group, it will affect the entire group.

[0063] Even if the group companies of the audited company 3 are covered, expanding the scope indefinitely would make things more complicated. Therefore, the group companies of the audited company 3 are organized by the investment ratio of shares and the control ratio of capital. Specifically, if the audited company 3 has subsidiaries or equity method affiliates, the external audit device 2 will obtain transaction information 30 and balance information 40 for the subsidiaries or equity method affiliates in the same way as for the audited company 3, as described above.

[0064] The schematic diagram in Figure 10 shows a situation in which, in addition to the audited company 3, there is a subsidiary 3a and an equity method affiliate 3b of the audited company 3. The audited company 3, subsidiary 3a, and equity method affiliate 3b are connected to an external audit device 2 (including cases where it is installed within the auditing firm 5) via a network line Nt. The audited company 3, subsidiary 3a, and equity method affiliate 3b are also connected to financial institutions 4 via network lines Nt. This makes it possible to audit fraudulent transactions within the audited company 3 and its group companies.

[0065] As explained in the series of explanations, the external audit system 1 and the external audit device 2 of the embodiment automatically detect and report transactions suspected of possible fraud, without relying on human labor, for audit work that usually relies on human labor. This allows companies and audit firms to respond quickly after fraudulent transactions are discovered. In particular, currently, when an audit firm requests a balance confirmation letter from a financial institution, in addition to the time required to confirm the signature or seal, there are problems such as lost time for mailing and loss of mail. Therefore, with the existing audit method, it is difficult to confirm at all times (in real time). Therefore, while it is ideal to audit all transactions, the audit was limited to extracting only a portion of the transactions to ensure the appropriateness of the audit. In contrast, the embodiment is automated, so that constant (real time) confirmation is realized. In addition, it also becomes possible to audit all transactions, which was previously difficult. In particular, in the case of foreign financial institutions, balance confirmation letters are rarely issued, and there is no way to check transactions with overseas parties. However, when the external audit system 1 and the external audit device 2 of the embodiment are introduced, there is no burden on financial institutions and the barrier to cooperation in audit work is lowered.

[0066] Hereinafter, the external audit method and the external audit program in the external audit system 1 (external audit device 2) will be described with reference to the flowcharts of Figures 11 to 14. The external audit method is executed by the CPU 15 of the external audit device 2 (computer unit 10) based on the external audit program. The external audit program causes the external audit device 2 (computer unit 10) in Figure 2 to execute various functions, including a transaction information acquisition function, a balance information acquisition function, a normal transaction information generation function, a judgment function, an abnormality information generation function, a reporting function, and further an interruption detection function, a change detection function, and a machine learning function. Each function overlaps with the description of the external audit device 2 described above, so details will be omitted.

[0067] As shown in the flowchart of Fig. 11, the processing of the external auditing device 2 (computer unit 10) includes a transaction information acquisition step (S110), a balance information acquisition step (S120), a normal transaction information generation step (S130), a judgment step (S140), an abnormality information generation step (S170), and a notification step (S180). Furthermore, the external auditing device 2 (computer unit 10) includes various steps, such as an interruption detection step (S150) from the flowchart of Fig. 12, an alteration detection step (S160) from the flowchart of Fig. 13, and a machine learning step (S190) from the flowchart of Fig. 14. Of course, various steps necessary for the operation of the external auditing device 2 (computer unit 10) itself are naturally included.

[0068] The transaction information acquisition function acquires the transaction information 30 of the audited company 3 from the audited company 3 (S110; transaction information acquisition step). The balance information acquisition function acquires the balance information 40 of the audited company 3 from the financial institution 4 with which the audited company does business (S120; balance information acquisition step). The normal transaction information generation function accumulates the transaction information 30 and the balance information 40 to generate the normal transaction information 50 of the audited company 3 (S130; normal transaction information generation step). The judgment function judges whether there is any one or both of the transaction information 30 and the balance information 40 of the audited company 3 that deviates from the normal transaction information 50. It judges whether either or both of the transaction information 30 and the balance information 40 of the audited company 3 deviates from the normal transaction information 50 (S140; judgment step). The abnormal information generation function generates abnormal information 60 when either or both of the transaction information 30 and the balance information 40 of the audited company 3 deviates from the normal transaction information 50 (S170; abnormal information generation step). The reporting function reports the abnormality information 60 to the audited company 3 (S180; reporting step). Each of these functions is executed by the CPU 15 of the external auditing device 2 (computer unit 10).

[0069] The interruption detection function detects interruption of access between the audited company 3 and the financial institution 4 with which it does business, or between the audited company 3 and the external audit device 2 (S150; interruption detection step). The change detection function detects changes to the transaction information 30 after it has been acquired by the transaction information acquisition unit 110 (S160; change detection step). The machine learning function accumulates the transaction information 30 for a predetermined period of time, and accumulates balance information 40 for a predetermined period of time to generate regular transaction information 50. Each of these functions is executed by the CPU 15 of the external audit device 2 (computer unit 10).

[0070] The computer program of the present invention described above may be recorded on a processor-readable recording medium, and the recording medium may be a "non-transitory tangible medium" such as a tape, disk, card, semiconductor memory, programmable logic circuit, etc.

