Transaction abnormality detection device, transaction abnormality detection method, and transaction abnormality detection program

Abstract

To provide a transaction anomaly detection device, a transaction anomaly detection method, and a transaction anomaly detection program which can automatically detect and notify of data registered in transaction data of business by a fraud executed by combination of an employee and a trader.SOLUTION: Transition data of costs for individual combinations of employees responsible and payment destinations in a prescribed period is generated on the basis of cost data, and it is determined whether or not transition of costs satisfies a prescribed fraud reference on the basis of the transition data, and an alert is output if it is determined that transition of costs satisfies the prescribed fraud reference.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a transaction abnormality detection device, a transaction abnormality detection method, and a transaction abnormality detection program. [Background technology]

[0002] Patent Document 1 discloses a configuration for categorizing time-series change trend patterns of outsourcing expenses and detecting fraudulent expenses by using machine learning on new time-series data of outsourcing expenses. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6955286 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the invention described in Patent Document 1 above has the problem that it is not possible to detect and deal with expense fraud caused by collusion between individuals and businesses at an early stage, which is on the rise across all industries.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a transaction abnormality detection device, a transaction abnormality detection method, and a transaction abnormality detection program that can automatically detect and notify data registered due to fraudulent combinations of employees and vendors within transaction data in business operations. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the transaction abnormality detection device of the present invention is a transaction abnormality detection device equipped with a memory unit and a control unit, wherein the memory unit comprises a business memory means for storing expense data that is set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount, and the control unit comprises a transition creation means for creating expense transition data for each combination of the employee in charge and the payee over a specified period based on the expense data, a transition determination means for determining whether the expense transition satisfies specified fraud criteria based on the transition data, and an expense output means for outputting an alert if the transition determination means determines that the expense transition satisfies the specified fraud criteria.

[0007] Furthermore, in the transaction abnormality detection device according to the present invention, the transition creation means creates the transition data based on the expense data, including the number of expenses for each combination of the employee in charge and the payee during the specified period; the transition determination means calculates an upper limit based on the transition data by adding a specified number of expenses to the number that is the third quartile of the interquartile range of the number of expenses, and determines whether the number of expenses is equal to or greater than the upper limit; and the expense output means outputs the alert when the transition determination means determines that the number of expenses is equal to or greater than the upper limit.

[0008] Furthermore, in the transaction abnormality detection device of the present invention, the transition creation means creates the transition data based on the expense data, including the number of expense items and the average expense amount for each combination of the responsible employee and the payee during the specified period, and the expense output means further displays comparison graph data by payee, which is aggregating by payee the number of expense items or the average expense amount for the expenses included in the transition data for the transitions that are determined by the transition determination means to meet the specified fraud criteria.

[0009] Furthermore, in the transaction abnormality detection device of the present invention, the transition creation means creates the transition data based on the expense data, including the number of expense items and the average expense amount for each combination of the responsible employee and the payee during the specified period, and the expense output means further displays comparative graph data by responsible employee, which is aggregating the number of expense items or the average expense amount for the expenses included in the transition data for the transitions that are determined by the transition determination means to meet the specified fraud criteria, by responsible employee.

[0010] Furthermore, in the transaction abnormality detection device according to the present invention, the transition creation means creates the transition data based on the expense data, including the average number of expense items for the expense for each combination of the employee in charge and the payee during the specified period, and the expense output means further displays the transition of the average number of expense items for the expense included in the transition data for the transition determined by the transition determination means to satisfy the specified fraud criteria, and / or average number transition data for the transition of the average number of expense items for the expense included in the transition data for the transition determined by the transition determination means to not satisfy the specified fraud criteria.

[0011] Furthermore, in the transaction abnormality detection device according to the present invention, the transition creation means creates the transition data based on the expense data, including the average expense amount per voucher for the expenses for each combination of the employee in charge and the payee for the specified period, and the expense output means further displays average expense amount transition data showing the transition of the average expense amount per voucher for the expenses included in the transition data for the expenses determined by the transition determination means to satisfy the specified fraudulent criteria, and / or the transition of the average expense amount data showing the transition of the average expense amount per voucher for the expenses included in the transition data for the expenses determined by the transition determination means to not satisfy the specified fraudulent criteria.

[0012] Furthermore, in the transaction abnormality detection device according to the present invention, the business memory means stores the expense data that is set by linking the expense voucher, the accounting year and month, the employee in charge, the payee, and the expense amount, as well as approval data that is set by linking the voucher and the approver of the voucher, and the transition determination means further creates transition data by approver that is calculated by aggregating the transition data for the transitions that are determined to meet the specified fraud criteria based on the approval data, by approver.

[0013] In addition, in the transaction abnormality detection device of the present invention, the transition creation means creates the transition data including the number of expense items for each combination of the responsible employee and the payee during the specified period based on the expense data, and the expense output means further displays number transition data by approver showing the transition of the number of expense items for the expenses aggregated by the approver included in the transition data by approver.

[0014] Furthermore, in the transaction abnormality detection device of the present invention, the transition creation means creates the transition data based on the expense data, including the average expense amount of the expenses for each combination of the responsible employee and the payee during the specified period, and the expense output means further displays average expense amount transition data by approver, which shows the transition of the average expense amount of the expenses aggregated by approver included in the transition data by approver.

[0015] In addition, in the transaction abnormality detection device of the present invention, the expense output means is further characterized in that it displays the expense data in which the expenses aggregated by the approver included in the approver-specific transition data are set, and a list of details of the approval data.

