JP2024016300A - Analysis program, analysis device, and analysis method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an analysis program, an analysis device, and an analysis method for analyzing accounting data.

SOLUTION: In an analysis system 1, an analysis program causes one or a plurality of processors to perform a function to display, on a user device, a screen for accepting selection of an analysis target scenario from among a plurality of scenarios each related to a different type of fraud and a function to display, on the user device, an analysis target score corresponding to the analysis target scenario among scores calculated for each of the plurality of scenarios that is an index indicating probability that fraud is included in accounting data that is an analysis target.

SELECTED DRAWING: Figure 1

COPYRIGHT: (C)2024,JPO&INPIT

Description

The disclosure of this specification relates to an analysis program, an analysis device, and an analysis method. More specifically, the disclosure of this specification relates to an analysis program, an analysis device, and an analysis method that support efficient detection of fraud in auditing financial statements.

Auditors are responsible for obtaining reasonable assurance that the financial statements of the entity being audited are free of material misstatement. A company's financial statements may contain misstatements due to fraud or error. Several techniques have been proposed for efficiently discovering fraud and errors in accounting data included in financial statements. For example, Japanese Patent Laid-Open No. 2020-140668 describes an analysis device that assigns a score indicating the probability of fraud or error to each piece of journal data based on analysis logic, and outputs analysis result data including this score. There is.

Japanese Patent Application Publication No. 2020-140668

The score assigned to each journal data unit that indicates the probability of fraud or error can be an indicator of the degree of validity of each journal data, but the score assigned to each journal data unit indicates what kind of fraud or error is likely to occur. There is no insight to determine what happened. For this reason, even if analysis result data including scores for each journal data unit is obtained, verifying what kind of fraud or error has occurred requires the personal insight of a skilled auditor. I have no choice but to rely on it.

The amount of journal entry data that must be analyzed in one accounting period is often enormous. For this reason, even if points are assigned to each journal data, it may not be possible to narrow down the journal data with a high probability of fraud or error to an appropriate amount. In other words, a large amount of journal data with high scores is generated, and there is a possibility that the journal entry test cannot be performed efficiently.

One of the objects of the invention disclosed in this specification is to provide a new analysis program, analysis device, and analysis method that support the discovery of fraud in accounting data.

Other objects of the invention disclosed herein will become apparent upon reference to the entire specification. The invention disclosed in this specification may solve the problems understood from the description of this specification instead of or in addition to the above problems.

One or more embodiments of the present invention relate to an analysis program for analyzing accounting data. An analysis program according to one or more embodiments of the present invention causes one or more processors to display on a user device a screen that accepts selection of a scenario to be analyzed from a plurality of scenarios, each of which is related to a different type of fraud. displaying on the user device an analysis target score corresponding to the analysis target scenario among the scores calculated for each of the plurality of scenarios, which is an index representing the probability that fraud is included in the accounting data to be analyzed. and execute the function.

In one or more embodiments of the present invention, the score is calculated for each data item included in a target data item among a plurality of data items included in the accounting data for each of the plurality of scenarios. The analysis program according to one or more embodiments of the present invention causes the one or more processors to execute a function of receiving selection of analysis target data from data included in the target data item. In one or more embodiments of the present invention, the analysis target score is a score calculated for the analysis target data among the plurality of scores.

The analysis program according to one or more embodiments of the present invention provides the one or more processors with the necessary information for calculating the score for each of the plurality of scenarios among the plurality of data items of the accounting data. A function for displaying a data item on the user device is executed.

The analysis program according to one or more embodiments of the present invention causes the one or more processors to execute a function of generating the accounting data based on detailed data received from the user device.

One or more embodiments of the present invention relate to an analysis device that analyzes accounting data. An analysis device according to one or more embodiments of the present invention includes a storage unit that stores accounting data, and a score that represents the probability that fraud is included in the accounting data for each of a plurality of scenarios, each of which is related to a different type of fraud. and a score calculation unit that calculates.

One or more embodiments of the present invention relate to an analysis method for analyzing accounting data by one or more processors executing computer-readable instructions. An analysis method according to one or more embodiments of the present invention includes a step of displaying on a user device a screen for accepting the selection of a scenario to be analyzed from among a plurality of scenarios, each of which is related to a different type of fraud; The method includes the step of displaying, on the user device, an analysis target score corresponding to the analysis target scenario, which is an index indicating the probability that fraud is included in the accounting data, and is calculated for each of the plurality of scenarios.

According to the embodiments of the present invention, it is possible to provide a new analysis program, analysis device, and analysis method that support the discovery of fraud in accounting data.

