JP2019159709A - Information management system and information management method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To extract data suspected of being illegally handled. An information management system including a processor and a storage device connected to the processor, wherein the storage device includes data indicating a fraudulent case, data indicating an organization corresponding to the fraudulent case, and a determination target. The data showing the case and the data showing the organization corresponding to the case to be judged are held, the calculation standard of the similarity between the case to be judged and the case of fraud is held, and the processor corresponds to the case of fraud. The degree of organizational relevance, which indicates the strength of the relationship between the organization and the organization corresponding to the case to be judged, is calculated, and the degree of similarity between the fraudulent case and the case to be judged is calculated and calculated based on the similarity calculation standard. Based on the degree of similarity and the degree of organizational relevance, it is determined whether the case to be determined is suspected of being fraudulent, and the result of the determination is output. [Selection diagram] Fig. 1

Description

  The present invention relates to a technique for managing information.

  In recent years, a technology called RPA (Robotic Process Automation) that automates a part of the work that humans have performed has been attracting attention as the decline in the working population is regarded as a problem. This technology actually starts to be applied to routine work, and non-routine work will be introduced in the future, and 49% of the current industry will be automated in 10 to 20 years.

  On the other hand, in corporate accounting, thorough internal audit control proves to investors that profits are not inflated, and leads to a reduction in information asymmetry between management and investors. As a result, it has the effect of reducing agency costs and increasing corporate value (reputation hypothesis on audit quality).

  In recent years, the existence of fraudulent accounting, especially in large corporations, has been viewed as a problem, and there is an increasing need for externally demonstrating the effectiveness of internal control. For such needs, a mechanical audit system that can submit the operation history as an objective trail of internal audit control is effective. For this reason, it is required to increase the viewpoint that the audit system controls the accounting data and to increase the effectiveness of the audit system.

  As a technique for supporting monitoring of illegal handling such as falsification or concealment of data, there is a technique described in Patent Document 1, for example. In Patent Document 1, in an investigation of insurance payments to a subscriber performed by an insurance company, if the investigation is incomplete, an illegal technique is associated based on the input information that has been established, and this associated illegal technique is objectively viewed. It describes a mechanism for inferring and displaying items that should be investigated for proving.

JP-A-6-119355

  According to the technique described in Patent Document 1, it is instructed which of unclear items should be investigated for a single case. However, if this technology is applied to a company's man-hour management, for example, there are a large number of projects, such as several hundred to several thousand per month. Become. In addition, in the case of fraud related to company man-hour management, etc., documents may be repaired so that they appear to be in the correct state, and the repaired state is personal. Organizational information should also be considered.

  In order to solve at least one of the above problems, the present invention provides an information management system having a processor and a storage device connected to the processor, wherein the storage device is data indicating an illegal case, Data indicating an organization corresponding to the fraud case, data indicating a case to be determined, and data indicating an organization corresponding to the case to be determined are stored, and the case of the determination target and the case of the fraud Holding a calculation criterion of similarity, the processor calculates an organization relevance indicating the strength of association between the organization corresponding to the fraud case and the organization corresponding to the determination target case, and the similarity Based on the calculation criteria, the similarity between the case of fraud and the case of the determination target is calculated, and whether the case of the determination target is suspected of fraud based on the calculated similarity and the organization relevance Size And, and outputs the result of the determination.

  According to the present invention, it is possible to extract not only data that has become invalid by falsifying data once created, but also data that has been created for the first time as a case of suspected fraud. At this time, by taking into account the degree of association of the organization, it is possible to extract cases that are more suspected of fraud.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a block diagram which shows the logic structure of the man-hour management system which concerns on Example 1 of this invention. It is a block diagram which shows the hardware constitutions of the man-hour management system which concerns on Example 1 of this invention. It is explanatory drawing of the man-hour data stored in the man-hour management DB which concerns on Example 1 of this invention. It is explanatory drawing of the PJ data stored in PJ management DB which concerns on Example 1 of this invention. It is explanatory drawing of the fraud determination rule which the man-hour transfer determination function which concerns on Example 1 of this invention refers. It is a flowchart which shows the process which the man-hour transfer determination function based on Example 1 of this invention performs. It is explanatory drawing of the warning screen which the display function which concerns on Example 1 of this invention displays as a result of the process of a man-hour transfer determination function. It is explanatory drawing of the case data stored in case record DB which concerns on Example 1 of this invention. It is a flowchart which shows the process which the case similarity calculation function which concerns on Example 1 of this invention performs. It is explanatory drawing of the man-hour data which the case similarity calculation function which concerns on Example 1 of this invention refers for the present case creation process. It is explanatory drawing of the PJ data which the case similarity calculation function based on Example 1 of this invention refers for the present case creation process. It is explanatory drawing of the present case data which the case similarity calculation function which concerns on Example 1 of this invention produces by the present case preparation process. It is explanatory drawing of the organization data which the case similarity calculation function which concerns on Example 1 of this invention refers for a organization relevance determination process. It is explanatory drawing of the organization relevance determination criterion which the case similarity calculation function based on Example 1 of this invention refers for a tissue relevance determination process. It is explanatory drawing of the organization relevance data which the case similarity calculation function which concerns on Example 1 of this invention produces by an organization relevance determination process. It is a flowchart which shows the similar past case determination process which the case similarity calculation function which concerns on Example 1 of this invention performs. It is explanatory drawing of the similar past case determination standard which the case similarity calculation function based on Example 1 of this invention refers for a similar past case determination process. It is explanatory drawing of the similar case list | wrist which the case similarity calculation function based on Example 1 of this invention produces by a similar past case determination process. It is a flowchart which shows the display case determination process which the case similarity calculation function which concerns on Example 1 of this invention performs. It is explanatory drawing of the warning screen which the display function which concerns on Example 1 of this invention displays as a result of the process of a case similarity calculation function. It is a block diagram which shows the logic structure of the man-hour management system which concerns on Example 2 of this invention. It is explanatory drawing of the communication record data which the case similarity calculation function which concerns on Example 2 of this invention refers for an organization relevance determination process. It is explanatory drawing of the organization relevance determination criterion which the case similarity calculation function based on Example 2 of this invention refers for a tissue relevance determination process. It is explanatory drawing of the organization relevance data which the case similarity calculation function which concerns on Example 2 of this invention produces by an organization relevance determination process. It is a flowchart which shows the process which the man-hour management system which concerns on Example 3 of this invention performs.

  Hereinafter, several embodiments of the present invention will be described with reference to the drawings. However, these examples are merely examples for realizing the present invention, and do not limit the technical scope of the present invention.

  FIG. 1 is a block diagram illustrating a logical configuration of a man-hour management system 100 according to the first embodiment of the present invention.

  The man-hour management system 100 manages information related to the man-hours of work of a plurality of workers 120. Further, the man-hour management system 100 is a process for assisting the inspector 130 to determine whether the information on the man-hours being managed is different from the actual state due to an unauthorized operation such as falsification or false input. Execute.

  The man-hour management system 100 includes a project (PJ) data input function 101, a man-hour recording function 102, a man-hour transfer determination function 103, a case similarity calculation function 104, a recording instruction function 105, and a display function 114. Furthermore, the man-hour management system 100 holds a man-hour management database (DB) 111, a PJ management DB 112, an organization management DB 113, and a case record DB 114.

  The PJ data input function 101 accepts input of information related to the project from the worker 120 and stores it in the PJ management DB 112. The man-hour recording function 102 accepts input of information related to man-hours from the worker 120 and stores it in the man-hour management DB 111.