[0016] Furthermore, in the transaction abnormality detection device of the present invention, the transition creation means creates the transition data based on the expense data and the approval data, which compiles the expenses for each combination of the responsible employee and the payee for the specified period by approver, and the transition determination means determines whether the transition of expenses for each approver meets the specified fraud criteria based on the transition data.

[0017] Furthermore, in the transaction abnormality detection device of the present invention, the expense data is further set in association with the business establishment and the responsible department, and when the business establishment and / or the responsible department are specified, the history creation means extracts the expense data set for that business establishment and / or the responsible department from the business memory means, and creates the history data of the expenses for each combination of the responsible employee and the payee for the specified period based on the expense data.

[0018] Furthermore, the transaction abnormality detection method of the present invention is a transaction abnormality detection method to be executed by a transaction abnormality detection device having a memory unit and a control unit, wherein the memory unit has a business memory means for storing expense data set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount, and is executed by the control unit, and is characterized by including: a transition creation step for creating expense transition data for each combination of the employee in charge and the payee over a specified period based on the expense data; a transition determination step for determining whether the expense transition satisfies specified fraud criteria based on the transition data; and an expense output step for outputting an alert if it is determined in the transition determination step that the expense transition satisfies the specified fraud criteria.

[0019] Furthermore, the transaction abnormality detection program of the present invention is a transaction abnormality detection program to be executed by a transaction abnormality detection device having a memory unit and a control unit, wherein the memory unit has a business memory means for storing expense data set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount, and the control unit executes a transition creation step for creating expense transition data for each combination of the employee in charge and the payee over a specified period based on the expense data, a transition determination step for determining whether the expense transition satisfies specified fraud criteria based on the transition data, and an expense output step for outputting an alert if it is determined in the transition determination step that the expense transition satisfies the specified fraud criteria. [Effects of the Invention]

[0020] The present invention has the advantage of being able to detect combinations of employees and contractors for which an abnormally large number of expenses have been recorded, compared to expenses recorded for each combination of employees and contractors. The present invention also has the advantage of being able to output a screen that allows users to check the status of abnormally large expenses and the status of each individual who approved the expenses. Because there is a possibility of personal expenses or multiple small expenses being recorded, the present invention has the advantage of being able to output a screen that allows users to switch between two perspectives: number of expenses and amount. The present invention also has the advantage of being able to regularly detect fraudulent activity from vast amounts of expense data. The present invention also has the advantage of providing a screen that allows users to check the expense status by each individual who approved the expenses, thereby enabling users to identify problems in the approval flow. The present invention also has the advantage of providing a screen that allows users to analyze and confirm anomalies and their reasons, thereby enabling reliable anomaly detection. The present invention also has the advantage of allowing personnel without statistical or analytical knowledge to detect anomalies in expense fraud and strengthen a company's internal control. The present invention also has the advantage of allowing anyone to quickly detect anomalies by imagining fraudulent scenarios. [Brief explanation of the drawings]

[0021] [Figure 1] FIG. 1 is a diagram showing an example of fraudulent expenses. [Figure 2] FIG. 2 is a diagram showing an example of fraudulent expenses. [Figure 3] FIG. 3 is a diagram showing an example of the fraudulent expense detection method according to this embodiment. [Figure 4] FIG. 4 is a block diagram showing an example of the configuration of a transaction abnormality detection device according to this embodiment. [Figure 5] FIG. 5 is a flowchart showing an example of the processing performed by the transaction abnormality detection device according to this embodiment. [Figure 6] FIG. 6 is a diagram showing an example of an analysis screen in this embodiment. [Figure 7] FIG. 7 is a diagram showing an example of an analysis screen in this embodiment. [Figure 8] FIG. 8 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 9] FIG. 9 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 10] FIG. 10 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 11] FIG. 11 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 12] FIG. 12 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 13] FIG. 13 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 14] FIG. 14 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 15] FIG. 15 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 16] FIG. 16 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 17] FIG. 17 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 18] FIG. 18 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 19] FIG. 19 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 20] FIG. 20 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 21] FIG. 21 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 22] FIG. 22 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 23] FIG. 23 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 24] FIG. 24 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 25] FIG. 25 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 26] FIG. 26 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 27] FIG. 27 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 28] FIG. 28 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 29] FIG. 29 is a diagram showing an example of the transaction abnormality detection process in this embodiment. [Figure 30] FIG. 30 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 31] FIG. 31 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 32] FIG. 32 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 33] FIG. 33 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 34] FIG. 34 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 35] FIG. 35 is a diagram showing an example of a transaction abnormality detection process in this embodiment. [Figure 36] FIG. 36 is a diagram showing an example of a transaction abnormality detection process in this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0022] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to this embodiment.

[0023] [1. Overview] First, an overview of the present invention will be described with reference to FIGS.

[0024] Traditionally, expenses were often reviewed by the individual who recorded them or the business partner to whom they were paid. Fraudulent activity that manifested itself in specific aggregation patterns, such as the combination of "employee, payee, and (employee x payee)," often took a long time to be discovered. Traditionally, the basic route for detecting expense anomalies was when accounting confirmed that more expenses than usual were recorded. Specifically, the individual who recorded the expense was identified, the expense item and amount were confirmed, and vendor expenses were identified based on the expense type. The expense payee and total payment amount were then confirmed, leading to the discovery of the expense anomaly. Therefore, extensive aggregation, comparison, and analysis were required to uncover fraud. This traditional process required extensive time for verification and analysis, making it impractical to process large volumes of transactions. Even when time was required, reliability could not be guaranteed.