FIG. 1 is a block diagram of an analysis system according to one embodiment of the present invention. 2 is an explanatory diagram showing an example of sales detail data used in the analysis system of FIG. 1. FIG. 2 is an explanatory diagram showing an example of purchase detail data used in the analysis system of FIG. 1. FIG. 2 is an explanatory diagram showing an example of scenario data used in the analysis system of FIG. 1. FIG. 2 is an explanatory diagram showing an example of score data used in the analysis system of FIG. 1. FIG. It is an explanatory diagram for explaining an example of score calculation logic. FIG. 7 is an explanatory diagram for explaining another example of score calculation logic. FIG. 2 is a flowchart showing the flow of processing for calculating a score representing the probability of fraud based on accounting data. 2 is a schematic diagram showing an example of a setting screen displayed on a user device when accounting data is mapped to a format that can be used in the analysis system of FIG. 1. FIG. FIG. 2 is a flow diagram illustrating a process for outputting a score corresponding to a selected scenario. FIG. 3 is a schematic diagram showing an example of a scenario selection screen that prompts the selection of a scenario. FIG. 3 is a schematic diagram showing an example of a score display screen.

Hereinafter, various embodiments of the present invention will be described with reference to the drawings as appropriate. As shown in FIG. 1, an analysis system 1 according to an embodiment of the present invention includes a user device 10 and a server 20. The analysis system 1 may include a storage 30 as shown. The user device 10, the server 20, and the storage 30 are communicably connected to each other via a network 40. The network 40 may be a single network or may be configured by connecting a plurality of networks. Network 40 is, for example, the Internet, a mobile communication network, or a combination thereof. As the network 40, any network that enables communication between electronic devices may be applied.

The analysis system 1 shown in FIG. 1 is an example of a system to which the present invention can be applied, and the system to which the present invention can be applied is not limited to that shown in FIG. The analysis system 1 to which the present invention is applicable may not include some of the illustrated components. For example, the analysis system 1 may not include the storage 30. The analysis system 1 may include components not shown. For example, although only one user device 10 is shown in FIG. 1 to simplify the explanation, the analysis system 1 can include any number of user devices 10, such as two or more.

The analysis system 1 analyzes accounting data to be analyzed for each of a plurality of scenarios regarding fraud or error in financial statements, as will be described in detail later. Through this analysis, a score representing the probability that the accounting data to be analyzed includes fraud or error is calculated for each of the plurality of scenarios. This score is calculated, for example, in the server 20, and the calculated score is outputted, for example, in the user device 10. Output on the user device 10 is performed by displaying on a display, for example. The server 20 is an example of an embodiment of the "analysis device" in the claims. The user of the user device 10 is assumed to be an auditor or his assistant. Auditors can obtain suggestions as to what types of fraud or errors exist in accounting data based on the scores calculated for each scenario, allowing them to detect fraud and errors more efficiently and comprehensively. be able to. In auditing practice, "fraud" and "error" are distinguished depending on whether the act that causes the misstatement of financial statements is intentional or not. In this specification, since there is no need to distinguish between fraud and error, "fraud" and "error" are collectively referred to as "fraud" unless the context requires a distinction. Therefore, in this specification, the mere term "fraud" can be interpreted to include "error" in audit practice.

The analysis system 1 assumes various scenarios of fraud that cause misstatement of financial statements, and calculates a score representing the probability that fraud is included in the accounting data to be analyzed for each assumed scenario. can. When an auditor conducts a financial statement audit of a company, when an auditor selects a scenario to be analyzed from among a plurality of scenarios on the user device 10, an auditor selects an analysis target scenario to be analyzed from among a plurality of scenarios on the user device 10, and then the server 20 analyzes the scores calculated for each score. An analysis target score corresponding to the target scenario is output at the user device 10.

A score calculation logic for calculating a score, which is an index representing the probability of fraud, can be individually determined for each of a plurality of scenarios. Therefore, scores are calculated according to different logic for each scenario. The score calculation logic outputs a score using at least part of the accounting data to be analyzed as a variable. The auditor can grasp the probability that fraud has occurred for each scenario based on the score output from the user device 10. In other words, auditors can gain direct insight into identifying the type of fraud committed from the scores calculated for each scenario. Therefore, depending on the score for each scenario, the auditor can efficiently investigate and verify whether the fraud indicated by the scenario was actually committed. According to analysis system 1, scores are calculated based on score calculation logic specific to each scenario, rather than evaluating the probability of fraud for the entire accounting data to be analyzed, so it is possible to improve the accuracy of scores. .

The fraud scenarios assumed in the analysis system 1 are determined based on audit practices. For example, the scenario for analysis system 1 is created by a skilled auditor. If a new method of fraud occurs, a new scenario can be created to deal with the fraud. Specifically, it is possible to define score calculation logic for calculating a score representing the probability that the new type of fraud has occurred, based on accounting data related to the newly occurring fraud case.

The score calculation logic may be defined by a skilled auditor. Machine learning may be used when determining the score calculation logic. For example, when a certain type of fraud occurs (for convenience of explanation, it will be referred to as "scenario A fraud"), by learning accounting data that contains misstatements due to the fraud in scenario A as training data, A score calculation model corresponding to A's fraud can be prepared. By preparing training data for each scenario, a score calculation model can be trained for each scenario based on the training data selected for each scenario. This provides a score calculation model that is optimized for each scenario.