  The man-hour transfer determination function 103 determines whether or not man-hours are transferred based on data stored in the man-hour management DB 111 and the PJ management DB 112. The display function 106 displays the result of determination by the man-hour transfer determination function 103 to the inspector 130. The inspector 130 determines whether or not to record the result of the determination based on the displayed result. If it is determined to record, the inspector 130 issues an instruction to record the result of the determination by the man-hour transfer determination function 103. Input to the management system 100. The record instruction function 105 receives an instruction input from the inspector 130 and stores the result of determination by the man-hour transfer determination function 103 in the case record DB 114.

  The case similarity calculation function 104 includes a man-hour case (current case) newly recorded via the man-hour recording function 102 based on the man-hour management DB 111, the PJ management DB 112, the organization management DB 113, and the case record DB 114, and a case record. The similarity with the past case (past case) stored in the DB 114 is calculated.

  Here, the past case is a fraud case to be detected from now on, for example, a fraud case actually performed in the past. On the other hand, the current case is a case for which it is determined whether fraud is suspected. The case similarity calculation function 104 calculates the similarity between the current case and the past case, and considers whether the current case is suspected of fraud, taking into account the degree of association between the current case and the past case. judge.

  The display function 106 displays information indicating the similarity calculated by the case similarity calculation function 104.

  FIG. 2 is a block diagram illustrating a hardware configuration of the man-hour management system 100 according to the first embodiment of the present invention.

  The man-hour management system 100 is a computer system having a network interface 206, a processor 201, a memory 202, a storage device 203, an input device 204, and an output device 205 that are communicably connected to each other.

  The network interface 206 is an interface device that is connected to a network (not shown) and communicates with other devices (not shown) via the network. The processor 201 executes various processes according to programs stored in the memory 202.

  The memory 202 is a main storage device such as a DRAM (Dynamic Random Access Memory), for example, and stores a program executed by the processor 201, data referred to by the processor 201, and the like. In this embodiment, the memory 202 stores at least programs for realizing the PJ data input function 101, the man-hour recording function 102, the man-hour transfer determining function 103, the case similarity calculation function 104, the recording instruction function 105, and the display function 114. The In the present embodiment, the processing executed by each unit described above is actually performed by the processor 201 by controlling each unit in the man-hour management system 100 as necessary in accordance with an instruction described in a program stored in the memory 202. Will run.

  The storage device 203 is a relatively large capacity storage device such as a hard disk drive or a flash memory. The storage device 203 of this embodiment stores, for example, a man-hour management database DB 111, a PJ management DB 112, an organization management DB 113, and a case record DB 114.

  At least a part of the data stored in the storage device 203 may be copied to the memory 202 as required by the processor 201. 1 may also be stored in the storage device 203, and at least a part of the program may be copied to the memory 202 as necessary.

  The input device 204 is a device that receives input of information from users of the man-hour management system 100 such as the worker 120 and the inspector 130, and may include, for example, a keyboard or a mouse. For example, the PJ data input function 101, the manhour recording function 102, and the recording instruction function 105 may be realized by the processor 201 controlling the input device 204 according to a program stored in the memory 202.

  The output device 205 is a device that outputs information to the user, and may include an image display device such as a liquid crystal display device. For example, the display function 106 may be realized by the processor 201 controlling the output device 205 according to a program stored in the memory 202.

  FIG. 3 is an explanatory diagram of the man-hour data 300 stored in the man-hour management DB 111 according to the first embodiment of the present invention.

  The man-hour data 300 is information regarding the man-hours of work performed by each person in the organization, and includes a worker 301, a department 302, a case 303, and an engagement time 304.

  The worker 301 is information (for example, a name or the like) that identifies the person who performed the work (that is, the worker 120). The department 302 is information for identifying an organization to which each person belongs. In this embodiment, the department 302 is the name of the section to which each person in the company belongs (for example, X section Y section). This is an example, and information identifying an organization of an arbitrary granularity within the company, such as a department, a staff, or a group to which each person belongs, can be used as the department 302.

  The case 303 is information for identifying the project to which the work belongs. Here, a project is, for example, a set of work that is a unit for creating a budget and calculating profits. In the present embodiment, it is described as a project or a project, but may be called by another name. The engagement time 304 is a time of work belonging to each case performed by each person within a predetermined period.

  FIG. 3 shows man-hour data 300A (FIG. 3A), 300B (FIG. 3B) and 300C (FIG. 3C) as examples of man-hour data 300. The man-hour data 300 </ b> A is data registered on March 1, 2017, and includes an average value of the working hours of each person in each month from October 2016 to February 2017. For example, the first record of the man-hour data 300A is the average per month for the period from October 2016 to February 2017, when Mr. S, who belongs to the X department Y section, belongs to the project A company maintenance. Shows that he has worked for 10 hours.

  The man-hour data 300B is data registered on March 31, 2017, and includes the engagement time of each person for one month in March 2017. On the other hand, the man-hour data 300C is data registered on April 1, 2017, and includes the engagement time of each person for one month in March 2017. Since the man-hour data 300B and 300C are data related to the same period, the working time corresponding to each project of each person in both should be the same.

  However, in the example of FIG. 3A and FIG. 3B, the working time related to the maintenance of Company A of Mr. J Island belonging to the X section Y section is corrected from 0 hour in the manhour data 300B to 110 hours in the manhour data 300C. In addition, the engagement time concerning the maintenance of the same company by Mr. J Island is corrected from 110 hours in the manhour data 300B to 0 hour in the manhour data 300C. This indicates that an input for correcting the engagement time of Mr. J Island was made on April 1.

  Such correction may be made to correct the registration content before the change, for example, if it is incorrect (ie, it is a legitimate correction). For example, for the purpose of adjusting profit, In some cases (ie, unauthorized modification). Here, an example in which unauthorized correction (that is, falsification) is performed will be described.

  There are various purposes and means for unauthorized correction. Typical fraudulent objectives include, for example, replacing a deficit that occurred in one project with another project, and postponing a deficit that occurred in one period to a later period. In this embodiment, as an example, a case where fraud for the purpose of the former is performed will be described.

  For example, if there are deficits in multiple projects organized by a department, the number of projects with deficits can be reduced by consolidating those deficits into one project. It is done to make it appear. In this case, typically, the cost of a project in which a deficit has occurred (for example, work man-hours) is rewritten to the cost of a project in which another deficit has occurred so that the project is in the black. The correction of Mr. J's engagement time in the example of FIG. 3 is performed for such a purpose.

  FIG. 4 is an explanatory diagram of the PJ data 400 stored in the PJ management DB 112 according to the first embodiment of the present invention.

  The PJ data 400 is information related to a project organized by an organization, and includes a gathering department 401, a matter 402, a completion date 403, and a profit rate 404. The management department 401 is information for identifying an organization (for example, a department such as the X section and the Y section) that organizes each project. The item 402 is information for identifying each project. The work completion date 403 is a date when each project is completed (or scheduled to be completed). In other words, the man-hours (that is, the cost) of the work belonging to the project does not occur after the work completion date of each project. Profit rate 404 is the profit rate of each project.

  FIG. 4 shows, as an example of the PJ data 400, PJ data 400A related to a project in March 2017 of the X department Y section. In this example, both Company A maintenance and Company B maintenance, which are projects compiled by Department X, Y Division, were completed in March 2017, the former profit margin was -80% (ie, in red), and the latter This shows that the profit rate is 3% (that is, surplus).

  FIG. 5 is an explanatory diagram of the fraud determination rule 500 referred to by the man-hour transfer determination function 103 according to the first embodiment of the present invention.