[0025] Furthermore, large companies with many employees have traditionally fallen into a vicious cycle where fraud has a large impact but is difficult to detect. Traditionally, when there are many employees, there are also many expenses recorded, but manually calculating and checking these is not practical. Because of this, it tends to be a routine process where simple calculation checks and approval procedures are used, making it easy for fraud to go undetected. In other words, expense fraud has traditionally been committed over the long term, causing a significant impact on the company, but many cases have occurred where it was left unchecked for several years before it was discovered, resulting in a large total amount of damage.

[0026] In addition, traditionally, small and medium-sized enterprises with low transaction volumes have found it difficult to secure personnel with advanced skills such as accountants, and in many cases have little know-how in expense analysis to begin with.As a result, identifying and analyzing the characteristics of fraudulent expenses requires advanced judgment skills like those of an accountant, but it has often been difficult to constantly secure personnel with these skills.

[0027] In addition, in the past, many cases of fraud were committed by exploiting loopholes in the approval control function. Expenses were generally approved through internal approval processes, with third-party checks inserted. Approval flows were established as a fraud prevention measure, but loopholes in these flows were exploited to approve fraudulent expenses. Specifically, in the past, when subsidiary executives were subject to company-wide approval flows, if self-approval was permitted due to the absence of senior management, they could approve their own expenses. This led to numerous cases of fraudulent expenses being approved, such as recording personal expenses and getting approved. Furthermore, in the past, if an employee colluded with the final approver, a final approver was designated in the approval flow, and a specific employee generally performed final approval at regular intervals. Therefore, by communicating with the final approver in advance, even fraudulent expenses could be approved.

[0028] In recent years, corporate fraud and embezzlement by employees and executives have been on the rise, compounded by the impact of the COVID-19 pandemic. As a result, the number of scandals has exceeded the level of human detection, necessitating the development of systems that can detect and address fraud early and without human intervention. As a countermeasure for early detection and response, systems that automatically detect fraud patterns and develop scenarios for regular detection are needed. There are many scenarios, including fraud involving sales records (inflating sales figures by falsifying sales figures); fraud involving purchasing records (collusion with business partners through fictitious payments); fraud involving inventory (profit manipulation by inflating end-of-period inventory figures); and fraud involving expenses (embezzlement by recording personal expenses). Systems must be developed to address each scenario. In many cases, the purpose of the fraud is to record personal expenses and provide funds to contractors. The characteristics of this fraud are: (1) in the case of concentrated expense recording to a specific contractor, the number of expenses for "employee x business partner" is abnormally high compared to other combinations; (2) in the case of personal expenses, the amount is often lower than normal expenses; and (3) in the case of fraudulent expenses, approval is often concentrated on self-approval or on the approval of an insider.

[0029] An example of improper expenses will now be described with reference to Figures 1 and 2. Figures 1 and 2 are diagrams showing an example of improper expenses.

[0030] As shown in Figure 1, in cases of fraud in personal expense claims, the person in charge submits personal expenses to the company as necessary business expenses, causing the company to make payments to vendors.

[0031] Furthermore, as shown in Figure 2, in cases of fraudulent provision of funds to contractors, the person in charge conspires with the contractor to declare fictitious expenses, have the company make payments to the contractor, and thereby funnel funds to the contractor.

[0032] In this way, if expenses are normal, actual expenses will basically occur at a fixed frequency and amount, but if fraud occurs, expenses between a specific employee and contractor may become abnormally high, or an employee may have an abnormally high number of low-cost expenses, or most of the expense usage may be to the same contractor and all of them may be low-cost.Therefore, in this embodiment, we focus on the number of expenses incurred between "employee x contractor" and provide a system that allows the user to check the detected data using an analysis screen to see if there are any "employee x contractor" where expenses are concentrated, or if there are any expenses where the average usage amount is low compared to the number of cases.

[0033] An example of the fraudulent expense detection method in this embodiment will now be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the fraudulent expense detection method in this embodiment.

[0034] As shown in Figure 3, in this embodiment, we focus on fraudulent scenarios related to expenses, and detect abnormalities by judging the average amount of expenses recorded for each vendor that is a payee (a business partner to which expenses are paid) that employee A is responsible for, using specified fraud criteria.

[0035] As a result, this embodiment can tally the number of expenses for each employee and vendor during the year and automatically detect employees and vendors with an abnormally high number of expenses. In other words, because the number of personal use and funding to vendors often increases compared to normal transactions, this embodiment uses this as a criterion for determining abnormalities, reducing tallying costs and eliminating tallying and calculation errors. Furthermore, this embodiment periodically compares the actual expenses for employees and vendors to detect months with an abnormally high number of expenses, eliminating oversights and errors and allowing users to quickly identify employees and vendors with abnormal expenses and take measures and investigate them.

[0036] Furthermore, in this embodiment, the number of expenses by vendor for the year of an employee for whom an abnormality has been detected can be tallied, and the differences between the detected vendor and other vendors can be visualized. That is, in this embodiment, it is possible to confirm that the number of expenses is being recorded in a concentrated manner for the employee x vendor (= the number of expenses is abnormally high compared to other vendors), and since it is possible to tally each vendor under the conditions linked to one employee, it is possible to eliminate the cost of tallying and omissions and errors in comparison confirmation.