The score calculation logic for each scenario used in the analysis system 1 is determined for each type of fraud, but there are no or almost no individual factors involved for each company. In this way, in Analysis System 1, it is possible to expand the scenarios for which scores can be calculated by adding scenarios according to the type of fraud, and when expanding, it is necessary to consider the individual circumstances of each company. It has excellent scalability because there is no In addition, since no customization is required, it is highly responsive to new fraudulent methods that emerge.

In the analysis system 1, as will be described later, sales detail data 25a related to sales and purchase detail data 25b related to purchases can be employed as analysis targets. It is difficult to falsify this data because the corresponding data is also left in the company with which the transaction is made. In this way, the analysis system 1 can analyze data that is difficult to falsify and calculate a score.

Various scenarios of fraud in financial statement audits can be assumed based on past audit practices. For example, a scenario of "regular trading days" is assumed. In audit practice, it can be hypothesized that the risk of fictitious sales is higher for transactions with a certain regularity in the interval between transaction dates. Therefore, the analysis system 1 can employ "regular transaction days" as one of the fraud scenarios. The analysis system 1 can calculate the score of the accounting data to be analyzed using the score calculation logic corresponding to the scenario of "regular transaction days". To calculate the score in this scenario, the degree of regularity is quantified by comparing the transaction interval recorded in the sales detail data provided by the company with the transaction interval assuming that the transactions were conducted randomly. A score calculation logic is used to The higher the score calculated by this score calculation logic, the higher the probability that the accounting data to be analyzed contains fraud corresponding to this "regular transaction day", that is, fraud in the form of fictitious sales. . Therefore, the auditor can investigate whether fictitious sales are actually being recorded based on the score for this scenario. In this way, the score calculated by the analysis system 1 is calculated for each fraud scenario, so it is possible to understand what type of fraud is likely to have been committed based on the score for each scenario, Efforts can be made to discover fraud by assuming the form of fraud based on this score.

The score may be calculated in more detailed data units. Since it is assumed that the accounting data to be analyzed includes a large number of data items, the analysis system 1 analyzes the data contained in a specific data item among the multiple data items included in the accounting data to be analyzed. A score may be calculated for each. For example, if the accounting data to be analyzed includes data values for data items such as "accounting date," "product," "department," "business partner," and "person in charge," specific data among these data items It may be calculated for each item of data. More specifically, if the data item "Department" includes data "Department A", "Department B", and "Department C", then this "Department A", "Department B", and "Department C" A score may be calculated individually for each of ``. When an individual score is calculated for "department A", the score is calculated using only data related to "department A" out of all the accounting data to be analyzed. In this way, by calculating a score for each data unit included in the accounting data to be analyzed, the calculated score provides more detailed insight into fraud that has a high probability of occurring. For example, if the score calculated for "department A" with respect to scenario A is larger than the score calculated for "department B" and the score calculated for "department C" with respect to scenario A, "department A" In this case, it is possible to obtain insight that fraud corresponding to scenario A (for example, recording of fictitious sales) may have been committed. In this case, the auditor can carefully investigate whether there were any fictitious sales in department A, while omitting the investigation of fraud related to scenario A in department B and department C to the extent permissible in audit practice. Can be done. In this way, according to one embodiment of the present invention, fraud investigations can be conducted more efficiently based on segmented scores.

Next, the components of the analysis system 1 will be explained. First, the configuration of the user device 10 will be explained. The user device 10 is a personal computer (PC), a tablet terminal, a smartphone, or various other information processing devices. The user device 10 includes a processor 11, a memory 12, a user interface 13, a communication interface 14, and a storage 15.

The processor 11 is an arithmetic device that loads an operating system and various other programs from the storage 15 or other storage into the memory 12 and executes instructions included in the loaded programs. The processor 11 is, for example, a CPU, an MPU, a DSP, a GPU, various other arithmetic devices, or a combination thereof. The processor 11 may be realized by an integrated circuit such as an ASIC, PLD, FPGA, or MCU.

The memory 12 is used to store instructions executed by the processor 11 and various other data. The memory 12 is a main memory that can be accessed by the processor 11 at high speed. The memory 12 is configured by, for example, RAM such as DRAM or SRAM.

The user interface 13 includes an input interface that receives user input, and an output interface that outputs various information under the control of the processor 11. The input interface is, for example, a keyboard, a pointing device such as a mouse, a touch panel, or any other information input device capable of inputting user input. The output interface is, for example, a liquid crystal display, a display panel, or any other information output device capable of outputting the calculation results of the processor 11.

The communication interface 14 is implemented as hardware, firmware, communication software such as a TCP/IP driver or a PPP driver, or a combination thereof. The user device 10 can send and receive data to and from other devices such as the server 20 via the communication interface 14 .