[0071] The computer program can be implemented using, for example, a scripting language such as ActionScript or JavaScript (registered trademark), an object-oriented programming language such as Objective-C or Java (registered trademark), or a markup language such as HTML5. [Industrial Applicability]

[0072] The external audit device and external audit system of the present invention enable constant auditing of company transactions and can promptly notify the company of the audit results, allowing the company to quickly deal with fraudulent transactions and questionable accounting practices. The same effects are also expected for the external audit method and external audit program. [Explanation of symbols]

[0073] 1. External Audit System 2. External Auditing Device 3. Audited companies 4. Financial Institutions 5. Audit Corporation 6. Internal Audit Personnel 7. Certified Public Accountant 10 Computer Department 11 Input / Output Interface 12 ROM 13 RAM 14 Storage section 15 CPU 30 Transaction Information 40 Balance Information 50 Regular transaction information 60 Abnormal information 110 Transaction Information Acquisition Department 120 Balance Information Acquisition Department 130 Normal transaction information generation unit 140 Judgment section 150 Interruption detection unit 160 Change detection unit 170 Abnormality information generation section 180 Reporting Department 190 Machine Learning Department

Claims

1. An external monitoring device connected to an audited company and a financial institution that the audited company does business with via a network line, a transaction information acquisition unit for acquiring transaction information of the audited company from the audited company; a balance information acquisition unit that acquires balance information of the audited company from the financial institution; a normal transaction information generating unit that accumulates the transaction information and the balance information and generates normal transaction information of the audited company; a determination unit that determines whether there is any one or both of the transaction information and the balance information of the audited company that deviates from the normal transaction information; an anomaly information generating unit that generates anomaly information when either or both of the transaction information and the balance information of the audited company deviates from the normal transaction information; A reporting unit that reports the abnormality information to the audited company. An external audit device comprising:

2. a blocking detection unit that detects a blocking of access between the audited company and the financial institution, or a blocking of access between the audited company and the external monitoring device, The external auditing device according to claim 1 , wherein the reporting unit reports the detected blockage of the access as the abnormality information to the audited company.

3. a change detection unit that detects a change in the transaction information after the transaction information acquisition unit acquires the transaction information, 3. The external auditing device according to claim 1, wherein the notification unit notifies the audited company of the detected change in the transaction information as the abnormality information.

4. 4. The external auditing device according to claim 1, wherein the reporting unit reports the abnormality information to an auditing firm contracted with the audited company.

5. 5. The external auditing device according to claim 1, wherein the normal transaction information generating unit generates the normal transaction information by accumulating the transaction information and the balance information for a predetermined period of time.

6. The normal transaction information generation unit includes a machine learning unit, The external auditing device according to claim 1 , wherein the machine learning unit accumulates the transaction information over a predetermined period of time and accumulates the balance information over a predetermined period of time to generate the regular transaction information.

7. 7. The external auditing device according to claim 1, wherein the transaction information includes a settlement record, an inventory record, an order record, a profit and loss statement record, or a balance sheet record of the audited company.

8. An external audit device as described in any one of claims 1 to 7, wherein the transaction information acquisition unit acquires transaction information of the subsidiary or the equity method affiliate of the audited company when the audited company has a subsidiary or an equity method affiliate.

9. 1. An external audit method in an external monitoring device connected to an audited company and a financial institution that does business with the audited company via a network line, comprising: The computer unit of the external monitoring device a transaction information acquisition step of acquiring transaction information of the audited company from the audited company; a balance information acquisition step of acquiring balance information of the audited company from the financial institution; a normal transaction information generating step of accumulating the transaction information and the balance information to generate normal transaction information of the audited company; a determination step of determining whether there is any one or both of the transaction information and the balance information of the audited company that deviates from the normal transaction information; an anomaly information generating step of generating anomaly information when either or both of the transaction information and the balance information of the audited company deviates from the normal transaction information; a notification step of notifying the abnormality information to the audited company; 1. An external audit method comprising:

10. An external audit program in an external monitoring device connected to an audited company and a financial institution that the audited company does business with via a network line, A computer unit of the external monitoring device A transaction information acquisition function for acquiring transaction information of the audited company from the audited company; A balance information acquisition function for acquiring balance information of the audited company from the financial institution; a normal transaction information generating function that accumulates the transaction information and the balance information to generate normal transaction information of the audited company; a judgment function for judging whether there is any one or both of the transaction information and the balance information of the audited company that deviates from the normal transaction information; an anomaly information generating function that generates anomaly information when either or both of the transaction information and the balance information of the audited company deviates from the normal transaction information; A reporting function for reporting the abnormal information to the audited company. An external audit program characterized by:

11. An external monitoring system comprising an audited company, a financial institution with which the audited company does business, and an external monitoring device of the audited company, connected by a network line, The external monitoring device a transaction information acquisition unit for acquiring transaction information of the audited company from the audited company; a balance information acquisition unit that acquires balance information of the audited company from the financial institution; a normal transaction information generating unit that accumulates the transaction information and the balance information and generates normal transaction information of the audited company; a determination unit that determines whether there is any one or both of the transaction information and the balance information of the audited company that deviates from the normal transaction information; an anomaly information generating unit that generates anomaly information when either or both of the transaction information and the balance information of the audited company deviates from the normal transaction information; A reporting unit that reports the abnormality information to the audited company. An external audit device comprising:

Images