[0037] Furthermore, in this embodiment, the annual number of expenses by employee for a contractor for which an anomaly has been detected can be tallied, and the differences between the detected employee and other employees can be visualized. That is, in this embodiment, it is possible to confirm that the number of expenses is recorded in a concentrated manner for the employee x contractor (= the number of expenses is abnormally high compared to other employees), and since it is possible to tally for each employee under conditions linked to one contractor, it is possible to eliminate the cost of tallying and the risk of omissions and errors in comparison confirmation. Furthermore, in this embodiment, by confirming that there are many employees for whom an anomaly has been detected when comparing by employee, it is possible to grasp the actual situation of the abnormally high number of detected employees x contractors.

[0038] Furthermore, in this embodiment, by focusing on employees and vendors for which anomalies have been detected, the number of expenses by month and the average amount per voucher can be tallied, and the trend in expenses increases and decreases can be visualized. In other words, in the case of personal expenses, since many of the amounts are small, there is a high possibility that many will be recorded, and in the case of funding to vendors, since large expenses are likely to be suspicious, there is a high possibility that many small amounts will be recorded. By being able to see the tendency for the number of expenses to increase suddenly at these specific times, it is possible to eliminate the cost of aggregating the number and amount of expenses each month and eliminate omissions and mistakes in monthly comparisons.

[0039] Furthermore, in this embodiment, by focusing on the approver of expenses recorded for employees and vendors for which an anomaly has been detected, it is possible to aggregate the number of expenses by month and the average amount per voucher, and visualize the trend of increases and decreases in expenses. In other words, in this embodiment, in both cases of personal expenses and funding to vendors, it is possible to confirm the tendency for self-approval or a concentration of approvers, thereby eliminating the cost of aggregating and calculating the number of expenses for each month by approver and eliminating omissions and errors in monthly comparisons.

[0040] In addition, in this embodiment, the details of the expense data can be checked at a glance, and the details of the transaction and the amount can be visualized. That is, in this embodiment, in the case of personal expenses, the state in which many items with small amounts are recorded is visualized, and in the case of funding to a contractor, the state in which many expenses for a specific contractor are recorded is visualized, so that signs of fraud can be confirmed from the information of the business partner who recorded the expenses and the amount.

[0041] [2. Configuration] An example of the configuration of the transaction abnormality detection device 100 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a block diagram showing an example of the configuration of the transaction abnormality detection device 100 according to this embodiment.

[0042] 4, the transaction abnormality detection device 100 is a commercially available desktop personal computer. Note that the transaction abnormality detection device 100 is not limited to a stationary information processing device such as a desktop personal computer, but may also be a portable information processing device such as a commercially available notebook personal computer, a PDA (Personal Digital Assistant), a smartphone, or a tablet personal computer.

[0043] Transaction anomaly detection device 100 includes a control unit 102, a communication interface unit 104, a memory unit 106, and an input / output interface unit 108. Each unit included in transaction anomaly detection device 100 is connected to each other so as to be able to communicate with each other via any communication path.

[0044] The communication interface unit 104 communicatively connects the transaction anomaly detection device 100 to the network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 300 has a function of connecting the transaction anomaly detection device 100 and the server 200 so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

[0045] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a touch panel), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to achieve a pointing device function. In the following, the output device 114 may be referred to as the monitor 114 or the printer 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112.

[0046] The storage unit 106 stores various databases, tables, files, etc. The storage unit 106 stores computer programs that cooperate with an operating system (OS) to issue commands to a central processing unit (CPU) to perform various processes. The storage unit 106 may be, for example, a memory device such as a random access memory (RAM) or a read-only memory (ROM), a fixed disk device such as a hard disk, a flexible disk, or an optical disk. The storage unit 106 includes a business database 106a, an anomaly detection execution database 106b, and an anomaly determination result database 106c.

[0047] The business database 106a stores business data accumulated in the course of business. Here, the business database 106a may store expense data that is set by linking together the accounting year and month of the expense, the employee in charge, the payee, and the expense amount. The business database 106a may also store expense data that is set by linking together the expense voucher, the accounting year and month, the employee in charge, the payee, and the expense amount, as well as approval data that is set by linking together the voucher and the voucher approver. The expense data may also be set by linking together the business establishment and the responsible department.

[0048] The anomaly detection execution database 106b stores anomaly detection execution data for detecting anomalies in expenses. Here, the anomaly detection execution database 106b may also store automatic detection execution schedule data and expense data acquisition range condition data.

[0049] The abnormality determination result database 106c stores abnormality determination result data that stores the determination results of the expense abnormality detection execution. Here, the abnormality determination result database 106c may store abnormality determination result data, abnormality determination result message data, and abnormality determination result message detail data.

[0050] The control unit 102 is a CPU or the like that comprehensively controls the transaction abnormality detection device 100. The control unit 102 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, etc., and executes various information processing based on these stored programs. Functionally, the control unit 102 conceptually includes a transition creation unit 102a, a transition determination unit 102b, and an expense output unit 102c.