  The fraud determination rule 500 may be stored on the memory 202 as a part of a program for realizing the man-hour transfer determination function 103, or may be stored on the memory 202 as data referred to by the program. Good.

  In FIG. 5, as an example of the fraud determination rule 500, the amount of the modified engagement time exceeds 100 hours, and the correction source matter calculated based on the corrected engagement time (that is, the shift source of engagement time) The rule X for determining that the correction is an illegal correction when the profit rate of the project) is in the range of 0% to 5%.

  FIG. 5 shows, as an example, a fraud determination rule 500 for detecting fraud in which a deficit generated in one project is replaced with another project. When such fraud is performed, it is generally necessary to move a certain amount of man-hours between projects. Therefore, as described above, the corrected amount of engagement time has a predetermined threshold (for example, 100 hours). The standard of exceeding is included. In addition, there are various purposes for improper correction, and there are also various specific correction methods used for that purpose. For this reason, the man-hour transfer determination function 103 may include a plurality of fraud determination rules 500 suitable for each purpose and correction method.

  FIG. 6 is a flowchart illustrating processing executed by the man-hour transfer determination function 103 according to the first embodiment of the present invention.

  The man-hour transfer determination function 103 compares the man-hour data 300 included in the man-hour management DB 111 and the PJ data 400 included in the corresponding PJ management DB 112 with the fraud determination rule 500, and the man-hour data 300 and the PJ data are determined as the fraud determination rule 500. If this is the case, the value of the illegal flag is set to 1 (step 603). Note that the initial value of the fraud flag is zero.

  Next, the man-hour transfer determination function 103 determines whether or not the value of the fraud flag is 1 (step 604). If it is 1 (step 604: Yes), the man-hour data to be determined is stored in the corresponding department. Including the past man-hour data is sent to the display function 106 and the case record DB 114, and the fraud flag is set to 0 (step 605). In this case, the display function 106 displays a warning screen (see FIG. 7). When the value of the fraud flag is 0 (step 604: No), the man-hour transfer determination function 103 does not execute step 605.

  The man-hour transfer determination function 103 repeatedly executes the above steps 603 to 605 for all fraud determination rules 500 and all man-hour data 300 (loop 602 and loop 601).

  FIG. 7 is an explanatory diagram of a warning screen 700 displayed by the display function 106 according to the first embodiment of the present invention as a result of the process of the man-hour transfer determination function 103.

  For example, when the man-hour transfer determination function 103 compares the man-hour data 300 shown in FIG. 3 and the fraud determination rule 500 shown in FIG. 5 at step 603 in FIG. Therefore, the correction time amount exceeds 100 hours. In addition, the profit rate of the maintenance of company B, which is the 110-hour source project, is 3% as shown in FIG. 4, and is in the range of 0% to 5%. For this reason, the value of the illegal flag is 1, and step 605 is executed. An example of the warning screen 700 displayed at this time is shown in FIG.

  The warning screen 700 includes, in addition to the display 701 indicating that a case suspected of being fraudulent has been discovered, the identification information 702 of the fraud determination rule 500 used for the determination (in this example) Rule X) and data 703 determined to correspond to the fraud determination rule 500 (in this example, the profit ratio of the X section Y section in the second half of FY2016 and the man-hours in March) are displayed. In this example, since the project manager (PM) of the X section Y section is Mr. Sada, the name is also displayed.

  Further, the warning screen 700 includes a Yes button 704 and a No button 705 together with a message for inquiring whether to record a case. When the inspector 130 refers to the warning screen 700 and determines that an unauthorized correction has been made, the inspector 130 operates the Yes button (for example, places the mouse cursor on the Yes button and clicks it). When the Yes button is operated, case data generated from the man-hour data 300 and the PJ data 400 that are the objects of determination are stored in the case record DB 114 as past cases.

  As described above, by displaying data that is suspected of fraud based on a predetermined fraud determination rule, allowing the auditor 130 to determine whether there is fraud, and recording what is determined to be fraud, Accumulation of appropriate past case data is supported.

  FIG. 8 is an explanatory diagram of the case data 800 stored in the case record DB 114 according to the first embodiment of the present invention.

  The case data 800 is generated based on the man-hour data 300, the PJ data 400, and the like, and information related to the man-hours of work performed by a person belonging to any organization on one or more projects in a predetermined period, and the one or more Information on profits for the predetermined period of the project. FIG. 8 shows, as an example, case data 800 stored corresponding to the example shown in FIGS. 6 and 7 described above. Specifically, the case data 800 includes a case name 801, a department 802, a case 803, a profit rate 804, a work completion date 805, a worker 806, an average of 807 working hours for October and February, and a work for March. Includes time 808.

  The case name 801 is information for identifying the stored case. The case name 801 may include information indicating the date on which this case is registered. The department 802 is information for identifying the department corresponding to the manhour data 300 and the PJ data 400 determined to correspond to the fraud determination rule 500, and specifically, the department 302 in FIG. 3 and the managing department 401 in FIG. Corresponding to

  The case 803 is information for identifying a project corresponding to the manhour data 300 and the PJ data 400 determined to correspond to the fraud determination rule 500, and specifically corresponds to the case 303 in FIG. 3 and the case 402 in FIG. To do. The profit rate 804 corresponds to the profit rate 404 of the PJ data 400 determined to fall under the fraud determination rule 500.

  The work completion date 805 corresponds to the work completion date 403 of the PJ data 400 determined to correspond to the fraud determination rule 500. The worker 806 corresponds to the worker 301 of the man-hour data 300 determined to correspond to the fraud determination rule 500.

  The average 807 of the working hours in October-February corresponds to the working time 304 of the man-hour data 300A from October to February among the man-hours 304 included in the man-hour data 300 determined to correspond to the fraud determination rule 500. To do.

  The engagement time 808 in March is the manhour data 300C for March after the correction on April 1 among the engagement time 304 included in the manhour data 300 determined to correspond to the fraud determination rule 500. This corresponds to the working time 304.

  FIG. 9 is a flowchart illustrating processing executed by the case similarity calculation function 104 according to the first embodiment of the present invention.

  First, the case similarity calculation function 104 executes the current case creation process 901 based on the man-hour management DB 111 and the PJ management DB 112. Details thereof will be described with reference to FIGS.

  FIG. 10 is an explanatory diagram of the man-hour data 300 referred to by the case similarity calculation function 104 according to the first embodiment of the present invention for the current case creation processing.

  Here, man-hour data 300D (FIG. 10 (a)) and man-hour data 300E (FIG. 10 (b)) are shown as examples of the man-hour data 300 that the case similarity calculation function 104 refers to for the current case creation processing.

  The man-hour data 300D is data registered on March 1, 2018, and includes information on man-hours (average value per month) from October 2017 to February 2018 for persons belonging to the Z section Y section. Including. The man-hour data 300E is data registered on April 1, 2018, and includes information on man-hours in March 2018 of persons belonging to the Z section Y section.

  These examples indicate that each person who belongs to the Z section Y section engaged in at least one of two projects of X development and Y development during the period from October 2017 to March 2018.

  FIG. 11 is an explanatory diagram of the PJ data 400 that the case similarity calculation function 104 according to the first embodiment of the present invention refers to for the current case creation process.

  FIG. 11 shows PJ data 400B related to a project in March 2018 of the Z section W section as an example of the PJ data 400. In this example, both X development and Y development, which are projects organized by the Z Department W Division, were completed during March 2018, the former profit margin was -70% (ie, deficit), and the latter profit margin. Is 2% (ie, surplus).

  FIG. 12 is an explanatory diagram of the current case data 1200 created by the case similarity calculation function 104 according to the first embodiment of the present invention by the current case creation process.