Storage 15 is an external storage device accessed by processor 11. The storage 15 is, for example, a magnetic disk, an optical disk, a semiconductor memory, or various other storage devices capable of storing data.

Next, the configuration of the server 20 will be explained. The server 20 includes a processor 21, a memory 22, a user interface 23, a communication interface 24, and a storage 25.

The processor 21 is an arithmetic unit that loads an operating system and various other programs into the memory 22 and executes instructions included in the loaded programs. The description regarding processor 11 also applies to processor 21 and the description regarding memory 12 also applies to memory 22.

The user interface 23 includes an input interface that receives input from an operator of the server 20 and an output interface that outputs various information under the control of the processor 21.

The communication interface 24 is implemented as hardware, firmware, communication software such as a TCP/IP driver or a PPP driver, or a combination thereof. The server 20 can send and receive data to and from other devices via the communication interface 22 .

Storage 25 is an external storage device accessed by processor 21. The storage 25 is, for example, a magnetic disk, an optical disk, a semiconductor memory, or any other type of storage device capable of storing data. The storage 25 can store sales detail data 25a, purchase detail data 25b, scenario data 25c, and score data 25d. Details of these data will be described later.

In the analysis system 1, there are no particular restrictions on the storage location of data. For example, various data that can be stored in the storage 15 may be stored in a storage that is physically separate from the user device 10 (for example, the storage 25 or the storage 30) or in a database server. Similarly, various data that can be stored in the storage 25 may be stored in a storage that is physically separate from the server 20 (for example, the storage 15 or the storage 30) or a database server. In FIG. 1, the storage 15 and the storage 25 are each illustrated as a single unit, but at least one of the storages 15 and 25 may be a collection of a plurality of physically separate storages. good. That is, in this specification, the data stored in the storage 15 and the data stored in the storage 25 may be stored in a single storage, or may be distributed and stored in a plurality of storages. Furthermore, in this specification and the claims, the term "storage" may refer to either a single storage or a collection of multiple storages, as long as the context allows.

Next, the functions of the user device 10 will be explained. The processor 11 of the user device 10 functions as a data transmission section 11a, a scenario selection section 11b, a data item selection section 11c, and an analysis result display section 11d by executing instructions included in a predetermined program.

As mentioned above, the user device 10 is assumed to be used by an auditor. The data transmitter 11a transmits detailed data regarding transactions and purchases of the company to be audited to the server 20. Detailed data is data that the auditor receives from the company being audited. The detailed data can include, for example, records regarding sales, purchases, financial activities, and various other data that auditors other than the above consider for financial statement audits in one accounting period of the company. The detailed data is, for example, tabular data.

As described above, the analysis system 1 can assume various fraud scenarios and calculate a score representing the probability of fraud for each of these various scenarios. Furthermore, the score may be calculated in units of data of data items included in the accounting data to be analyzed (in the above example, in units of data such as "department A" included in the data item "department"). The scenario selection unit 11b is capable of displaying a scenario selection screen on the display of the user device 10 for accepting the selection of an analysis target scenario to be analyzed from among multiple scenarios assumed by the analysis system 1. . The scenario selection screen may display scenario options that can be selected by the user. Due to this. The user device 10 can prompt the user to select an analysis target scenario to be analyzed. Further, the data item selection unit 11c displays an analysis target data selection screen on the display of the user device 10 for accepting the selection of data to be analyzed from among the data included in the accounting data analyzed by the server 20. The user can be prompted to select the data to be analyzed for which the score should be obtained. The options for data to be analyzed may be displayed together with the scenario options on the scenario selection screen.

An example of this scenario selection screen is shown in FIG. As shown in FIG. 11, the scenario selection screen includes an area 111 where scenario options are displayed, and a user interface 112 where analysis target data options are displayed. In the example shown in FIG. 11, two scenarios (“regular trading days” and “transactions concentrated on specific dates”) are displayed in area 111 along with checkboxes. The user can select a desired scenario by checking the checkbox corresponding to the scenario. The scenario shown in FIG. 11 is an example, and various scenarios other than those shown are possible. Two or more scenarios to be analyzed may be selected. The user interface 112 is a drum roll type user interface, and by operating this user interface, one of the data items included in the accounting data to be analyzed can be selected. In the illustrated example, "department" is selected as the data item to be analyzed. After selecting a data item, specific data (for example, "department A") included in the data item can be selected. Two or more pieces of data to be analyzed may be selected. When a scenario to be analyzed is selected in the area 111 and data to be analyzed is selected in the user interface 112, a decision button 113 labeled "Run Scenario" becomes selectable, and a scenario that specifies the selected scenario to be analyzed is selected. The server 20 is notified of specific data and analysis target specifying data that specifies the analysis target data.