[0051] The transition creating unit 102a creates expense transition data. Here, the transition creating unit 102a may create expense transition data for each combination of a responsible employee and a payee for a predetermined period based on the expense data. Furthermore, the transition creating unit 102a may create transition data including the number of expense items for each combination of a responsible employee and a payee for a predetermined period based on the expense data. Furthermore, the transition creating unit 102a may create transition data including the number of expense items and the average expense amount for each combination of a responsible employee and a payee for a predetermined period based on the expense data. Furthermore, the transition creating unit 102a may create transition data including the average number of expense items for each combination of a responsible employee and a payee for a predetermined period based on the expense data. Furthermore, the transition creating unit 102a may create transition data including the average expense amount per voucher for each combination of a responsible employee and a payee for a predetermined period based on the expense data. The transition creation unit 102a may also create transition data that aggregates expenses for each combination of a responsible employee and a payee for a specified period by approver, based on the expense data and approval data. The transition creation unit 102a may also create transition data that includes the number of expenses for each combination of a responsible employee and a payee for a specified period, based on the expense data. The transition creation unit 102a may also create transition data that includes the average expense amount for each combination of a responsible employee and a payee for a specified period, based on the expense data. When a business establishment and / or a responsible department is specified, the transition creation unit 102a may extract expense data for the specified business establishment and / or responsible department from the business database 106a, and create transition data for expenses for each combination of a responsible employee and a payee for a specified period, based on the expense data.

[0052] The transition determination unit 102b determines whether the transition of expenses satisfies a predetermined fraud criterion. Here, the transition determination unit 102b may determine whether the transition of expenses satisfies a predetermined fraud criterion based on the transition data. Furthermore, the transition determination unit 102b may calculate an upper limit by adding a predetermined number of expenses to the number of expenses that is the third quartile of the interquartile range based on the transition data, and determine whether the number of expenses is equal to or greater than the upper limit. Furthermore, the transition determination unit 102b may determine whether the transition of expenses by approver satisfies a predetermined fraud criterion based on the transition data. Furthermore, the transition determination unit 102b may create transition data by approver by aggregating the transition data of the transitions that have been determined to satisfy the predetermined fraud criterion based on the approval data.

[0053] The expense output unit 102c outputs output data related to expenses. Here, the expense output unit 102c may output an alert when the transition determination unit 102b determines that the expense transition satisfies the predetermined fraud criteria. Furthermore, the expense output unit 102c may output an alert when the transition determination unit 102b determines that the number of expenses is equal to or greater than an upper limit. Furthermore, the expense output unit 102c may display comparison graph data by payee, which aggregates, by payee, the number of expenses or the average expense amount of expenses included in the transition data of the transition determined by the transition determination unit 102b to satisfy the predetermined fraud criteria. Furthermore, the expense output unit 102c may display comparison graph data by responsible employee, which aggregates, by responsible employee, the number of expenses or the average expense amount of expenses included in the transition data of the transition determined by the transition determination unit 102b to satisfy the predetermined fraud criteria. The expense output unit 102c may also display average expense count trend data showing the trend of the average number of expenses included in the transition data of the transition determined by the transition determination unit 102b to satisfy the predetermined fraud criterion, and / or the trend of the average number of expenses included in the transition data of the transition determined by the transition determination unit 102b to not satisfy the predetermined fraud criterion. The expense output unit 102c may also display average expense amount trend data showing the trend of the average expense amount per slip included in the transition data of the transition determined by the transition determination unit 102b to satisfy the predetermined fraud criterion, and / or the average expense amount trend data showing the trend of the average expense amount per slip included in the transition data of the transition determined by the transition determination unit 102b to not satisfy the predetermined fraud criterion. The expense output unit 102c may also display number trend data by approver showing the trend of the number of expenses tallied by approver included in the approver-specific transition data. The expense output unit 102c may also display average amount transition data by approver, which shows the transition of the average expense amount of expenses totaled by approver included in the transition data by approver. The expense output unit 102c may also display expense data in which expenses totaled by approver included in the transition data by approver are set, and a list of approval data details.

[0054] [3. Specific Examples] A specific example of this embodiment will be described with reference to FIGS.

[0055] [Transaction anomaly detection processing] An example of transaction abnormality detection processing in this embodiment will now be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of processing by the transaction abnormality detection device 100 in this embodiment.

[0056] As shown in FIG. 5, the transition creation unit 102a creates transition data including the number of expenses and the average expense amount for each combination of responsible employee and payee during a specified period based on the expense data stored in the business database 106a (step SA-1).

[0057] Then, based on the transition data, the transition determination unit 102b calculates an upper limit value by adding a specified number of expense items to the number of expense items that is the third quartile of the interquartile range, and determines whether the number of expense items is greater than or equal to the upper limit value (step SA-2).

[0058] If the transition determining unit 102b determines that the number of expense items is not equal to or greater than the upper limit (step SA-2: No), the process ends.

[0059] On the other hand, if the transition determination unit 102b determines that the number of expense items is equal to or greater than the upper limit (step SA-2: Yes), the transition determination unit 102b shifts the process to step SA-3.

[0060] Then, the expense output unit 102c outputs an alert via the output device 114, and displays on the output device 114 comparison graph data by responsible employee that summarizes the number of expense items or average expense amounts for expenses included in the transition data for the transitions that the transition determination unit 102b has determined to meet the specified fraud criteria (step SA-3), and then ends the processing.

[0061] An example of an analysis screen in this embodiment will now be described with reference to Figures 6 and 7. Figures 6 and 7 are diagrams showing an example of an analysis screen in this embodiment.

[0062] In this embodiment, the total annual expense count for each combination of employee and payee is targeted, and any combination of employee and payee with an abnormally high number of expenses compared to other combinations is detected. The "number of expenses by employee and payee" and "trend in the number of expenses recorded by employee and payee and average monthly expense amount" are output, and any data detected as abnormal is highlighted using a different color or font size so that it can be identified at a glance.