  FIG. 12 shows, as an example, current case data 1200 created based on the manhour data 300D and 300E and the PJ data 400B shown in FIGS. The current case data 1200 includes a department 1201, a project 1202, a profit rate 1203, a completion date 1204, a worker 1205, an average of 1206 working hours for October to February, and a working time 1207 for March.

  The department 1201 is information for identifying an organization corresponding to the man-hour data 300 and the PJ data 400 that is the basis for creating the current case data 1200, and corresponds to the department 302 in FIG. 10 and the summary department 401 in FIG.

  The case 1202 is information for identifying a project corresponding to the man-hour data 300 and the PJ data 400, which is the basis for creating the current case data 1200. Specifically, the case 1202 includes the case 303 in FIG. 10 and the case 402 in FIG. Correspond. The profit rate 1203 corresponds to the profit rate 404 of the PJ data 400 that is the basis for creating the current case data 1200.

  The work completion date 1204 corresponds to the work completion date 403 of the PJ data 400 that is the basis for creating the current case data 1200. The worker 1205 corresponds to the worker 301 of the man-hour data 300 that is the basis for creating the case data 1200 at present.

  The average 1206 of the working hours in October-February is the working time 304 of the man-hour data 300D from October to February, among the man-hours 304 included in the man-hour data 300 that is the basis for creating the current case data 1200. Correspond.

  The working time 1207 in March is the man-hour data 300E for March after the correction on April 1 among the working time 304 included in the man-hour data 300 which is the basis for creating the current case data 1200. Corresponds to the engagement time 304 of

  It should be noted that the department 1201, the project 1202, the profit rate 1203, the work completion date 1204, the workers 1205, the average engagement time 1206 of October-February, and the March engagement time 1207 are respectively the department 802 and the project 803 of FIG. , Profit rate 804, work completion date 805, worker 806, average 807 of work hours for October to February and work time 808 for March. When the similarity between the two is determined later, the values of the corresponding items are referred to.

  Refer to FIG. 9 again. The case similarity calculation function 104 executes an organization relevance determination process 902. Note that the tissue association degree determination process 902 may be executed at any time as long as it is before step 1604 in FIG. For example, the organization relevance determination process 902 may be executed before the current case creation process 901. Details of the tissue relevance determination processing 902 will be described with reference to FIGS.

  FIG. 13 is an explanatory diagram of the organization data 1300 that the case similarity calculation function 104 according to the first embodiment of the present invention refers to for the organization relevance determination process.

  The organization management DB 113 holds information on all organizations (for example, a plurality of departments in one company) that are managed by the man-hour management system 100, such as information on the members of each organization. The organization data 1300 illustrated in FIG. 13 is extracted from the organization management DB 113, and is a period from October 2017 to March 2018 (that is, a period corresponding to the current case data 1200 illustrated in FIG. 12). At least in part, it includes information on the position of the person who belonged to the Z section W section (that is, the organization corresponding to the current case data 1200 illustrated in FIG. 12) and the organization to which the person belongs in the past year.

  Specifically, the organization data 1300 includes a worker 1301, a post 1302, a 2015 affiliation 1303, a 2016 affiliation 1304, and a 2017 affiliation 1305.

  The worker 1301 is information for identifying each person. The title 1302 indicates the title of each person in the Z section W section. 2015 affiliation 1303-2017 affiliation 1305 indicates the organization to which each person belonged in 2015-2017.

  FIG. 14 is an explanatory diagram of the tissue relevance determination criterion 1400 that the case similarity calculation function 104 according to the first embodiment of the present invention refers to for the tissue relevance determination processing.

  The organization relevance criterion 1400 may be held on the memory 202 as a part of a program for realizing the case similarity calculation function 104, or held on the memory 202 as data referred to by the program, for example. May be.

  14 includes a criterion “same organization: 100%”. This is because, when two organizations are compared, if the organizations are the same organization (for example, both are the Z section W section), the organization relevance of the organizations is determined to be 100%. It is shown that.

  Furthermore, the organization relevance criterion 1400 includes a criterion of “Department of the section manager one year ago: 80%”. This means that, when comparing two organizations, if the manager of one organization belongs to the other organization one year ago, it is determined that the relevance of those organizations is 80%. Is shown.

  As in the above, the organization relevance criterion 1400 indicates the degree of organization relevance when the manager, chief, person in charge, etc. of one organization belongs to the other organization one year ago, two years ago, etc. Standards are included. The larger the percentage value of the degree of association, the higher the degree of association between the two organizations (that is, the stronger the association).

  In the example of FIG. 14, it is determined that the degree of relevance of these organizations is higher as the status of the person belonging to the organization in the past is higher in the current organization. This is because a person with a higher position in the current organization is more likely to divert the fraudulent method performed in the organization to which the person belonged in the past to the current organization. That is, the degree of organization relevance can also be said to be an index indicating the ease of transmission of an illegal handling method (method) for data.

  Further, in the example of FIG. 14, it is determined that the degree of relevance of these organizations is higher as the time when a person belonging to an existing organization belongs to another organization is closer to the present time. This is because fraudulent methods performed in organizations that belonged in the near past are considered to be easier to divert to the current organization.

  However, the organization relevance determination criterion 1400 is an example of a criterion for determining the strength of association between two organizations, and criteria other than those described above may be employed. By using such a criterion, it is possible to extract cases that are more likely to be fraudulent.

  When the organization relevance criterion 1400 is applied to two organizations, a plurality of criteria included therein may be applicable. In that case, a larger percentage value is adopted.

  FIG. 15 is an explanatory diagram of the organization relevance data 1500 created by the case similarity calculation function 104 according to the first embodiment of the present invention by the organization relevance determination process.

  FIG. 15 shows, as an example, information related to the Z section W section (that is, the organization corresponding to the current case data 1200 illustrated in FIG. 12) among the organization relevance levels between the organizations in the company. Specifically, the organization relevance data 1500 shown in FIG. 15 includes a department 1501 for identifying each organization whose organization relevance is determined with respect to the Z section W section, and a relationship between the Z section W section and each organization. The organization relevance degree 1502 indicating the degree is included.

  For example, since the Z section W section and the Z section W section are the same organization, based on the criterion “same organization: 100%”, their organization relevance is determined to be 100%. As shown in FIG. 13, Mr. Yda who currently belongs to the Z section W section as a person in charge belonged to the Z section P section one year ago. Therefore, based on the criterion “Department in charge of one year ago: 40%” of the organization relevance criterion 1400, it is determined that the organization relevance between the Z section W section and the Z section P section is 40%. Is done. Here, FY2017 is assumed to be “present”.

  Mr. Mda, the current manager of the Z department W section, belonged to the M department N section two years ago. For this reason, based on the criteria of the organization relevance criterion 1400, “Department 2 years before the section manager: 60%”, the relevance between the Z and W sections and the M and N sections is determined to be 60%. Is done. Mr. Oike, the current chief of the Z Division W Division, also belonged to the M Division N Division two years ago. For this reason, the combination of the Z section W section and the M section N section also corresponds to the criteria of the organization relevance criterion 1400 “Department 2 years before boss: 40%”. However, in this case, a larger “60%” is adopted.

  Mr. Mda, the current manager of the Z Division W Division, belonged to the X Division Y Division one year ago. For this reason, based on the criterion “Department of department manager one year ago: 80%” of the organization relevance criterion 1400, the relevance between the Z section W section and the X section Y section is determined to be 80%. Is done.

  Refer to FIG. 9 again. The case similarity calculation function 104 is based on the current case obtained by the current case creation processing 901, the organization relevance obtained by the organization relevance determination processing 902, and the cases stored in the case record DB 114. Then, similar past case determination processing 903 is executed. Details thereof will be described with reference to FIGS.