The analysis result display unit 11d receives the score corresponding to the analysis target scenario from the server 20, and displays a score display screen including the received score on the display of the user device 10. When data to be analyzed is also selected, the score display screen may include a score calculated for each data to be analyzed. An example of the score display screen is shown in FIG. In Figure 12, two scenarios are selected for analysis: "regular trading days" and "transactions concentrated on specific dates", and "department A" to "department J" are selected as data for analysis. It is assumed that On the score display screen in FIG. 12, the scores calculated for each of the two scenarios of "regular trading days" and "transactions concentrated on specific dates" are displayed for each of departments A to J. ing. In the example of FIG. 12, since the scores of department A are relatively high for both "regular transaction days" and "transactions concentrated on specific dates," the user of the user device 10 Based on the scores included in this score display screen, it is possible to obtain an insight that there is a high probability that fictitious sales were recorded in department A. As shown in FIG. 12, on the score display screen, data may be displayed in a ranking format in descending order of scores. In the example in Figure 12, "Department A" with the highest average (score average) of the scores for "regular trading days" and "transactions concentrated on specific dates" is displayed at the top. . Based on this result, the auditor can investigate whether fictitious sales have been recorded in transactions involving department A.

Next, the functions of the server 20 will be explained. By executing instructions included in a predetermined program, the processor 21 of the server 20 operates a data reception section 21a, a mapping section 21b, an analysis section 21c, a scenario reception section 21d, a data item reception section 21e, and an analysis result output section 21f. functions as

The data reception unit 21a receives detailed data transmitted from the user device 10. The detailed data is, for example, detailed data transmitted by the data transmitting unit 11a of the user device 10.

The mapping unit 21b performs mapping processing to associate data items of detailed data received by the data receiving unit 21a with data items suitable for processing by the server 20. For example, the server 20 can calculate scores and perform other processing using the sales detail data shown in FIG. 2 and the purchase detail data shown in FIG. 3. In this case, the mapping unit 21b associates each of the data items of detailed data regarding transactions and purchases of the company to be audited with the data items of sales detailed data and purchase detailed data shown in FIGS. 2 and 3. The detailed data mapped by the mapping unit 21b is stored in the storage 25 as sales detailed data 25a and purchase detailed data 25b.

The sales details data 25a and the purchase details data 25b will be explained with reference to FIGS. 2 and 3. The sales detail data 25a is data indicating the sales details of the company to be audited, which is generated by the mapping unit 21b based on the detail data received from the user device 10. As shown in FIG. 2, the sales detail data 25a includes an identification number (sales ID) that uniquely identifies each record, "accounting date," "transaction amount," "transaction amount," and "gross profit." , "Business Partner," "Product," "Department," "Salesperson," and "Shipping Date" data values may be associated with each other. The data value of each item may be numerical data or text data. The purchase detail data is data that is generated by the mapping unit 21b based on the detail data received from the user device 10 and shows the purchase details of the audit target company. As shown in FIG. 3, the purchase details data 25b includes an identification number (purchase ID) that uniquely identifies each record, "purchase date", "transaction amount", "transaction amount", " The data set may be a data set in which data values of each data item of "product", "supplier", "department", and "sales person" are associated. The sales detail data 25a shown in FIG. 2 and the purchase detail data 25b shown in FIG. The purchase detail data that can be used by the analysis system 1 is not limited to that shown in FIG. 3. The sales detail data 25a may not include some of the data items shown in FIG. 2, or may include data items not shown in FIG. Similarly, the purchase detail data 25b may not include some of the data items shown in FIG. 3, or may include data items not shown in FIG.

The mapping unit 21b may associate the data items of the detailed data received by the data receiving unit 21a with data items suitable for processing by the server 20 based on rules. The detailed data received by the data reception unit 21a may include mapping information that specifies the correspondence between each data item of the detailed data and the data item of the accounting data to be analyzed. FIG. 9 shows an example of a mapping data input screen for inputting mapping information. Before transmitting the detailed data, the data transmitting unit 11a of the user device 10 displays a mapping data input screen on the display of the user device 10, and allows the user to input data items in the detailed data to be associated with each piece of accounting data to be analyzed. You may be prompted to input. As shown in FIG. 9, the mapping data input screen includes an input window 91 for inputting detailed data items corresponding to each of the data items included in the sales detailed data 25a, and an input window 91 for inputting detailed data items corresponding to each of the data items included in the sales detailed data 25a, and It includes an input window 92 for inputting data items of detailed data corresponding to each of the included data items. For example, the user can specify a data item in the detailed data to be associated with the "accounting date" of the sales detailed data 25a in the window 91 associated with "1. Accounting date" among the nine windows 91. . For example, by inputting the "sales date" included in the detailed data into the window 91 associated with "1. Accounting date", the "sales date" of the detailed data is associated with the "accounting date" of the sales detailed data 25a. be able to. Correspondence can be made in the same manner for other data items.

The mapping data input screen includes an automatic mapping button 93 for automatically mapping. When the automatic mapping button 93 is selected by the user, data items of the detailed data are associated with the sales detailed data 25a and the purchase detailed data 25b based on rules. Automatic mapping can associate each data item of detailed data with the data item of sales detailed data 25a and purchase detailed data 25b by applying a mapping model prepared by machine learning.