[0063] As shown in Fig. 6, the analysis screen in this embodiment displays a list of detected anomaly result messages, and the detected anomaly result messages are output at an overview level. As shown in Fig. 6(1), the analysis screen in this embodiment has an area for displaying messages related to the anomaly detection process, and displays the timing of the anomaly detection, employee, payee, and number of expenses for the detected period, and is output on an overview basis, so for detailed detection methods, it is necessary to select a message and switch screens; if there is a large amount of data detected as anomalies, multiple messages are displayed vertically.

[0064] Furthermore, as shown in FIG. 7, the analysis screen in this embodiment displays graphs necessary for analyzing the message resulting from the detection of an abnormality, and when a message is selected on the analysis screen in FIG. 6, the screen switches, the graphs necessary for analysis are displayed, and detailed detection data is output as a message.

[0065] As shown in FIG. 7(1), the analysis screen in this embodiment has an area for displaying messages related to the anomaly detection process, displaying the "detection method used to detect the anomaly" and "key data for the data in which the anomaly was detected." If there is more than one piece of data detected as an anomaly, messages for that number are displayed, and if a displayed message is clicked, the portion of the graphs in FIG. 7(2) to FIG. 7(6) related to the clicked anomaly detection data is highlighted.

[0066] Furthermore, as shown in Figure 7(2), the analysis screen in this embodiment is set up with a graph that outputs the number of expenses by payee recorded by employees for whom an abnormality has been detected, and a graph that allows confirmation of the "actual number of expenses by payee for the year" is output, allowing confirmation of how abnormally high the number of payees for whom an abnormality has been detected is compared to other payees.

[0067] Furthermore, as shown in Figure 7(3), the analysis screen in this embodiment is set up with a graph that outputs the number of expenses by employee recorded by the payment recipient for which an abnormality has been detected, and a graph that allows you to check the "actual number of expenses by employee for the year" is output, allowing you to check how abnormally high the number of employees for whom an abnormality has been detected is compared to other employees.

[0068] Furthermore, as shown in Figure 7 (4), the analysis screen in this embodiment is set up with a graph that outputs the number of expenses for the employee x payee combination for which an abnormality has been detected and other combinations, and a graph is output that allows you to check the "trend in the number of expenses incurred each month," making it possible to check the trend in the number of expenses increasing from a specific month, and it is possible to switch between the average amount per voucher and the number of vouchers, allowing you to check the trends in either the average amount or the number of vouchers.

[0069] Furthermore, as shown in Figure 7 (5), the analysis screen in this embodiment is set up with a graph that outputs the number of expenses by approver for expenses recorded with the employee x payee for which an abnormality was detected, and a graph is output that allows you to check the "trend in the number of expenses incurred each month," allowing you to check the trend in the number of expenses increasing from a specific month, and if there is self-approval or approval by a specific user, the output will show a biased number of expenses, and you can switch between the average amount per voucher and the number of expenses, allowing you to check the trends in either the average amount or the number of expenses.

[0070] Furthermore, as shown in Figure 7 (6), the analysis screen in this embodiment is set up with a table that outputs a list of expenses recorded for a combination of employee and payee, and a table is output that allows you to check the "expense details" and "amount size." The expenses are output in order of decreasing amount, so that vouchers that tend to be small amounts, such as personal expenses, appear at the top of the details, and in the case of fraud, it is possible to analyze characteristics such as the reason for the application being arbitrary.

[0071] Furthermore, as shown in Figure 7(7), the analysis screen in this embodiment has an extraction conditions area for data extraction, which is used when you want to check the data extracted based on conditions from the data output in the graphs of Figures 7(2) to 7(6).You can switch the aggregation criteria, that is, you can switch the aggregation to amount or number of items for analysis.

[0072] An example of transaction abnormality detection processing in this embodiment will be described with reference to Figures 8 to 36. Figures 8 to 36 are diagrams showing an example of transaction abnormality detection processing in this embodiment.

[0073] In this embodiment, as shown in FIG. 8, the automatic detection execution schedule data and acquisition range condition data required for anomaly detection are saved in a table as pre-settings. As shown in FIG. 9, timing data for detecting anomalies is acquired by automatic execution. It is determined whether the timing of automatic execution is the timing for anomaly detection, and the data range condition for detecting anomalies is acquired. As shown in FIGS. 10 to 12, the [expense data] in the business data is referenced, and employee / payee pairs with an abnormally high number of expense items are detected. Here, in this embodiment, the interquartile range is used as the detection method because it allows automatic calculation of thresholds to determine anomalies. Note that the standard deviation method, which is a statistical method, is not adopted in this embodiment because it is an analysis that does not involve the concept of a time axis, in which the distribution of values ​​at a certain point is taken, a confidence interval is set, and the analysis does not determine whether something is normal or abnormal. This method is not suitable for cross-sectional data analysis, which focuses on "trends from the past." Furthermore, the statistical method of "moving average + outlier" can detect abnormal increases or decreases in the progression of a time series, which requires defining a range for taking the average value and setting in advance a threshold value for determining an abnormality based on the average value calculated for each time series. However, this method is not adopted in this embodiment because it requires the user to set the threshold value for the average value for determining an abnormality.