  FIG. 16 is a flowchart showing similar past case determination processing executed by the case similarity calculation function 104 according to the first embodiment of the present invention.

  The case similarity calculation function 104 is a similarity between one current case data obtained by the current case creation processing 901 and one case data (described here as past case data) stored in the case record DB 114. Is calculated (step 1603). Details of this processing will be described later with reference to FIG.

  Next, the case similarity calculation function 104 multiplies the similarity calculated in step 1603 by the tissue relevance determined in the tissue relevance determination processing 902 (step 1604). The organization relevance to be multiplied here is the relationship between the organization corresponding to the current case data and the organization corresponding to the past case data in the combination of the current case data and the past case data whose similarity is calculated in step 1603. Degree.

  Next, the case similarity calculation function 104 determines whether or not the similarity after the tissue relevance is multiplied in Step 1604 exceeds a predetermined threshold (Step 1605). When the similarity exceeds the threshold (step 1605: Yes), the case similarity calculation function 104 determines that the current case data is suspected of fraud, and the current case data, the past case data, and the similarity Is added to the similar case list (step 1606). On the other hand, when the similarity does not exceed the threshold (step 1605: No), the case similarity calculation function 104 does not execute step 1606.

  The case similarity calculation function 104 performs the above-described steps 1603 to 1603 for all combinations of all past case data stored in the case record DB 114 and all current case data obtained by the current case creation processing 901. Step 1606 is repeatedly executed (loop 1602 and loop 1601).

  FIG. 17 is an explanatory diagram of a similar past case determination criterion 1700 that the case similarity calculation function 104 according to the first embodiment of the present invention refers to for the similar past case determination processing.

  The similar past case determination criterion 1700 is a criterion for calculating the similarity between the current case data and the past case data. For example, the similar past case determination criterion 1700 may be generated based on past case data in the case record DB 114 and stored in the case record DB 114.

  A similar past case determination criterion 1700 shown in FIG. 17 includes four items of items a to d, and 25% is added as a similarity each time a set of current case data and past case data satisfies one item.

  Item a is a value obtained by dividing the number of man-hours in the completion month (that is, the month including the completion date) by the average value per month of the man-hours in all months other than the completion month in the period to be determined. There are projects (projects) smaller than .5.

  Item b is a project (project) in which the value obtained by dividing the number of man-hours in the work completion month by the average value of the man-hours in all months other than the work completion month is greater than 2.0 in the period to be judged. It exists.

  Item c is that the profit rate of the item satisfying the item a is in the range of 0% to 5%.

  Item d is that the profit rate of the project satisfying item b is −10% or less.

  Such a similar past case determination criterion 1700 is an example of a criterion used for finding a current case similar to the past case (that is, case 1) shown in FIG. This case 1 is a fraudulent case in which a deficit generated in one project is replaced with another project at the same time. For this reason, the similar past case determination criterion 1700 shown in FIG. 17 uses the items a and b for detecting the characteristic man-hour distribution and the characteristic profit distribution when such fraud is performed. Items c and d for detection are included.

  Similar to the past case shown in FIG. 8, such fraud can be detected by using the fraud determination rule 500 shown in FIG. 5 when the man-hour data once inputted is corrected later. there is a possibility. However, if such fraud is planned from the time when man-hour data is first input, it cannot be detected using the fraud determination rule 500. However, if the similar past case determination criterion 1700 shown in FIG. 17 is used, it is possible to determine that the current case is suspected of being fraud regardless of whether the fraud is performed by correcting the data.

  Since various types of fraud may actually exist, a plurality of similar past case determination criteria may be held in order to find them. For example, the similar past case determination criterion 1700 may include only a criterion based on the man-hour allocation, may include only a criterion based on the profit allocation, or may include another criterion.

  In the present embodiment, the similar past case determination standard 1700 shown in FIG. 17 is manually created based on the past case data, and the case similarity calculation function 104 determines the current case data and past case data based on this standard in step 1603. The degree of similarity is calculated. However, the reference creation method and the similarity calculation method are examples, and the reference creation and the similarity calculation may be performed by other methods.

  For example, the similar past case determination criterion 1700 may be created by mechanical means from past case data. Further, the case similarity calculation function 104 may calculate the similarity between the current case data and the past case data in step 1603 by means such as machine learning.

  Here, as an example of the similar past case determination process, the similarity between the current case data 1200 shown in FIG. 12 and the past case data 800 shown in FIG. An example of calculation based on the organization relevance data 1500 shown in FIG. 15 will be described.

  In this case, the current case data 1200 shown in FIG. 12 includes two cases of “X development” and “Y development”. The period to be judged is 6 months from October 2017 to March 2018 (that is, the second half of FY2017), and the construction completion months of X development and Y development are both March.

  Focusing on X development, as shown in FIG. 10, the average value of the X development engagement time (ie, man-hours) from October 2017 to February 2018 is 150 hours. On the other hand, the working hours of X development in March 2018 is 330 hours. For this reason, the item b of the similar past case determination criterion 1700 is satisfied. And as shown in FIG. 11, since the profit rate of X development is -70%, the item d is satisfy | filled.

  Focusing on the Y development, as shown in FIG. 10, the average value of the Y development engagement time from October 2017 to February 2018 is 130 hours. On the other hand, the working time of Y development in March, 2018 is 20 hours. For this reason, the item a of the similar past case determination criterion 1700 is satisfied. And as shown in FIG. 11, since the profit rate of Y development is 2%, the item c is satisfied.

  As a result, in step 1603, “100%” is calculated as the similarity.

  As shown in FIG. 15, the degree of organizational relevance between the Z section W section, which is the organization corresponding to the current case data 1200, and the X section Y section, which is the organization corresponding to the past case data 800, is calculated as 80%. . As a result, in step 1604, “80%” is calculated as the similarity multiplied by the tissue relevance.

  If it is determined in step 1605 that 80% exceeds the threshold value, the current case data 1200, the past case data 800, and the similarity (80%) are added to the similar case list in step 1606. An example of data added in this way is shown in FIG.

  FIG. 18 is an explanatory diagram of the similar case list 1800 created by the similar past case determination process by the case similarity calculation function 104 according to the first embodiment of the present invention.

  The similar case list 1800 includes a department 1801, a similar case 1802, a similarity 1803, a project 1804, a profit rate 1805, a completion date 1806, a worker 1807, an average engagement time 1808 for October and February, and an engagement time 1809 for March including. Among these, the department 1801, the project 1804, the profit ratio 1805, the completion date 1806, the workers 1807, the average engagement time 1808 in October and February, and the engagement time 1809 in March are the current case data shown in FIG. It corresponds to 1200 departments 1201, projects 1202, profit rate 1203, work completion date 1204, workers 1205, average of 1206 working hours for October to February, and working hours 1207 for March.

  The similar case 1802 is information for identifying past case data determined by the similar past case determination process that the similarity exceeds a predetermined threshold. The similarity 1803 indicates the similarity determined to exceed a predetermined threshold.

  In FIG. 18, as an example, the case similarity calculation function 104 includes the current case data 1200 illustrated in FIG. 12, the past case data 800 illustrated in FIG. 8, the similar past case determination criterion 1700 illustrated in FIG. The steps 1603 to 1606 in FIG. 16 are executed based on the organization relevance data 1500 shown in FIG. 16, and the data added to the similar case list 1800 in step 1606 is shown.