The mapping data input screen may include a scenario information area 94 that displays data items required for score calculation for each scenario. The user can refer to the information displayed in the scenario information area 94 to understand the data items necessary for calculating the score in each scenario. In the example shown in Figure 9, to calculate the score for the "regular trading day" scenario, the first data item (i.e., "accounting date"), the second data item (i.e., " It is shown that the data items ``transaction amount'') and the ninth data item (namely, ``shipment date'') are required. Since the detailed data is data managed by each company, it may not necessarily include data items corresponding to each data item of the sales detailed data 25a and the purchase detailed data 25b. Or, because the comprehensiveness of the data provided by the company to the auditor is insufficient, data corresponding to some of the data items included in the sales detail data 25a and the purchase detail data 25b may not be included in the detail data. There is a possibility that it is missing. By referring to the scenario information area 94 on the mapping data input screen, the user of the user device 10 can check whether the detailed data includes data items necessary for the scenario in which analysis is to be performed. . If the detailed data does not include data items necessary for the scenario in which the analysis is to be performed, the company can be requested to submit additional data.

In this specification, in order to distinguish the data set generated by the mapping unit 21b based on detailed data provided from the user device 10 from general accounting data, "accounting data to be analyzed" and "accounting data to be analyzed" are used. This is called "accounting data." The sales detail data 25a and the purchase detail data 25b are included in the accounting data to be analyzed.

The analysis unit 21c calculates a score for each of the plurality of scenarios by analyzing the accounting data to be analyzed according to the score calculation logic determined for each fraud scenario. FIG. 4 shows an example of scenario data 25c used by the analysis unit 21c to analyze target accounting data. As illustrated, the scenario data 25c includes scenario identification information that uniquely identifies each of a plurality of scenarios assumed by the server 20, a "scenario name," "required data item," and "calculation logic information." ” may be associated with the data set. “Scenario name” is text data representing the characteristics of the scenario or the name of the scenario. The "necessary data item" is data that specifies the data item used for calculating the score among the accounting data to be analyzed. The score calculation logic is data that specifies the logic used to calculate the score. The "calculation logic information" for a certain scenario may be information (for example, a function name) that specifies the logic used to calculate the score for the scenario. In the example of FIG. 4, the above-mentioned "regular trading day" is stored as the scenario name. In order to calculate the score based on this scenario, the data value of the "accounting date" on which the sales were recorded is required, so "sales details: recording date" is stored in the "required data item". The data required to calculate the score may change depending on the calculation logic. The illustrated scenario data 25c is an example, and the scenario data 25c applicable to the present invention is not limited to what is illustrated.

The analysis unit 21c may calculate a score for each piece of data included in a specific data item among a plurality of data items included in the accounting data to be analyzed. For example, if the data item "Department" among the data items of the sales detail data 25a to be analyzed includes data for "Department A" to "Department J", each of "Department A" to "Department J" Scores may be calculated individually. As described above, when an individual score is calculated for "Department A", the score is calculated using only the data related to "Department A" out of all the accounting data to be analyzed.

The score data 25d calculated by the analysis unit 21c is stored in the storage 25. FIG. 5 shows an example of the score data 25d. The score data 25d includes a score ID that identifies the score calculated by the analysis unit 21c, "scenario identification information" that identifies the scenario selected when calculating the score, and a specific data item that includes the calculation of the score. When the calculation is performed in data units, the data set may be a data set in which the "data unit" indicating the data that is the unit of score calculation and the calculated "score" are associated.

A specific example of how the analysis unit 21c calculates the score will be described with reference to FIGS. 6 and 7. FIG. 6 is an explanatory diagram illustrating a specific example of score calculation for the scenario of "regular trading days", and FIG. It is an explanatory view explaining a specific example. In the "regular trading day" scenario, the trading interval calculated from the accounting data to be analyzed is The score is calculated by comparing the model with the transaction interval model that does not include fictitious sales. In FIG. 6, the horizontal axis represents the number of days between transactions, and the vertical axis represents the number of transactions for each number of days between transactions. Graph 60 shows a distribution model of the number of transactions for each number of days between transactions, assuming that fictitious sales are not included. Graph 61 extracts transactions involving department F from the sales detail data 25a, and shows the distribution of the number of transactions for each number of days between transactions calculated based on the data extracted for department F. 1 extracts transactions involving department A from the sales detail data 25a, and shows the distribution of the number of transactions for each number of days between transactions calculated based on the data extracted for department A. The score of department F in the scenario of "regular trading days" is based on the graph 61 showing the relationship between the number of days between transactions and the number of transactions for department F, and the model of the number of days between transactions and the number of transactions when fictitious sales are not included. The Euclidean distance with respect to the graph 60 shown is calculated for each number of days between transactions, and the calculated Euclidean distances are added up and then normalized to a value in the range of 0 to 1.0. Similarly, the score of department A in the scenario of "regular trading days" was calculated by calculating the Euclidean distance between graph 62 for department A and graph 60 in the case of no fictitious sales for each number of days between transactions. The value is the sum of the Euclidean distances and normalized to a range of 0 to 1.0.