[0074] In this embodiment, when data that is automatically detected as an anomaly from the [Expense Data] in the business data is output to the initial screen for analysis, a message is obtained as a result of the anomaly being detected, as shown in FIG. 13, and the message is displayed on the screen, and the date when the screen is launched is obtained and set as the base date for the extraction conditions, as shown in FIG. 14.

[0075] In this embodiment, when a message indicating an abnormality has been detected is selected and the analysis screen is launched, the message is switched to detailed data display as shown in FIG. 15, an area for outputting a graph is secured, extraction conditions are set as shown in FIGS. 16 and 17, "expense data by payee" in which the number of expenses is calculated by payee is obtained from the [expense data] in the business data as shown in FIG. 18, "expense data by employee" in which the number of expenses is calculated by employee is obtained from the [expense data] in the business data as shown in FIG. 19, and "month x employee x payee" is obtained from the [expense data] in the business data as shown in FIG. 20. "Expense data by employee x payee", which calculates the number of expenses separately, is obtained, and as shown in Figure 21, "Expense data by approver", which calculates the number of expenses by month x approver, is obtained from the [Expense data] and [Approval data] in the business data, and as shown in Figure 22, "Expense accounting detail data" is obtained from the [Expense data] and [Approval data] in the business data, and as shown in Figures 23 to 26, "Expense data by payee", "Expense data by employee", "Expense data by employee x payee", "Expense data by approver", and "Expense accounting detail data" are bound to graphs and tables, that is, a total of four graphs and one table.

[0076] In this embodiment, when the display of the analysis graph is switched and analysis is performed, the aggregation unit is switched as shown in Figures 27 to 35, and the expense occurrence status when aggregated by average amount is confirmed and analyzed, and as shown in Figure 36, the expense occurrence status when aggregated by limiting the organizations to be confirmed is confirmed and analyzed.

[0077] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to the achievement of SDGs Goals 8 and 9.

[0078] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0079] Furthermore, this embodiment can contribute to strengthening control and governance, which can contribute to the achievement of Goal 16 of the SDGs.

[0080] 5. Other Embodiments The present invention may be implemented in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0081] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0082] Furthermore, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings can be changed as desired unless otherwise specified.

[0083] Furthermore, with regard to the transaction anomaly detection device 100, the components shown in the figures are functional concepts, and do not necessarily have to be physically configured as shown in the figures.

[0084] For example, all or any part of the processing functions of the transaction anomaly detection device 100, particularly the processing functions performed by the control unit 102, may be implemented by a CPU and a program interpreted and executed by the CPU, or may be implemented as hardware using wired logic. The program is recorded on a non-transitory computer-readable recording medium containing programmed instructions for causing the information processing device to execute the processes described in this embodiment, and is mechanically read by the transaction anomaly detection device 100 as needed. That is, a computer program for providing instructions to the CPU in cooperation with the OS and performing various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). The computer program is executed by being loaded into RAM and cooperates with the CPU to constitute the control unit.

[0085] In addition, this computer program may be stored in an application program server connected to the transaction anomaly detection device 100 via any network, and all or part of it may be downloaded as needed.

[0086] Furthermore, the program for executing the processes described in this embodiment may be stored in a non-transitory computer-readable recording medium or configured as a program product. Here, the term "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) disc.

[0087] Furthermore, a "program" is a data processing method written in any language or description method, and does not matter whether it is in the form of source code or binary code. Note that a "program" is not necessarily limited to a single structure, but also includes a structure that is distributed as multiple modules or libraries, or a structure that achieves its function by cooperating with a separate program, such as an OS. Note that the specific configuration and reading procedure for reading a recording medium in each device shown in this embodiment, as well as the installation procedure after reading, can use well-known configurations and procedures.

[0088] The various databases stored in the memory unit 106 are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and providing websites.

[0089] The transaction anomaly detection device 100 may be configured as an information processing device such as a known personal computer or workstation, or may be configured as the information processing device to which any peripheral device is connected. The transaction anomaly detection device 100 may be realized by installing software (including programs, data, etc.) that causes the device to perform the processing described in this embodiment.

[0090] Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the drawings, and all or part of them can be configured by functionally or physically distributing and integrating them in any unit depending on various additions or functional loads. In other words, the above-described embodiments can be implemented in any combination, or embodiments can be implemented selectively. [Industrial Applicability]

[0091] The present invention is useful in any industry that conducts transactions with external parties, including the retail industry that conducts sales. [Explanation of symbols]

[0092] 100 Transaction abnormality detection device 102 Control section 102a Transition Creation Department 102b Transition determination section 102c Expense Output Section 104 Communication interface unit 106 Storage section 106a Business Database 106b Anomaly detection execution database 106c Abnormality determination result database 108 Input / Output Interface Section 112 Input Device 114 Output Device 200 servers 300 Network

Claims

1. A transaction abnormality detection device including a memory unit and a control unit, The storage unit a task storage means for storing expense data that is set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount; Equipped with The control unit a transition creating means for creating transition data including the number of expenses for each combination of the employee in charge and the payee during a predetermined period based on the expense data; a transition determination means for calculating a threshold value for detecting an increase in the number of expenses as a predetermined fraud criterion based on the transition data, and determining whether the transition of expenses satisfies the predetermined fraud criterion; an expense output means for outputting an alert when the change determination means determines that the change in the expenses satisfies the predetermined fraud criterion; A transaction abnormality detection device comprising:

2. The transition determination means Based on the transition data, an upper limit value obtained by adding a predetermined number of expenses to the number of expenses that is the third quartile of the interquartile range is calculated as the predetermined fraud standard, and it is determined whether the number of expenses is equal to or greater than the predetermined fraud standard. The expense output means 2. The transaction abnormality detection device according to claim 1, wherein the alert is output when the transition determination means determines that the number of expenses is equal to or greater than the predetermined fraud standard.

3. The transition creation means Based on the expense data, the transition data including the number of expense items and the average expense amount for each combination of the employee in charge and the payee during the specified period is created; The expense output means The transaction abnormality detection device described in claim 1 further displays comparison graph data by payee, which is obtained by aggregating the number of expense items or the average expense amount of the expenses included in the transition data for the transitions determined by the transition determination means to meet the specified fraud criteria by the payee.

4. The transition creation means Based on the expense data, the transition data including the number of expense items and the average expense amount for each combination of the employee in charge and the payee during the specified period is created; The expense output means The transaction abnormality detection device described in claim 1 further displays comparative graph data by responsible employee that summarizes the number of expense items or the average expense amount of the expenses included in the transition data of the transition that is determined by the transition determination means to meet the specified fraud criteria by the responsible employee.

5. The transition data is Furthermore, the average number of expenses for each combination of the employee in charge and the payee during the specified period is included, The expense output means The transaction abnormality detection device described in claim 1 further displays the trend in the average number of expenses for the expenses included in the transition data for the transitions that are determined by the transition determination means to satisfy the specified fraud criteria, and / or average number of expenses trend data for the trend in the average number of expenses for the expenses included in the transition data for the transitions that are determined by the transition determination means to not satisfy the specified fraud criteria.

6. The transition creation means Based on the expense data, the transition data including the average expense amount per voucher for each combination of the employee in charge and the payee during the specified period is created; The expense output means The transaction abnormality detection device described in claim 1 further displays the trend in the average expense amount per slip for the expenses included in the transition data for the transitions that are determined by the transition determination means to satisfy the specified fraud criteria, and / or average expense amount trend data for the trend in the average expense amount per slip for the expenses included in the transition data for the transitions that are determined by the transition determination means to not satisfy the specified fraud criteria.

7. The job storage means The expense data is set by linking the expense voucher, the accounting year and month, the employee in charge, the payee, and the expense amount, and approval data is set by linking the voucher and the approver of the voucher, The transition determination means The transaction abnormality detection device described in claim 1 further creates approving party-specific transition data by aggregating the transition data of the transitions that are determined to meet the specified fraud criteria based on the approval data, by the approver.

8. The expense output means: The transaction abnormality detection device described in claim 7 further displays number trend data by approver showing the trend in the number of expenses for the expenses aggregated by the approver included in the transition data by approver.

9. The transition creation means Based on the expense data, the transition data including the number of expense items and the average expense amount for each combination of the employee in charge and the payee during the specified period is created; The expense output means The transaction abnormality detection device described in claim 7 further displays average amount trend data by approver showing the trend in the average expense amount of the expenses aggregated by the approver included in the change data by approver.

10. The expense output means A transaction abnormality detection device as described in any one of claims 7 to 9, further displaying the expense data in which the expenses aggregated by the approver included in the approver transition data are set, and a list of details of the approval data.

11. The transition creation means Based on the expense data and the approval data, the transition data is created by aggregating the number of expenses for each combination of the employee in charge and the payee for the specified period by the approver; The transition determination means The transaction abnormality detection device described in claim 7, characterized in that based on the change data, the threshold for detecting an increase in the number of expenses for each approver is calculated as the specified fraud criterion, and it is determined whether the change in the expenses for each approver satisfies the specified fraud criterion.

12. The expense data is Furthermore, the business establishment and the department in charge are linked and set, The transition creation means A transaction abnormality detection device as described in any one of claims 1 to 9, characterized in that when the business establishment and / or the responsible department is specified, the expense data set for that business establishment and / or the responsible department is extracted from the business memory means, and based on the expense data, the historical data including the number of expense items for the expenses for each combination of the responsible employee and the payee during the specified period is created.

13. A transaction abnormality detection method to be executed by a transaction abnormality detection device including a storage unit and a control unit, The storage unit a task storage means for storing expense data that is set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount; Equipped with Executed in the control unit: a transition creation step of creating transition data including the number of expenses for each combination of the employee in charge and the payee during a predetermined period based on the expense data; a transition determination step of calculating a threshold value for detecting an increase in the number of expense items as a predetermined fraud criterion based on the transition data, and determining whether the transition of expenses satisfies the predetermined fraud criterion; an expense output step of outputting an alert when it is determined in the change determination step that the change in the expenses satisfies the predetermined fraud criterion; A transaction anomaly detection method comprising:

14. A transaction abnormality detection program to be executed by a transaction abnormality detection device having a storage unit and a control unit, The storage unit a task storage means for storing expense data that is set by linking the accounting year and month of the expense, the employee in charge, the payee, and the expense amount; Equipped with In the control unit, a transition creation step of creating transition data including the number of expenses for each combination of the employee in charge and the payee during a predetermined period based on the expense data; a transition determination step of calculating a threshold value for detecting an increase in the number of expense items as a predetermined fraud criterion based on the transition data, and determining whether the transition of expenses satisfies the predetermined fraud criterion; an expense output step of outputting an alert when it is determined in the change determination step that the change in the expenses satisfies the predetermined fraud criterion; A transaction anomaly detection program to execute the above.

Images