  Therefore, the values of the department 1801, the project 1804, the profit ratio 1805, the completion date 1806, the workers 1807, the average engagement time 1808 in October-February and the engagement time 1809 in March are the current case data shown in FIG. The values are the same as the values of the department 1201, the project 1202, the profit rate 1203, the completion date 1204, the worker 1205, the average engagement time 1206 of October and February, and the engagement time 1207 of March. Further, the value of the similar case 1802 is “Case 1” for identifying the past case data 800 shown in FIG. 8, and the value of the similarity 1803 is “80%” calculated.

  Refer to FIG. 9 again. When the similar past case determination process 903 ends, the case similarity calculation function 104 executes a display case determination process 904 and outputs a display case 905. Details thereof will be described with reference to FIGS. 19 and 20.

  FIG. 19 is a flowchart showing display case determination processing executed by the case similarity calculation function 104 according to the first embodiment of the present invention.

  First, the case similarity calculation function 104 sorts the cases included in the similar case list 1800 in descending order of the similarity 1803 (step 1901). In the example of FIG. 18, only one case is included in the similar case list 1800, but actually, the processing of steps 1603 to 1606 is repeated by the loops 1601 and 1602 of FIG. May be registered. In that case, the registered cases are sorted in descending order of similarity 1803.

  Next, the case similarity calculation function 104 sends a predetermined number of current case data at the top of the sorted similar case list 1800 and past cases determined to be similar to them to the display function 106 (step) 1902). The display function 106 displays a warning screen including the set of case data.

  FIG. 20 is an explanatory diagram of a warning screen 2000 that is displayed as a result of the processing of the case similarity calculation function 104 by the display function 106 according to the first embodiment of the present invention.

  The warning screen 2000 displays a current case display column 2001 that displays at least part of the current case data suspected of being found fraud in addition to a display indicating that a case suspected of being fraud has been found, and past cases similar thereto. A past case display column 2002 that displays at least a part of the data is included.

  In the example of FIG. 20, the current case data 1200 shown in FIG. 12 is similar to the past case data 800 shown in FIG. 8 (that is, it is suspected that fraud similar to that performed in the past case data 800 has been performed). The example displayed when it is determined that. In this case, in the current case display column 2001, the current case data 1200 shown in FIG. 12 and the time extracted from the related data (second half of 2017), the organization name (Z section M section), the project manager name (M field) ), Project name (X development, etc.), profit rate (-70%, etc.), man-hours in March, which is the completion month (330 hours), etc. are displayed. In the current case display column 2001, the values of items corresponding to the above extracted from the past case data 800 shown in FIG.

  By referring to these displays, the inspector 130 can grasp a case where fraud is suspected and determine whether or not fraud has actually been performed.

  According to the first embodiment of the present invention described above, the similarity between the current case and a case where fraud has been performed in the past is determined. At this time, since the final finished data is compared, not only the data created by falsifying the data once created but also the data created for the wrong purpose from the beginning Can be extracted as suspected cases.

  Among such data, there is not only data that is actually fraudulent, but also data that is actually legitimate, just by accidental resemblance to past cases. However, in Example 1, the degree of association between an organization that has performed fraud in the past and the organization related to the current case is determined, and the higher the degree of association, the more types of fraud that have been performed in the past. It is determined that there is a high possibility. This is based on the assumption that the higher the degree of association between organizations, the easier it is to transmit an illegal method between the organizations. As a result, it is possible to extract those that are more likely to have been fraudulent and support the audit by the auditor.

  In addition, although the process of the man-hour management system 100 was shown in the present Example, this invention is applicable not only to an operator's man-hour but the system which manages arbitrary information. For example, since the man-hours shown in the present embodiment are examples of information relating to costs incurred in corporate activities, the present invention is applied to management of information other than man-hours relating to costs (for example, costs such as material costs or outsourcing costs). You can also. In other words, the present invention can be widely applied to management of accounting information such as costs and profits generated in each period in business activities, such as management of project budgets based on such information. Alternatively, the present invention can also be applied to illegal operations on information other than accounting information. Therefore, the man-hour management system 100 of the present embodiment can also be called an information management system, an accounting information management system, a project budget management system, a cost management system, or the like. The same applies to Example 2 and Example 3 described later.

  Next, a second embodiment of the present invention will be described. Except for the differences described below, each part of the system of the second embodiment has the same function as each part denoted by the same reference numeral in the first embodiment shown in FIGS. Is omitted.

  FIG. 21 is a block diagram illustrating a logical configuration of the man-hour management system 100 according to the second embodiment of the present invention.

  The man-hour management system 100 according to the second embodiment is similar to the man-hour management system 100 according to the first embodiment except that the case similarity calculation function 104 determines the organization relevance based on the communication information DB 2101 instead of the organization management DB 113. It is.

  Note that the communication information DB 2101 may be placed outside the man-hour management system 100 as shown in FIG. For example, when the communication information DB 2101 is stored in a computer system connected to the man-hour management system 100 via a network, the man-hour management system 100 may acquire information included in the communication information DB 2101 via the network interface 206. it can. Alternatively, the communication information DB 2101 may be included in the man-hour management system 100 by being stored in the storage device 203, for example.

  FIG. 22 is an explanatory diagram of the communication record data 2200 referred to by the case similarity calculation function 104 according to the second embodiment of the present invention for the organization relevance determination process.

  The communication record data 2200 illustrated in FIG. 22 is an example of data extracted from the communication information DB 2101. The communication record data 2200 includes a communication date 2201, a communication source 2202, a post 2203, a communication destination 2204, a communication destination department 2205, and a communication time 2206.

  The communication date 2201 indicates the date on which communication was performed. The communication source 2202 indicates a person of a communication source in the communication that has been performed (for example, if the communication type is a telephone call). The title 2203 indicates the title of the person who is the communication source. A communication destination 2204 indicates a person of the communication destination. A communication destination department 2205 indicates an organization to which a communication destination person belongs. A communication time 2206 indicates the time of communication performed. Here, since a telephone call is assumed, the communication time 2206 is a call time. However, in the case of communication other than the telephone, such as e-mail, for example, the number of transmitted mails or the amount of data transmitted, etc. The communication time 2206 may be used instead. That is, the communication time 2206 is an example of the traffic.

  FIG. 23 is an explanatory diagram of the tissue relevance determination criterion 2300 that the case similarity calculation function 104 according to the second embodiment of the present invention refers to for the tissue relevance determination processing.

  The organization relevance criterion 2300 may be held on the memory 202 as a part of a program for realizing the case similarity calculation function 104, or held on the memory 202 as data referred to by the program, for example. May be.

  23 includes a criterion “same organization: 100%”. This is the same as that included in the tissue relevance criterion 1400 of the first embodiment.

  Furthermore, the organization relevance determination criterion 2300 includes a criterion of “section manager's communication destination 60 minutes or more or 3 times or more: 80%”. This means that when focusing on two organizations, the manager of one organization communicated with a person belonging to the other organization, and the time was 60 minutes or more, or the number of times was 3 or more. In this case, it is indicated that the relevance of those tissues is determined to be 80%.

  Similar to the above, the organization relevance criterion 2300 is that the degree of organization relevance is large according to the length or number of times that the manager, chief, person in charge, etc. of one organization communicates with a person belonging to the other organization. The standard for judging the accuracy is included. The larger the percentage value of the degree of association, the higher the degree of association between the two organizations (that is, the stronger the association).

  In the example of FIG. 23, it is determined that the higher the status of the person who communicated is, the higher the degree of association between the organization to which the person belongs and the organization to which the communication destination person belongs. This is because the higher the position, the easier it is to apply the fraudulent method performed in the organization to which the person with whom the person with whom the person exchanged information belongs belongs to the organization to which he belongs.

  In the example of FIG. 23, for example, it is determined that the relevance of the organization to which the two persons who performed the communication belong respectively increases as the communication amount increases, for example, the communication time is long or the communication frequency is large. . This is because the more information is exchanged, the easier it is to apply the fraudulent method performed in one organization to the other organization.

  However, the organization relevance determination criterion 2300 is an example of a criterion for determining the strength of association between two organizations, and criteria other than the above may be adopted.

  In addition, when the organization relevance criterion 2300 is applied to two organizations, a plurality of criteria included therein may be applicable. In that case, a larger percentage value is adopted.

  FIG. 24 is an explanatory diagram of the tissue relevance data 2400 created by the case similarity calculation function 104 according to the second embodiment of the present invention through the tissue relevance determination process.

  FIG. 24 shows the organization relevance 2400 calculated based on the information acquired from the communication information DB 2101. In this example, the degree of organizational relevance between the Z section W section and the X section Y section is 80% as in the first embodiment. For this reason, the similarity similar to Example 1 is calculated.

  According to the second embodiment of the present invention described above, the strength of association between organizations is calculated based on the amount of communication between the two organizations, such as a telephone conversation time. As a result, even in a combination of organizations that do not have personnel exchanges, such as a person belonging to one organization in the past, information exchange is actively performed by actual communication or the like. It can be determined that the degree of relevance is high for the tissue estimated to be present. As a result, it is possible to extract cases that are more likely to be fraudulent and support audits by auditors.

  In the above example, the amount of communication is used to calculate the strength of association between organizations, but this is the amount of actual exchange between persons belonging to each organization (for example, between people). This is an example of an index indicating the amount of communication), and a value other than the communication volume can be used as a similar index. For example, not only the amount of communication by telephone or e-mail, but also a means for measuring various types of contact amount such as actual face-to-face time, face-to-face number, conversation time or number of conversations between persons can be used. The face-to-face time measured can be used instead of the communication time described above.

  Next, a third embodiment of the present invention will be described. Except for the differences described below, each part of the system of the third embodiment has the same functions as the parts denoted by the same reference numerals of the first and second embodiments shown in FIGS. Description of is omitted.

  In the first and second embodiments, cases of fraud that have occurred in the past in the company to be audited are extracted in advance, and the cases are accumulated as past cases. Then, similar past case determination criteria are generated based on the past case, and based on this, the similarity between the case newly generated in the company (current case) and the past case is calculated.

  However, new fraud methods that have not been discovered until now may become apparent, for example, by whistleblowing or by the confession of a person who actually performed fraud. Alternatively, there may be information about fraudulent methods that have not been done at the company but have been done at another company. Further, there are cases where an illegal method that can actually occur can be assumed even if it has not been confirmed that it has actually been performed.

  In the third embodiment, in such a case, a function of taking a new past case and creating a new similar past case determination criterion based on the new past case is realized. In addition, when such a new similar past case determination criterion itself has already been created and can be obtained from the outside, a function of obtaining and holding it is realized.

  FIG. 25 is a flowchart illustrating processing executed by the man-hour management system 100 according to the third embodiment of the present invention.

  The processing shown in FIG. 25 is executed by the processor 201 of the man-hour management system 100 controlling each unit in the man-hour management system 100 as necessary in accordance with a program stored in the memory 202.

  First, the man-hour management system 100 sets the flag value to 1 when accepting input of case data, and sets the flag value to 0 when accepting input of a rule (ie, a similar past case determination criterion) ( Step 2501). For example, the inspector 130 may input information indicating which input is to be performed via the input device 204, and the man-hour management system 100 may set the value of the flag based on the information.

  Next, the man-hour management system 100 determines whether or not the value of the flag is 1 (step 2502). If the value of the flag is 1 (step 2502: Yes), the man-hour management system 100 determines whether there is data to be input in the man-hour management DB 111 and the PJ management DB 112, and if so, sets the flag value. If it does not exist, the flag value is set to 0 (step 2503).

  For example, if the newly revealed fraud has occurred in the company in the past and the data remains in the man-hour management DB 111 and the PJ management DB 112, the flag value is set to 1. . On the other hand, for example, when data related to newly revealed fraud is already discarded, or when the fraud is performed by another company, the data related to the fraud includes the man-hour management DB 111 and the PJ management DB 112. Otherwise, the flag value is set to 0.

  Next, the manhour management system 100 determines whether or not the value of the flag is 1 (step 2504). When the value of the flag is 1 (step 2504: Yes), the man-hour management system 100 extracts the target data from the man-hour management DB 111 and the PJ management DB 112 (step 2505) and records the data in the case record DB 114 (step 2505). Step 2506).

  If the value of the flag is 0 in step 2504 (step 2504: No), the man-hour management system 100 instructs to input pseudo data and receives the input of the pseudo data (step 2508). Pseudo data is not data that records actual man-hours, but is pseudo-generated data that would be such man-hours if a newly illicit method was applied. is there. Then, the man-hour management system 100 records the pseudo data in the case record DB 114 (step 2506).

  For example, the man-hour management system 100 outputs a message requesting input of pseudo data from the output device 205, and records the pseudo data input to the input device 204 from the inspector 130 or the like in the case record DB 114 accordingly. Good.

  When the value of the flag is 0 in Step 2502 (Step 2502: No), the man-hour management system 100 instructs the input of the similar past case determination criterion and accepts the similar past case determination criterion (Step 2507. Man-hour). The management system 100 records the similar past case determination criterion in the case record DB 114 (step 2506).

  For example, the man-hour management system 100 outputs a message requesting the input of a similar past case determination criterion from the output device 205, and records the similar past case determination criterion input to the input device 204 from the inspector 130 or the like accordingly as a case record You may record in DB114.

  When the data extracted from the man-hour management DB 111 and the PJ management DB 112 as described above, the input pseudo data, or the input similar past case determination criterion is recorded in the case record DB 114, these data are case similar. Used by the degree calculation function 104. The method will be described below.

  When the data extracted from the man-hour management DB 111 and the PJ management DB 112 in step 2505 is recorded in the case record DB 114 in step 2506 as past case data, similar past case determination criteria are generated and recorded based on the past case data. The For example, the auditor 130 may manually generate similar past case determination criteria, or may be generated by some mechanical means in the man-hour management system 100. In this case, the case similarity calculation function 104 calculates the similar past case based on the degree of association between the organization corresponding to the data extracted from the man-hour management DB 111 and the PJ management DB 112 in step 2505 and the organization corresponding to the current case. A determination process 903 is executed.

  On the other hand, when the pseudo data input in step 2508 is recorded in the case record DB 114 as past case data in step 2506, a similar past case determination criterion is generated and recorded based on the past case data. For example, the auditor may manually generate similar past case determination criteria, or may be generated by some mechanical means in the man-hour management system 100.

  In this case, since the past case data based on the pseudo data is not a case that actually occurred, the past case data does not include information on the corresponding organization (information corresponding to the department 802 in FIG. 8). Therefore, the man-hour management system 100 uses the similar data generated based on the pseudo data from the data other than the past case data based on the pseudo data recorded in Step 2506 among the past case data stored in the case record DB 114. The past case data corresponding to the past case determination criteria may be extracted, and the value of the department 802 of the past case data may be held as the value of the department 802 of the past case data based on the pseudo data. Then, the case similarity calculation function 104 performs similar past based on the degree of organizational relevance between the organization specified by the department 802 of the pseudo data and the organization corresponding to the current case (ie, the organization specified by the department 1201). Case determination processing 903 is executed.

  When the similar past case determination criterion input in step 2507 is recorded in the case record DB 114 as past case data in step 2506, the similar past case determination criterion is used by the case similarity calculation function 104. Also in this case, since the input similar past case determination criterion is not created based on an actual case that occurred in the organization (department) in the company, the organization relevance cannot be used as it is.

  Therefore, the man-hour management system 100 extracts past case data corresponding to the input similar past case determination criteria from the past case data stored in the case record DB 114, and the value of the department 802 of the past case data May be stored as organization information corresponding to the inputted similar past case determination criterion. Then, the case similarity calculation function 104 executes the similar past case determination processing 903 based on the degree of organization relation between the held organization and the organization corresponding to the current case (that is, the organization specified by the department 1201). To do.

  According to the third embodiment of the present invention described above, even when an unknown fraud method is newly known, by extracting data suspected of fraud using a rule corresponding to the method, the auditor can Can support audits.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for better understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Further, each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function is stored in a non-volatile semiconductor memory, a hard disk drive, a storage device such as an SSD (Solid State Drive), or a computer-readable non-readable information such as an IC card, an SD card, or a DVD. It can be stored on a temporary data storage medium.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

100 Man-hour Management System 101 PJ Data Input Function 102 Man-hour Recording Function 103 Man-hour Transfer Determination Function 104 Case Similarity Calculation Function 105 Recording Instruction Function 106 Display Function 111 Man-hour Management DB
112 PJ management DB
113 Organization management DB
114 Case Record DB
120 Worker 130 Auditor

Claims (13)

An information management system comprising a processor and a storage device connected to the processor,
The storage device
Holding data indicating a fraud case, data indicating an organization corresponding to the fraud case, data indicating a case to be determined, and data indicating an organization corresponding to the case to be determined;
Holds a calculation standard for the degree of similarity between the case to be judged and the fraud case,
The processor is
Calculating an organization relevance level indicating the strength of the association between the organization corresponding to the fraud case and the organization corresponding to the determination target case;
Based on the similarity calculation criterion, calculate the similarity between the fraud case and the determination target case,
An information management system, wherein, based on the calculated similarity and organization relevance, it is determined whether there is a suspicion of fraud in the determination target case, and the determination result is output. The information management system according to claim 1,
The data indicating the case of fraud and the data indicating the case to be judged include accounting information including information indicating a cost and profit indicating a predetermined period of one or more cases executed in any organization, respectively. An information management system characterized by being data. The information management system according to claim 1,
The data indicating the case of fraud and the data indicating the case to be judged are respectively the number of man-hours of work performed by a person belonging to any organization on one or more cases in a predetermined period, and the respective cases. And profit for the predetermined period of
The criteria for calculating the degree of similarity includes a criterion for calculating the degree of similarity based on at least one of the allocation of the man-hours to the cases in the predetermined period and the profits of the cases in the predetermined period. ,
The processor is
Based on the similarity calculation criterion, calculate the similarity between the fraud case and the determination target case,
When a value obtained by multiplying the calculated similarity by the organization relevance between the organization corresponding to the fraud case and the organization corresponding to the judgment target case exceeds a predetermined threshold, An information management system characterized by determining that a case is suspected of fraud. The information management system according to claim 1,
The processor is
Obtaining organization information indicating the organization to which each person currently belongs and the organization to which the person belonged in the past,
An information management system that calculates the degree of organization relevance based on whether a person belonging to one of the two organizations has belonged to the other in the past. The information management system according to claim 4,
In the case where a person who belongs to one of the two organizations has belonged to the other organization in the past, the higher the status of the person, the higher the degree of association between the two organizations. And the organization relevance is calculated so that the organization relevance of the two organizations increases as the time when the person belonged to the other organization is closer to the present time. Management system. The information management system according to claim 1,
The processor is
Get information that records communications between people,
An information management system that calculates the degree of organization relevance based on the amount of communication between a person belonging to one of the two organizations and a person belonging to the other organization . The information management system according to claim 6,
In the case where a contact is made between a person who belongs to one of the two organizations and a person who belongs to the other organization, the processor determines that the higher the status of the person, An information management system, wherein the organization relevance level is calculated so that the organization relevance level of the two organizations increases as the organization relevance level of the organization increases and the amount of the communication increases. The information management system according to claim 1,
The storage device
The organization to which each person belongs, the case that each person has engaged, and the man-hour information indicating the man-hour for each case of each person, and the case information indicating the profit for each case,
Holds judgment rules for judging suspected fraud information,
Based on the determination rule, the processor includes the man-hour information and the case information related to one or more cases in which a person belonging to any organization is engaged in any period of the man-hour information and the case information. When it is determined that there is a suspicion of fraud, the man-hour information and the case information that are determined to be suspicion of fraud are stored in the storage device as data indicating the fraud case. The information management system according to claim 8, wherein
An input device and an output device connected to the processor;
The output device outputs at least part of the man-hour information and the case information determined to be suspected of fraud,
When the man-hour information determined to be suspected of fraud and the information instructing to record the case information are input, the man-hour information and the case information determined to be suspected of fraud are An information management system for storing data in the storage device as data indicating the case of The information management system according to claim 1,
The storage device holds an organization to which each person belongs, a case in which each person has engaged, man-hour information indicating the man-hour for each case of each person, and case information indicating profit for each case. And
The processor is
From the man-hour information and the case information, data indicating a plurality of cases including the man-hour information and the case information relating to one or more cases in which a person belonging to any organization has engaged in any period is generated. And
When the calculation criterion for the similarity between the determination target case and the fraudulent case is input, the data indicating the plurality of cases generated based on the input calculation criterion for the similarity An information management system, wherein data indicating a case whose similarity with an illegal case is larger than a predetermined reference is stored in the storage device as data indicating the illegal case. The information management system according to claim 1,
The storage device holds an organization to which each person belongs, a case in which each person has engaged, man-hour information indicating the man-hour for each case of each person, and case information indicating profit for each case. And
The processor is
From the man-hour information and the case information, data indicating a plurality of cases including the man-hour information and the case information relating to one or more cases in which a person belonging to any organization has engaged in any period is generated. And
When the data indicating the fraud case including the man-hour information and the case information related to one or more cases engaged in a period by a person belonging to any organization is input, Based on the data shown, generate a calculation criterion for the similarity between the case to be determined and the fraud case,
Based on the generated calculation criterion for similarity, data indicating a case whose similarity with the input past case is larger than a predetermined reference is specified among the generated plurality of cases. ,
An information management system for calculating an organization relevance between an organization corresponding to data indicating the specified case and an organization corresponding to the case to be determined. The information management system according to claim 1,
An output device connected to the processor;
The output device, when it is determined that the determination target case is suspected of fraud, at least a part of data indicating the fraud case, information for identifying an organization corresponding to the fraud case, the determination target An information management system for outputting at least a part of data indicating an example of the above and information for identifying an organization corresponding to the case to be determined. An information management method executed by a computer system having a processor and a storage device connected to the processor,
The storage device
Holding data indicating a fraud case, data indicating an organization corresponding to the fraud case, data indicating a case to be determined, and data indicating an organization corresponding to the case to be determined;
Holds a calculation standard for the degree of similarity between the case to be judged and the fraud case,
The information management method includes:
The processor calculates a degree of organization relevance indicating the strength of association between the organization corresponding to the fraud case and the organization corresponding to the case to be determined;
The processor calculates a similarity between the fraud case and the determination target case based on the similarity calculation criterion;
And a step of determining whether the determination target case is suspected of fraud based on the calculated similarity and organization relevance, and outputting a determination result. Information management method.

Images