In the example shown in FIG. 6, the total Euclidean distance between graph 62 and graph 60 is greater than the total Euclidean distance between graph 61 and graph 60, so department A The score for department F becomes greater than the score for department F. Similar calculations are performed for each of departments A to J. The score may be calculated for each data item of other data items. For example, the score may be calculated according to the same score calculation logic for each data included in the "Business Partner" data item, the data included in the "Product" data item, and the data included in the "Salesperson" item. . By calculating a score for each business partner, it is possible to gain insight into the possibility that a specific business partner is involved in fictitious sales. By calculating a score for each product, it is possible to gain insight into the possibility that a particular product is being used for fictitious transactions. By calculating a score for each salesperson, it is possible to gain insight into whether a particular salesperson may be involved in fictitious transactions. Based on these insights, auditors can investigate whether fictitious sales are occurring in specific departments, specific accounts, specific products, and/or specific sales personnel. . Obtaining such a hypothesis or insight can be expected to increase the accuracy of detecting fraud.

In the scenario of "transactions concentrated on a specific date," based on the hypothesis that the more transactions occur on the same day every month, the higher the risk of fictitious sales, the "accounting date" included in the sales detail data 25a to be analyzed is A score is calculated by comparing transaction date data obtained by removing year and month information from a model of the distribution of transaction days that does not include fictitious sales. In FIG. 7, the horizontal axis represents transaction date data (integers from "1" to "31"), and the vertical axis represents the number of transactions on each trading day. The graph 70a is a graph in which the value on the vertical axis is the total number of transactions of department F divided by 365 during the accounting period (one year) in which the accounting data to be analyzed was recorded. In other words, the graph 70a shows the average number of transactions per day for department F during the year in which the accounting data to be analyzed was recorded. Similarly, graph 70b shows the average number of transactions per day for department A during the year in which the accounting data to be analyzed was recorded. Graph 71 is a graph that extracts transactions involving department F from the sales detail data 25a and shows the distribution of the number of transactions for each transaction day based on the data extracted for department F. It is a graph showing the distribution of the number of transactions for each transaction day calculated based on the extracted data for the department A by extracting transactions in which the department A was involved from the detailed data 25a. The score of department F in the scenario of "transactions concentrated on a specific date" is calculated by calculating the Euclidean distance between the graph 71 showing the relationship between the transaction date and the number of transactions for department F and the graph 70a showing the average number of transactions for department F. It is calculated for each day, the calculated Euclidean distance is added up, and the value is normalized to a range of 0 to 1.0. Similarly, the score of department A in the scenario of "transactions concentrated on a specific date" is determined by calculating the Euclidean distance between the graph 72 for department A and the graph 70b showing the average number of transactions of department A for each transaction date. Then, the calculated Euclidean distances are added together and then normalized to a value in the range of 0 to 1.0. In the example shown in FIG. 7, the value obtained by normalizing the sum of the Euclidean distances between the graph 72 and the graph 70b is larger than the value obtained by normalizing the sum of the Euclidean distances between the graph 71 and the graph 70a. The score for department A is also higher than the score for department F for ``transactions concentrated on the date of''.

The scenario receiving unit 21d specifies which scenario has been selected from among the plurality of scenarios assumed by the server device 20, based on the scenario specifying data that specifies the analysis target scenario transmitted from the user device 10.

The data item reception unit 21e specifies the data to be analyzed based on the data to be analyzed that specifies the data to be analyzed that is transmitted from the user device 10.

The analysis result output unit 21f extracts one or more scores corresponding to the analysis target scenario specified by the scenario reception unit 21d and the analysis target data specified by the data item reception unit 21e from the score data 25d, and extracts the extracted score. is transmitted to the user device 10.

Next, with reference to FIG. 8, a flow of a score calculation process for calculating a score representing the probability of fraud based on accounting data will be described. First, in step S11, detailed data is transmitted from the user device 10 to the server 20, and this detailed data is received by the server 20. The user device 10 may send the detailed data received from the company to be audited to the server 20 as is, or it may send the detailed data to the server 20 after specifying that it should be handled based on the mapping data input screen shown in FIG. You can also send it.

Next, the process proceeds to step S12, and in step S12, accounting data to be analyzed is generated to be mapped to the detailed data received by the server 20. For example, sales detail data 25a and purchase detail data 25b may be generated based on the detail data. The mapping process in step S12 may be performed by the mapping unit 21b described above.

Next, the process proceeds to step S13. In step S13, a score indicating the probability that fraud exists in the accounting data to be analyzed is calculated for each of the plurality of scenarios based on the accounting data to be analyzed generated in step S12. The score may be calculated for each piece of data included in a specific data item among a plurality of data items included in the accounting data to be analyzed. For example, a score may be calculated individually for each piece of data ("department A" to "department J") included in the data item "department". The calculation of the score is performed, for example, in the above-mentioned analysis section 21c. The score calculated as described above is stored in the storage 25 as score data 25d.

Next, with reference to FIG. 10, the flow of score output processing for outputting scores will be described. First, in step S21, the user of the user device 10 selects a scenario to be analyzed as an analysis target scenario. The analysis target scenario is selected on the scenario selection screen shown in FIG. 11, for example. Multiple scenarios to be analyzed may be selected.

Once the scenario to be analyzed is selected, the process proceeds to step S22. In step S22, data that the user wants to analyze is selected as analysis target data. The data to be analyzed is selected in response to an operation on the user interface 112 on the scenario selection screen shown in FIG. Multiple pieces of data to be analyzed may be selected.

When the enter button is selected on the scenario selection screen, the server 20 is notified of the scenario specifying data that specifies the analysis target scenario selected in step S21 and the analysis target specifying data that specifies the analysis target data selected in step S22. Ru.

Next, the process proceeds to step S23. In step S23, scores corresponding to the analysis target scenario specified by the scenario specification data and the analysis target data specified by the analysis target specification data are extracted from the score data 25d, and the extracted scores are stored in the user device 10. displayed on the display. The score is extracted and transmitted to the user device 10, for example, by the above-mentioned analysis result output unit 21f. In the user device 10, the score display screen illustrated in FIG. 12 is displayed on the display. The score display screen includes a score corresponding to the analysis target data specified by the analysis target specifying data. Based on the score displayed on the score display screen, the user of the user device 10 can obtain the score of the data that the user desires to analyze regarding the scenario that the user desires to analyze. A user (mainly an auditor) of the user device 10 can efficiently audit financial statements based on the scores displayed on the score display screen. For example, in the example shown in Figure 12, the score indicating the probability that fictitious sales fraud has been committed regarding department A is displayed high, so fictitious sales are not recorded in transactions involving department A. You can investigate whether there are any.

In the processing procedures explained in this specification, especially the processing procedures explained using flowcharts, some of the steps constituting the processing procedures may be omitted, and some of the steps constituting the processing procedures may be omitted. It is possible to add steps that are not explicitly specified and/or change the order of the steps, and such omissions, additions, and changes in the order of processing procedures are also included in the present invention as long as they do not depart from the spirit of the present invention. within the scope of the invention. For example, step S21 and step S22 shown in FIG. 10 can be processed in parallel, and step S22 can also be executed before step S21.

Even if processes and procedures described herein are described as being performed by a single device, software, component, or module, such processes or procedures may be performed by multiple devices, software, components, or modules. components and/or multiple modules. Further, even if data, tables, or databases described herein are described as being stored in a single storage device (storage or memory), such data, tables, or databases are The information may be stored in a distributed manner in a plurality of storage devices included in one device or in a plurality of storage devices distributed among a plurality of devices. Additionally, the software and hardware elements described herein can be implemented by integrating them into fewer components or decomposing them into more components.

1 analysis system 10 user device 20 server

Claims (6)

An analysis program for analyzing accounting data,
to one or more processors,
a function that causes a user device to display a screen that accepts the selection of a scenario to be analyzed from among multiple scenarios each related to a different type of fraud;
a function of displaying, on the user device, an analysis target score corresponding to the analysis target scenario, which is an index indicating the probability that fraud is included in the accounting data to be analyzed, and among the scores calculated for each of the plurality of scenarios; ,
An analysis program that runs The score is calculated for each data included in a target data item among a plurality of data items included in the accounting data for each of the plurality of scenarios,
the one or more processors,
Execute a function that accepts selection of analysis target data from data included in the target data item,
The analysis target score is a score calculated for the analysis target data among the plurality of scores,
The analysis program according to claim 1. causing the one or more processors to execute a function of displaying, on the user device, necessary data items necessary for calculating the score for each of the plurality of scenarios, among the plurality of data items of the accounting data; The analysis program according to claim 2. causing the one or more processors to execute a function of generating the accounting data based on detailed data received from the user device;
The analysis program according to any one of claims 1 to 3. a storage unit that stores accounting data;
a score calculation unit that calculates a score representing the probability that fraud is included in the accounting data for each of a plurality of scenarios, each of which is related to a different type of fraud;
An analysis device equipped with. An analytical method for analyzing accounting data by one or more processors executing computer-readable instructions, the method comprising:
Displaying on the user device a screen for accepting the selection of a scenario to be analyzed from a plurality of scenarios, each of which is related to a different type of fraud;
displaying on the user device an analysis target score corresponding to the analysis target scenario, which is an index indicating the probability that fraud is included in the accounting data to be analyzed, and among the scores calculated for each of the plurality of scenarios; ,
An analysis method comprising: