An Interpretable Financial Statement Fraud Detection Framework Enhanced by Temporal–Spatial Patterns

Abstract

In recent years, financial statement fraud schemes have evolved to become markedly more sophisticated and concealed, thereby posing severe threats to both social stability and economic health. Traditional detection methods, which rely primarily on fragmented corporate data, exhibit significant limitations in capturing the dynamic evolution and spatial diffusion characteristics of fraudulent behaviors over time and space. To address this issue, in this study, we undertake a thorough analysis of the intrinsic nature of fraud risk from a sociotechnical systems perspective and construct a multi-level indicator system to comprehensively quantify risk elements. Furthermore, recognizing the dynamic evolution nature and propagating characteristics of fraud risk, we propose a novel financial statement fraud detection framework to capture behavior patterns in temporal and spatial dimensions. Experiments on A-share-listed companies of high-risk industries in China demonstrate that the proposed framework significantly outperforms other mainstream machine learning and deep learning techniques. In addition, we open the “black box” of the detection framework and empirically validate fraud risk patterns with respect to social–technical elements by leveraging explainable AI techniques. Practically, the proposed framework and interpretable analysis are capable of providing precise early warnings and supervision.

1. Introduction

In contemporary business practice, enterprise organizations usually function as a complex sociotechnical system (STS), where human actors and technological tools work in collaboration to achieve specific objectives [1,2,3]. In this system, rapid variations in the external environment have significantly intensified pressures, such as unrealistic business expectations and fierce market competition, which can push individuals to commit fraud [4,5,6]. In addition, advanced information technology is increasingly exploited to conduct fraud, posing a great challenge for internal control and governance structure in detection and prevention [7,8,9,10,11]. In this way, instances of fraud often exhibit the following characteristics: strong motivation, concealment, and intelligence.

There are various types of fraud, among which we focus on financial statement fraud in this study. Financial statement fraud refers to deliberately engaging in the misleading manipulation of financial statements, violating accounting standards and regulations to obtain improper economic benefits [12,13,14]. In 2021, Shanghai Electric was exposed to financial fraud through its “private network communication business”, involving 15 listed companies and exceeding CNY 90 billion [15]. Fraudsters conduct private network communication business by circulating it among third parties without any substantive content [16]. Using this insidious, sophisticated, and systematic fraud scheme, financial statement fraud can evade traditional manual audits successfully. As one of the most prevalent types of occupational fraud in the world, it has caused severe adverse effects on capital markets and the broader socioeconomic environment [17,18,19]. Hence, it is necessary to construct an intelligent model for financial statement fraud detection (FSFD), which would function as an early warning mechanism for proactive fraud prediction, enabling timely intervention to mitigate losses and significantly supporting an organization’s capacity for resilience [20,21].

Preliminarily, most detection approaches employ financial data and corresponding financial indices as core carriers for FSFD [22]. In addition, many studies have shifted to exploring non-financial data, such as financial report data, governance data, and internal control data, for better detection performance [23,24,25,26,27]. However, financial statement fraud is not an abrupt occurrence but rather the outcome of long-term interactions among various factors within the enterprise STS. These data—both traditional financial data and newly incorporated non-financial data—predominantly represent static features of a certain period [28], and they have difficulty in capturing dynamically changing fraud risks. For instance, insidious fraudulent activities, such as “private network communication business”, are often conducted through circulation among third parties without substantive content, rendering traditional analyses based on static data largely ineffective.

With the rapid development of information technology, detection models have evolved beyond traditional rule-based systems and machine learning and deep learning techniques [29,30]. Although existing models have demonstrated continuously improved performance by extracting increasingly complex features, especially in deep learning, they lack the capability to systematically represent the holistic picture of fraud risks driven by the interplay of four sociotechnical elements.

In this study, multiple inputs from a sociotechnical perspective are studied. According to Leavitt [2], four key elements—namely, task, technology, actor, and structure—need to be considered in an enterprise system. Each element can be decomposed into a set of indicators, and each indicator can be quantified and taken as an input. Based on this framework, we attempt to resolve complex and dynamic fraud mechanisms and, furthermore, warn of fraud risk using these quantifiable inputs.

We propose a method for financial statement fraud detection enhanced by temporal–spatial patterns (FSFD-ETSP). Since four sociotechnical elements interact and evolve over time and risk behaviors spread among peers and supply chains, we integrate long short-term memory (LSTM) networks and clustering approaches to comprehensively capture the nuanced fraudulent patterns in both temporal and spatial dimensions. Specifically, LSTM can be used to analyze temporal changes among various inputs, extract specific shapes and features that repeatedly occur in time series, and be applied to characterize temporal patterns. Clustering algorithms can classify companies into groups. In each group, companies are categorized according to their similarity in the spatial dimension. In our framework, we assemble the attention mechanism to combine these two types of patterns, and transform them for FSFD through a fully connected layer network. Compared with other commonly used machine learning and deep learning models, the proposed framework exhibits higher detection performance with respect to real-world data.

Another achievement of this study is the examination of potential fraud risk suggested by corporate data through model interpretation. We apply the SHAP (SHapley Additive exPlanation) method to identify the most influential indicators in the model’s predictions. The resulting patterns provide holistic explanations consistent with an STS perspective on fraud risk, thereby ensuring the transparency of the detection process [31,32].

To improve the anticipation capability of organizational resilience [33], we introduce STS theory into fraud detection. Based on this, we then propose a specific temporal–spatial multi-input framework with SHAP-based interpretation in practice. Our work moves beyond traditional methods that rely on experience-based data accumulation and increasingly complex feature extraction, enabling a profound understanding of sophisticated fraud schemes within an enterprise STS, the construction of a novel systematic indicator system, and the capture of nuanced temporal–spatial patterns for superior detection. The key contributions of this study are as follows:

(1)

Beyond the traditional method of accumulating data for detection, we construct a multi-input set by mapping four core elements (task, technology, actor, and structure) within an enterprise STS, ensuring comprehensive coverage of all key factors where fraud may originate.

(2)

Considering the dynamic evolution and spatial diffusion of fraud risk within an enterprise STS, we innovatively combine supervised LSTM networks and an unsupervised clustering approach to extract both temporal and spatial patterns with an attention mechanism. With spatiotemporal patterns, the proposed FSFD-ETSP significantly outperforms traditional machine learning and other deep learning methods.

(3)

We introduce explainable AI techniques to analyze the most influential indicators and the associations among them, which align with the fraud risk pattern described by the enterprise STS.

The primary objectives of this study are:

(1)

To construct a multi-level indicator system as input to comprehensively cover potential risk sources according to STS theory;

(2)

To develop a temporal–spatial enhanced framework for FSFD by integrating LSTM networks and a clustering approach to effectively capture the nuanced behavior patterns of fraud risk;

(3)

To leverage the explainable AI techniques to ensure the trustworthiness and transparency of the proposed framework.

The rest of this article is organized as follows. In Section 2, we review the related literature, and in Section 3, we provide an overview of the framework and implementation details. In Section 4, we outline the experimental design, and in Section 5, we report on the results and further research. In Section 6, we summarize the thesis and propose future research directions.

2. Related Research

2.1. Conceptual Literature

As a systematic perspective on organizations [1], an STS can be viewed as an integrated whole, wherein the social subsystem and technical subsystem are inextricably intertwined [34,35]. The system usually comprises four core elements [2]: actors, social subsystem elements, and all stakeholders related to organizations; technology, technical subsystem elements, tools, equipment, and technical platforms that assist organizations; structures, social subsystem elements, and institutional arrangements, such as power distribution and management; and tasks, technical subsystem elements, and the specific goals of organizations.

Modern enterprises, as typical STSs, can be regarded as comprising the dynamic coupling of the two subsystems [36]. In this framework, financial or personal stresses, such as financial leverage and liquidity [37], can compel individuals to engage in fraudulent behavior. Actors, such as managers, find opportunities within the structural and technological elements to commit fraud, e.g., by exploiting weak ethical leadership and poor monitoring [20]. As for peers, suppliers, customers, and other company-level actors, unethical actions with respect to structural and technological elements can propagate and cause negative multiplier effects [38]. Based on these phenomena, we can conclude that the likelihood of intentional fraudulent behavior is continuously changing; that is, financial fraud risk is dynamic. One key manifestation of this risk is financial statement fraud [19].

As for the aforementioned risk, two solutions—a financial safety performance framework and a risk management system—are proposed in the enterprise STS, targeting social and technical subsystems, respectively [39]. The former solution, functioning as “a controller and decider”, normally comprises a performance evaluation mechanism for monitoring financial security and optimizing operations based on feedback [40]. The latter solution, serving as a critical tool for identifying potential fraud, can either collect company data in a timely manner (early warning mechanism) [41,42,43] or employ various models for statistical prediction (risk modeling) [44,45,46]. These two solutions are mutually reinforcing, with early warnings providing risk data and alert information, and the safety performance framework carrying out further actions to preserve financial security. Additionally, embedding a financial safety performance framework and an early warning system into an enterprise STS can effectively contribute to organizational resilience by enhancing early detection and risk insight. Organizational resilience refers to the ability of an organization to anticipate, withstand, respond to, and adapt to unexpected crises [47,48]. With these two solutions, the whole system can form a synergistic defense mechanism encompassing prevention, in-process control, and post-event improvement [42]. It is important to note that organizational resilience is inferred from the improved early warning and risk insight provided by the detection framework, rather than being observed directly. Accordingly, we can outline the conceptual framework in Figure 1.

2.2. Financial Statement Detection Methods

FSFD is an important task for auditors and accountants. In the early days, FSFD mainly relied on the empirical judgment of auditors [49]. With the development of artificial intelligence (AI), modern FSFD methods are mainly based on machine learning [18,50,51,52,53,54,55,56,57] and deep learning technologies [58,59]. The efficacy of these techniques is dependent on their ability to carry out discriminative feature extraction. For example, traditional machine learning methods, such as logistic regression [60,61,62,63], decision tree [64,65,66], and support vector machine [17,54,67,68,69], are capable of capturing linear relations among companies [70,71]. Meanwhile, deep learning methods have the potential to learn nonlinear and non-stationary correlations, rendering them state-of-the-art detection methods [72,73].

Table 1. Summarized classification for CFF detection methods.

Authors (Year)	Detection Model	Data Source	Data Information	Model Input	Results
Kotsiantis et al. [57]	Hybrid decision support system using a stacking-based ensemble classifier	164 Greek manufacturing firms (2001–2002)	41 fraud and 123 non-fraud cases	Audited financial statements	Accuracy: 95.1%
Kirkos et al. [55]	DT, NN, BBN	76 Greek manufacturing firms	38 fraud and 38 non-fraud cases	Financial ratios from balance sheet and income statement	Accuracy: 90.3% (BBN), 80% (NN), 73.6% (DT)
Cecchini et al. [17]	SVM-FK	205 fraudulent and 6427 non-fraudulent company-years from SEC AAERs and Compustat.	205 fraud and 6427 non-fraud cases	23 financial indicators	AUC: 87.8% (SVM-FK) Recall: 80% (SVM-FK)
Ravisankar et al. [54]	MLFF, SVM, GP, LR, PNN	202 Chinese companies	101 fraud and 101 non-fraud cases	Balance sheet, income statement, cash flow statement, statement of retained earnings	Accuracy: 95.64% (PNN), 92.68% (GP)
Hajek and Henriques [66]	BBN, DTNB, SVM, NN, DT, LR	622 U.S. SEC AAERs (2005–2015)	311 fraud and 311 non-fraud cases	Financial statements, analysts’ forecasts, and managerial comments	Accuracy: 90.32 ± 1.90 (BBN), 89.50 ± 1.91 (DTNB) TP rate: 85.19 ± 4.26 (BBN), 87.21 ± 3.24 (DTNB)
Yao et al. [56]	RF, SVM, DT, ANN, LR	240 Chinese companies (2007–2016)	120 fraud and 120 non-fraud cases	Financial and non-financial information from annual report	Accuracy: 71.67% (SVM), 70.83% (ANN)
Bao et al. [18]	RUSBoost, LR, SVM	All publicly listed U.S. firms (1991–2008)	1171 fraud and 206,026 non-fraud cases	Financial statements	AUC: 72.5% (RUSBoost), 69% (Logit), 62.6% (SVM)
An and Suh [51]	MRF, ANN, SVM, LR, DT	Combined dataset from KIND system (1996–2018)	1591 fraud and 31,628 non-fraud cases	KIND system and KIS value database	Accuracy: 78.06% (MRF), 78.51% (ANN)
Bertomeu et al. [52]	GBRT, RUSBoost, LR	Audit analytics data (2001–2014)	428 fraud and 11,323 non-fraud cases	Audit analytics non-reliance restatement database and financial statements	AUC: 76.1% (RUSBoost), 72.8% (GBRT)
Jan et al. [58]	RNN, LSTM	153 Taiwanese listed companies (2001–2019)	51 fraud and 102 non-fraud cases	Financial statements	Accuracy: 94.88% (LSTM), 87.18% (RNN) AUC: 95.86% (LSTM), 91.30% (RNN)
Achakzai et al. [53]	Meta-Classifiers (Stacked & Voting) combining LR, RF, RUSBoost, DT, SVM, MLP	32173 firm-year observations of Chinese listed firms (2007–2019)	2847 fraud and 29,326 non-fraud cases	Financial statements	AUC: 73.8% (Meta-classifiers), 66.4% (LR), 69.5% (DT)
Wang [59]	XGBoost	Chinese listed companies from CSMAR (2010–2021)	457 fraud and 3146 non-fraud cases	Multiple indicators across governance, supervision, and financial dimensions.	Accuracy: 85.9% (XGBoost) AUC: 89.6% (XGBoost)
Zhang [68]	SVM, BP, PSO-SVM	Enterprise financial data sourced from WIND China Financial Database	60 fraud and 60 non-fraud cases	20 financial indicators and 8 non-financial indicators	Accuracy: 85.64% (PSO-SVM)
Li et al. [63]	LR, DT, NB, AdaBoost, BP, ensemble algorithm (RF, LightGBM, AdaBoost, and XGBoost)	3547 Chinese listed firms (2012–2021) from CSMAR and WIND financial database	6077 fraud and 6077 non-fraud cases	207 financial, non-financial and textual indicators from MD&A	Accuracy: 70.01% (RF), 70.14% (AdaBoost) AUC: 70.00% (RF), 70.14 (AdaBoost)
Lee et al. [65]	LR, KNN, SVM, DT, RF	Firms listed on the Indonesia Stock Exchange (IDX) (2015–2023)	2373 firm-year observations	Balance sheets and income statements	Precision: 84% (RF), 74% (LR) Recall: 67% (RF), 66% (LR)
Fu et al. [69]	Probability-based One-Class SVM, DT, ensemble models (LightGBM, AdaBoost, and XGBoost)	A-share listed companies (2011–2021) from CSMAR	/	67 feature multimodal index system of financial, non-financial and textual indicators	Accuracy: 95% (DT), 85% (One-Class SVM) AUC: 95% (DT), 84% (One-Class SVM)

Notes: ‘Year’ is the publishing year; ‘LR’ is short for Logistic Regression, ‘DT’ is short for Decision Tree; ‘NB’ is short for Native Bayes; ‘NN’ is short for Neural Networks; and ‘SVM’ is short for Support Vector Machine; ‘GA’ is short for Genetic Algorithm; ‘NLP’ is short for Natural Language Processing; ‘RF’ is short for Random Forest; ‘BBN’ is short for Bayesian Belief Network; ‘MFNN’ is short for Multilayer Feedforward Neural Network; ‘PNN’ is short for Probabilistic Neural Network; ‘DTNB’ is short for Decision Table/Naïve Bayes; ‘RUSBoost’ is short for Random Under-Sampling Boosting; ‘MRF’ is short for Modified Random Forest; ‘GBRT’ is short for Gradient Boosted Regression Trees, ‘ANN’ is short for Recurrent Neural Network; ‘LSTM’ is short for Long Short-Term Memory Network; ‘DBN’ is short for deepbeliefnetwork; ‘BP’ is short for BackPropagation; ‘FK’ is short for Financial Kernel, ‘GBT’ is short for Gradient Boosted Trees. SEC refers to the US Securities and Exchange Commission. AAERs refers to the Accounting and Auditing Enforcement Releases. CSMAR refers to China Stock Market & Accounting Research Database.

provides a detailed description of the major body of research on FSFD.

According to Table 1, many studies were conducted primarily based on financial data, for which their lagging nature constrains predictive performance. Moreover, many other data types, such as textual data [66,69], are employed for FSFD, as they can complementarily provide real-time soft information regarding corporate behavior, managerial intent, and social interactions. By complementarily reducing information asymmetry, they demonstrate excellent detection performance. Nevertheless, these feature extraction approaches only focus on fragmented data, lacking a unified theoretical framework for feature integration and for revealing fraud mechanisms. This encourages further exploration from an STS perspective.

2.3. Deep Learning Models

Deep learning, with its powerful feature extraction and pattern recognition capabilities, has achieved significant breakthroughs in natural language processing [26]. By building multi-layer neural networks, deep learning models automatically learn high-dimensional feature representations, greatly enhancing prediction accuracy. Notably, convolutional neural networks (CNNs), recurrent neural networks (RNNs), and their variants, such as long short-term memory (LSTM) and gated recurrent units (GRUs), effectively address the long-term dependency problem through recurrent connections and gate control mechanisms.

CNN: The CNN architecture comprises stacked convolutional layers, fully connected layers, and an output layer. The convolutional layers extract localized features, while pooling layers perform downsampling to reduce dimensions. Dropout regularization is employed during training to prevent overfitting. This hierarchical design facilitates the progressive learning of multi-scale spatial representations, which are optimized via a loss function.

RNN: Unlike traditional feedforward neural networks, RNNs establish circular connections between hidden layers to capture long-term dependencies and dynamically update hidden states. However, they are prone to gradient vanishing or explosion when processing long sequences, limiting their effectiveness in long-term dependency tasks.

LSTM: LSTM is a variant of RNN. It can automatically learn the feature representations of MTS and use embeddings in end-to-end models. To control the storage unit, the LSTM requires three different gates.

Firstly, a forget gate is required to determine which information in the cell state should be discarded or retained. It outputs a value between 0 and 1 through the sigmoid activation function, indicating the proportion of information retained from the previous cell state. With respect to the values, 1 means “fully retained,” while 0 means “completely discarded.” The formula is as follows:

$${\mathrm{f}}_{\mathrm{t}} = \mathsf{\sigma }\left({\mathrm{W}}_{\mathrm{f}}\cdot \left[{\mathrm{h}}_{\mathrm{t}-1},{\mathrm{X}}_{\mathrm{t}}\right] + {\mathrm{b}}_{\mathrm{f}}\right)$$

(1)

where$\mathsf{\sigma }$ is the sigmoid activation function; ${\mathrm{W}}_{\mathrm{f}}$ and ${\mathrm{b}}_{\mathrm{f}}$ are the weight and bias of the forgetting gate; ${\mathrm{h}}_{\mathrm{t}-1}$ is the hidden state of the previous time step; ${\mathrm{X}}_{\mathrm{t}}$ is the input of the current time step.

Secondly, an input gate is needed to determine new information that should be stored or updated in the cell state. It consists of two components: a sigmoid layer responsible for determining the updated extent (2) and a candidate cell state derived from the tanh activation function (3):

$${\mathrm{j}}_{\mathrm{t}} = \mathsf{\sigma }\left({\mathrm{W}}_{\mathrm{j}}·\left[{\mathrm{h}}_{\mathrm{t}-1},{\mathrm{X}}_{\mathrm{t}}\right] +{ \mathrm{b}}_{\mathrm{j}}\right)$$

(2)

$${\hat{\mathrm{c}}}_{\mathrm{t} }=\text{tanh}\left({\mathrm{W}}_{\mathrm{c}}·\left[{\mathrm{h}}_{\mathrm{t}-1},{\mathrm{X}}_{\mathrm{t}}\right]+{\mathrm{b}}_{\mathrm{c}}\right)$$

(3)

where ${\mathrm{W}}_{\mathrm{j}}$,${\mathrm{W}}_{\mathrm{c}}$,${ \mathrm{b}}_{\mathrm{j}}$, and ${\mathrm{b}}_{\mathrm{c}}$ are the weights and biases of the input gates.

Furthermore, an output gate is needed to determine what information from the cell state should be output. Specifically, it produces a value between 0 and 1 via the sigmoid activation function. This value is subsequently multiplied by the candidate activation (the tanh function) to compute the new hidden state:

$${\mathrm{o}}_{\mathrm{t}} = \mathsf{\sigma }\left({\mathrm{W}}_{\mathrm{o}}·\left[{\mathrm{h}}_{\mathrm{t}-1},{\mathrm{X}}_{\mathrm{t}}\right] +{ \mathrm{b}}_{\mathrm{o}}\right)$$

(4)

$${\mathrm{h}}_{\mathrm{t}}={\mathrm{o}}_{\mathrm{t}}·\text{tanh}\left({\mathrm{c}}_{\mathrm{t}}\right)$$

(5)

where ${\mathrm{W}}_{\mathrm{o}}$ and ${\mathrm{b}}_{\mathrm{o}}$ are the weight and bias of the output gate.

In addition to the gating mechanism, LSTM also introduces a cell state for storing long-term information. It combines the forgotten information in the cell state with the newly added information to obtain the updated cell state ${\mathrm{c}}_{\mathrm{t}}$. The formula is as follows:

$${\mathrm{C}}_{\mathrm{t}} = \mathrm{ft} ·{ \mathrm{C}}_{\mathrm{t}}-1 + \mathrm{jt} · {\hat{\mathrm{C}}}_{\mathrm{t}}$$

(6)

GRU: The GRU is a simplified version of LSTM. It combines the forget and input gates into an update gate to control what information is kept or discarded. It also combines the cell state and hidden state, reducing the number of parameters to two. The reset gate determines the retention of prior hidden state information, while the update gate adjusts the integration of new inputs into the current state. The resulting model is simpler than the standard LSTM model, and is hence becoming increasingly popular.

Attention mechanism: In neural networks, attention refers to a mechanism that simulates human cognitive attention [74]. The inspiration for this concept arises from the limitations of human attention, which cannot effectively process all significant information [26]. Instead, it can selectively concentrate on the most critical elements to acquire insights. Therefore, the core idea of the attention mechanism is to highlight the most relevant parts of input data rather than treating all parts equally.

Previous research has confirmed attention mechanisms to be a crucial component of predictive models, especially in the financial field, with their introduction enhancing the interpretability and predictive accuracy of models.

In this study, an attention mechanism is used to dynamically weight and integrate features according to their predictive importance. This approach amplifies impactful features to enhance model performance.

3. An Interpretable Financial Statement Fraud Detection Framework Enhanced by Temporal–Spatial Patterns (FSFD-ETSP)

In this study, we propose an interpretable financial statement fraud detection framework enhanced by temporal–spatial patterns (FSFD-ETSP), as shown in Figure 2. According to an STS, the framework firstly integrates diverse data as model inputs: operational and financial data for the technology element; audit and governance data for the structural element; social responsibility reports for the actor element; and key performance metrics for the task element. Then, we extract the behavior patterns of the spatial and temporal dimensions among peer firms using a clustering algorithm and LSTM networks, respectively. An attention mechanism is also incorporated to improve feature fusion by adaptively setting weights. Finally, the extracted features are fed into a fully connected (dense) layer for FSFD. In addition, we apply the SHAP method to provide holistic feature explanations with respect to FSFD, thereby validating fraud risks using an STS lens and ensuring detection transparency.

3.1. Multiple Inputs

From the perspective of an STS, an enterprise is a complex system in which task, technology, structure, and actor elements interact dynamically. Financial statement fraud is not caused by a single factor but results from the imbalance and maladaptive interactions of these four elements. To systematically analyze such risks, we have constructed a multi-level indicator system that is explicitly mapped onto the STS, as outlined in

Table 2. An STS-based multi-level indicator system.

STS Elements		Subdivision Dimension		Corresponding Indicators
X1	Task	X11	Supply Chain	Top 5 supplier purchase volume, ratio of procurement value of the largest supplier to total procurement value, supplier concentration, supply chain concentration
		X12	Business Predicament	Top 5 customer sales, ratio of sales to total sales of the largest customer, customer concentration, profit per capital
		X13	Ambitious earnings target	Financial indicators
X2	Technology	X21	Financial Statements	All 122 accounting subject items in balance sheets, profit sheets and cash flow sheets
		X22	The quality of accounting information	Financial distress Z-score
X3	Structure	X31	Audit opinion	The auditor is from the top 4 or top 8
		X32	Audit fee	Total audit fees
		X33	Internal control	The share capital structure changes, the chairman of the board of directors and the general manager concurrently serve as the situation, committees, the internal control evaluation and audit report disclosure, effectiveness and deficiencies of internal control
		X34	Equity	Equity nature, separation rate of two powers, the consistency of the working place of independent directors and companies, board, supervisory board and shareholders’ meetings, nature of property rights, the proportion of ownership, the separation rate of the two rights, the shareholding ratio and nature of the controlling shareholder, equity checks and balances, one control multiple situations, network centrality of independent directors
		X35	Shareholder	Number of directors, supervisors and senior executives, independent directors, shares held by directors, supervisors, senior management, regulator and senior executives, the total annual salary of directors and supervisors, total remuneration of directors, supervisors, executives, female supervisors, female directors, independent female directors, female senior managers, unpaid supervisors, directors and supervisors of unpaid remuneration, the first salary of the supervisor, remuneration of the first director, supervisors, senior management, top 10 shareholders, employees, retired employees, shareholding ratio of general manager, institutional investors and other financial institutions, total management compensation, employee density, excess employee rate, overseas or financial background, average age, proportion of men in management
X4	Actor	X41	Litigation and arbitration	Litigation and arbitration information
		X42	Social responsibility report	Third-party organization verification, refer to the GRI sustainability reporting guidelines, the protection of shareholders, creditors, employees, suppliers, customer and consumers’ rights and interests, environmental and sustainable development, public relations and social welfare undertakings, the construction of the social responsibility system and the measures for improvement, the content of safety production, the company’s deficiencies, announcement disclosure intention,
		X43	Geographical location	Longitude and latitude of office, Longitude and latitude of registration, Province, Region,
		X44	registered capital	Registered capital

. The quantification of the four core elements corresponds to the following specific indicators. Within this system, diverse company data are organized through an STS lens: financial and operational data correspond to the technology element; audit and corporate governance data reflect the structural element; social responsibility reports pertain to the actor element; key operational metrics align with the task element.

The task element encompasses the firm’s objectives and external pressures. Here, unrealistic performance targets (X₁₃), often stemming from supply chain pressures (X₁₁) or business predicaments (X₁₂), can create a powerful motive for fraud.

The technology element comprises tools and outputs for information processing and task achievement. With the misuse of technical tools, such as applying aggressive accounting treatment methods or directly beautifying reports, financial statements (X₂₁) with financial information and their authenticity—dependent on the quality of accounting information (X₂₂)—can be manipulated.

The structural element refers to institutional arrangements and the control environment, which determine fraud opportunities. A robust internal control system (X₃₃) is the primary defense, while the firm’s equity (X₃₄) and shareholder structures (X₃₅) constitute the governance foundation. External audits, reflected in the audit opinion (X₃₁) and audit fees (X₃₂), represent the external assessment and supervision of this internal structure.

The actor element consists of decision-makers and executors within the system, whose behaviors directly precipitate fraud. Litigation X₄₁ is a direct manifestation of conflicts among actors. A social responsibility report X₄₂ can, to some extent, reflect the management’s strategic vision and capability. Furthermore, geographical location X₄₃ and registered capital X₄₄ help to analyze the behavioral patterns of actors at the company level, considering the existence of peer effects.

As multiple inputs for FSFD, this STS-based multi-level indicator system goes beyond examining factors in isolation. It enables a systemic diagnosis of fraud risk by providing a critical linkage between task, technology, structure, and actor elements. By analyzing these interactions, regulators, auditors, and researchers can predict fraud risks in a more precise and timely manner, which is crucial for developing robust and preemptive anti-fraud measures.

3.2. Spatial Behavior Pattern Extraction

From an STS perspective, fraud risk is not a sudden, isolated event but a dynamically evolving process within an enterprise organization. It originates from intense task pressure and escalates as actors exploit systemic vulnerabilities in structures and technology. These interconnections dynamically change and potentially culminate in a major fraud incident.

Simultaneously, we should note that, in reality, peer firms exhibit structural correlations that create channels for risk propagation. When fraudulent behavior emerges in one firm, it can spread through these connected channels, generating negative social multiplier effects. In this study, we employ K-means clustering—an unsupervised learning method—to group firms together and define “peer firms” based on feature similarity. Concerning the dynamic nature of fraud risk, we profile each company with its STS-based characteristics spanning all time points instead of at a single time point. Through the K-means approach, each resulting cluster represents a distinct configuration of these spatial sociotechnical characteristics. There is no doubt that companies exhibiting high-risk fraud behavior patterns are typically grouped together. This also provides crucial insights for targeted monitoring and early warning systems focused on high-risk STS profiles.

As shown in Figure 3a, the primary input is a tensor X of three ranks, namely, time, feature, and firm. Any single sample slice on the firm dimension represents a company’s profile over time. As illustrated in Figure 3b, for company c, its corresponding time–feature matrix is as follows:

$${\mathrm{X}}_{\mathrm{i},\mathrm{t}}^{\mathrm{c}}=\left\{{\mathrm{x}}_{\mathrm{i},1},{\mathrm{x}}_{\mathrm{i},2},\dots ,{\mathrm{x}}_{\mathrm{i},\mathrm{t}}\right\}(\mathrm{i}\in [1,\mathrm{j}],\mathrm{t}\in [1,\mathrm{z}\left]\right)$$

(7)

where ${\mathrm{x}}_{\mathrm{i},\mathrm{t}}$ is the ith feature of company c at time t, resulting from the STS-based multi-level indicator system outlined in Table 2. Given the high dimensions of the feature vector for each company, the principal component analysis (PCA) approach—comprising the one-dimension reduction technique—is applied to reduce computational complexity and mitigate the curse of dimensionality while preserving as much information as possible. According to the PCA principle, an orthogonal projection matrix P can be derived from the computed principal components. Subsequently, as shown in formula (8) and Figure 3c, the time–feature matrix ${\mathrm{X}}_{\mathrm{i},\mathrm{t}}^{\mathrm{c}}$ of company c can be projected into a lower-dimensional space using matrix P:

$${\mathrm{Y}}_{\mathrm{i}\mathrm{’},\mathrm{t}}^{\mathrm{c}}=\mathrm{P}{\mathrm{X}}_{\mathrm{i},\mathrm{t}}^{\mathrm{c}}$$

(8)

where $\mathrm{i}\in [1,\mathrm{j}]$, $\mathrm{i}\mathrm{’}\in [1,\mathrm{j}\mathrm{’}]$, and $\mathrm{j}\mathrm{’}<\mathrm{j}$. Based on the low-dimensional time–feature matrix, we can construct a feature vector for each company. According to Figure 3d and formula (9), the time–feature matrix ${\mathrm{Y}}_{\mathrm{i},\mathrm{t}}^{\mathrm{c}}$ of company c can be flatted into a unified 1D vector ${\mathrm{Y}}^{\mathrm{c}}$. The stretched vector integrates the STS-based characteristics of all time points.

$${\mathrm{Y}}^{\mathrm{c}}=[{\mathrm{y}}_{1,1},{\mathrm{y}}_{1,2},\dots ,{\mathrm{y}}_{1,\mathrm{t}},\dots ,{\mathrm{y}}_{\mathrm{i},1},{\mathrm{y}}_{\mathrm{i},2},\dots ,{\mathrm{y}}_{\mathrm{i}’,\mathrm{t}},\dots ,{\mathrm{y}}_{\mathrm{j}’,1},{\mathrm{y}}_{\mathrm{j}’,2},\dots ,{\mathrm{y}}_{\mathrm{j}’,\mathrm{t}}]$$

(9)

In clustering, feature similarity can be measured using the average Euclidean distance. For any two companies (${\mathrm{c}}_1 \mathrm{and} {\mathrm{c}}_2)$, the degree of similarity can be expressed as follows:

$$\mathrm{d}\left({\mathrm{c}}_1,{\mathrm{c}}_2\right)={\displaystyle \frac{1}{\mathrm{T}}}{\sum }_{\mathrm{t}=1}^{\mathrm{T}}{‖{\mathrm{Y}}_{\mathrm{t}}^{{\mathrm{c}}_1}-{\mathrm{Y}}_{\mathrm{t}}^{{\mathrm{c}}_2}‖}_2$$

(10)

where ${\parallel \cdot \parallel }_2$ represents the L2 norm, T represents the total number of time points, and ${\mathrm{Y}}_{\mathrm{t}}^{\mathrm{c}}$ denotes the feature vector of company c at time t. The summation calculates the average Euclidean distance across all time points from 1 to T. Thus, formula (10) can compute the average distance between two companies over time.

As Figure 3e shows, through the K-means approach, the M clusters and the tensor X are transformed into M sets of the cluster matrix:

$$\mathrm{X}=\{{\mathrm{V}}_1,\dots ,{\mathrm{V}}_{\mathrm{m}}\} (\mathrm{m}\in [1,\mathrm{M}])$$

(11)

where ${\mathrm{V}}_{\mathrm{m}}=\left\{{\mathrm{Y}}^{\mathrm{c}}\right\}$ represents the matrix of cluster m, and ${\mathrm{Y}}^{\mathrm{c}}$ denotes company c in this cluster. This clustering approach is robust because its feature similarity measure assesses the holistic alignment of two firms’ STS elements throughout the observed period. It can analyze whether companies operating under similar task pressures—utilizing comparable technology—are governed by analogous structures and whether they are managed by actors with similar attributes over all time points rather than at any single time point. By analyzing patterns over all periods, companies sharing persistent and systemic spatial behavioral patterns are more likely to be grouped together. Finally, the matrices $\left\{{\mathrm{V}}_1,\dots ,{\mathrm{V}}_{\mathrm{m}}\right\}$ can be assembled into a single matrix G as the output, which is then used as the input for the next step (shown in Figure 3f).

3.3. Temporal Behavior Pattern Extraction

From an STS perspective, financial statement fraud is a dynamic process marked by the gradual accumulation of risk. To capture this temporal progression, we analyze multi-year corporate panel data using the most popular LSTM networks. LSTM networks are particularly adept at identifying long-range dependencies in sequential data, enabling the detection of subtle, evolving risk patterns that precede fraudulent activities.

In time series data, temporal behavior patterns are commonly observed as recurring shapes and features. For example, financial series can reflect industry traits, corporate strategies, and decision-making lagging effects. Deviations from existing patterns may indicate strategic misalignments or potential data manipulation. As shown in Figure 4, LSTM networks extract these temporal features through their internal cell states and network weights, learning representations of normal versus anomalous behavioral sequences. The practical significance of LSTM networks lies in their ability to detect abnormal changes during the years preceding fraud occurrence based on STS-based characteristics.

In this step, LSTM networks receive the matrix G as the input for extracting specific temporal behavior patterns and generate a low-dimensional representation $\mathrm{H}=\left\{{\mathrm{h}}_{1,\mathrm{t}},{\mathrm{h}}_{2,\mathrm{t}},\dots ,{\mathrm{h}}_{\mathrm{m},\mathrm{t}}\right\}$ as the output. Here, ${\mathrm{h}}_{\mathrm{m},\mathrm{t}}$ represents the hidden layer state of the mth cluster at the tth time step.

3.4. Feature Weight Modification

In this framework, we integrate the spatial group features from the K-means clustering step with the temporal dynamic features extracted via LSTM networks to carry out comprehensive FSFD. The spatial features represent each company based on its cluster assignment, while the temporal features capture the dynamic evolutions of STS elements over time. The combined approach enables dynamic risk assessments. For improved integration, an attention mechanism is employed to optimally weight spatial and temporal features.

This mechanism takes the low-dimensional representations of temporal–spatial patterns, $\mathrm{H}=\left\{{\mathrm{h}}_{1,\mathrm{t}},{\mathrm{h}}_{2,\mathrm{t}},\dots ,{\mathrm{h}}_{\mathrm{m},\mathrm{t}}\right\},$as inputs. These fused features are dynamically weighted based on their predictive relevance in order to obtain a global representation, which can simplify the model and accelerate calculations. Four steps are included in this process:

Step 1: Compute Query, Key, and Value separately for the low-dimensional representations, ${\mathrm{h}}_{\mathrm{m},\mathrm{t}}$, of the temporal–spatial patterns in each cluster:

$${\text{Query}:\mathrm{Q}}_{\mathrm{m}}={\mathrm{h}}_{\mathrm{m},\mathrm{t}}·{\mathrm{W}}_{\mathrm{q}}$$

(12)

$${\text{Key}:\mathrm{K}}_{\mathrm{m}}={\mathrm{h}}_{\mathrm{m},\mathrm{t}}·{\mathrm{W}}_{\mathrm{k}}$$

(13)

$${\text{Value}:\mathrm{V}}_{\mathrm{m}}={\mathrm{h}}_{\mathrm{m},\mathrm{t}}·{\mathrm{W}}_{\mathrm{u}}$$

(14)

where ${\mathrm{W}}_{\mathrm{q}}, {\mathrm{W}}_{\mathrm{k}},\text{and} {\mathrm{W}}_{\mathrm{u}}$ are the weight matrices.

Step 2: Calculate the attention score:

$${\text{Dot} \text{product} \text{attention}:{\text{attention}}_{\_}\text{scores}}_{\mathrm{mj}}={\mathrm{Q}}_{\mathrm{m}} · {\mathrm{K}}_{\mathrm{j}}^{\mathrm{T}}$$

(15)

where ${\mathrm{Q}}_{\mathrm{m}}$ and ${\mathrm{K}}_{\mathrm{j}}$are the Query and Key vectors of the temporal–spatial representation in the m-th and j-th clusters, respectively.

$${\text{Scaling} \text{dot} \text{product} \text{attention}: {\text{attention}}_{\_}\text{scores}}_{\mathrm{mk}}={\displaystyle \frac{{\mathrm{Q}}_{\mathrm{m}}·{\mathrm{K}}_{\mathrm{j}}^{\mathrm{T}}}{\sqrt{\mathrm{n}’}}}$$

(16)

$${\text{Softmax} \text{normalization}:\mathsf{\alpha }}_{\mathrm{mj}}=\text{soft} \text{max}({{\text{attention}}_{\_}\text{scores}}_{\text{mj}})={\displaystyle \frac{\text{exp}({{\text{attention}}_{\_}\text{scores}}_{\text{mj}})}{{\sum }_{\mathrm{k}=1}^{\mathrm{t}}\left({{\text{attention}}_{\_}\text{scores}}_{\text{mk}}\right)}}$$

(17)

Here, ${\mathsf{\alpha }}_{\text{mj}}$ is the attention weight between the m-th and j-th clusters. Softmax ensures that the sum of the attention weights for each row is 1.

Step 3: Use the weighted sum to obtain the context vector:

$${{\text{attention}\_\text{output}}_{\mathrm{m}}=\mathsf{\alpha }}_{\text{mj}}·{\mathrm{V}}_{\mathrm{j}}$$

(18)

where ${\mathrm{V}}_{\mathrm{j}}$ is the value vector in the j-th cluster.

Step 4: Carry out the temporal–spatial characterization of clusters:

$$\mathrm{S}={\displaystyle \frac{1}{\mathrm{m}}}{\sum }_{\mathrm{i}=1}^{\mathrm{m}}{\text{attention}\_\text{output}}_{\mathrm{m}}$$

(19)

Finally, the attention mechanisms generate a global representation S as the output, which is used as the input for the next step.

3.5. Financial Statement Fraud Detection

In this subsection, we employ a fully connected (dense) layer as the prediction model. It receives global representation S from the attention mechanism as an input and generates the predicted value $\hat{\mathrm{y}}$:

$$\hat{\mathrm{y}} = \text{model.predict}\left(\mathrm{S}\right) ={ \mathrm{W}}_{\mathrm{p}}\mathrm{S} + {\mathrm{b}}_{\mathrm{p}}$$

(20)

where ${\mathrm{W}}_{\mathrm{p}}$and ${\mathrm{b}}_{\mathrm{p}}$ are the weight matrix and bias vector of the fully connected layer, respectively.

In the training process, the Adam optimizer is used to adjust the learning rate of each parameter. Specifically, it minimizes the loss function L through a backpropagation algorithm, adjusting the model parameters ${\mathrm{W}}_{\mathrm{p}}$ and ${\mathrm{b}}_{\mathrm{p}}$ such that the predicted value $\hat{\mathrm{y}}$ is as close as possible to the true label y. Considering efficient gradients and faster convergence, we employ binary cross-entropy in the loss function to train our model for FSFD. The loss function is defined as follows:

$${\mathrm{L}}_{\mathrm{BCE}}=-{\displaystyle \frac{1}{\mathrm{N}}}\sum _{\mathrm{c}=1}^{\mathrm{N}}\left[{\mathrm{y}}_{\mathrm{c}}·\log \left({\hat{\mathrm{y}}}_{\mathrm{c}}\right)+\left(1-{\mathrm{y}}_{\mathrm{c}}\right)·\log \left(1-{\hat{\mathrm{y}}}_{\mathrm{c}}\right)\right]$$

(21)

where N is the number of companies, ${\hat{\mathrm{y}}}_{\mathrm{c}}$ is the predicted value of company c, and ${\mathrm{y}}_{\mathrm{c}}$ is the true label of company c.

3.6. Detection Result Explanation

Inspired by the Shapley value from cooperative game theory, this study uses the SHAP method to quantify indicator contributions for FSFD. It can provide a globally interpretable framework that transcends conventional indicator ranking. Quantifying both the direction and magnitude of indicator influences, it supports a logical interpretation of fraud risks through an STS perspective.

Financial statement fraud risks stem from maladaptive interactions among task, technology, structure, and actor elements. Positive SHAP values, visualized as red in dependency plots, indicate an increased likelihood of fraud risk. They may reflect task pressures, actor traits, or structural weaknesses that may result in fraudulent behaviors. Conversely, negative SHAP values, shown in blue, signal protective factors that reduce fraud risk. The SHAP analysis not only enhances model transparency but also decodes the essence of fraud risk from an STS perspective, thereby offering a systemic mechanism for risk generation and mitigation.

The principle of the SHAP method is as follows:

$$\mathrm{f}\left(\mathrm{x}\right)={\varnothing }_0\left(\mathrm{f}\right)+\sum _{\mathrm{i}=1}^{\mathrm{M}}{\varnothing }_{\mathrm{i}}\left(\mathrm{f},\mathrm{x}\right)$$

(22)

where ${\varnothing }_0\left(\mathrm{f}\right)$ is the expected value of the model’s output, and the sum of ${\varnothing }_{\mathrm{i}}\left(\mathrm{f},\mathrm{x}\right)$ matches the output $\mathrm{f}\left(\mathrm{x}\right)$of the original tree-based model. ${\varnothing }_{\mathrm{i}}\left(\mathrm{f},\mathrm{x}\right)$ is the contribution value of indicator ${\mathrm{x}}_{\mathrm{i}}$, and its formula is as follows:

$${\varnothing }_{\mathrm{i}}\left(\mathrm{f},\mathrm{x}\right)={\displaystyle \frac{1}{\mathrm{M}}}\sum _{\mathrm{s}\subseteq \mathrm{N}∕\mathrm{i}}{\displaystyle \frac{\mathrm{u}\left(\mathrm{S}\cup \mathrm{i}\right)-\mathrm{u}\left(\mathrm{S}\right)}{{\mathrm{C}}_{\mathrm{n}-1}^{\left|\mathrm{s}\right|}}}$$

(23)

where $\mathrm{u}\left(\mathrm{S}\right)$is the value of the characteristic subset S as the input. This equation represents the weighted average of the difference in contributions between all indicator subsets, regardless of whether indicator ${\mathrm{x}}_{\mathrm{i}}$ is included.

For each observation, we obtain the interpretation set $\mathrm{E}=\left\{{\varnothing }_{\mathrm{i}}\left({\mathrm{f}}_1,\mathrm{x}\right),{\varnothing }_{\mathrm{i}}\left({\mathrm{f}}_2,\mathrm{x}\right),\dots ,{\varnothing }_{\mathrm{i}}\left({\mathrm{f}}_{\mathrm{T}},\mathrm{x}\right)\right\}$ for each indicator ${\mathrm{x}}_{\mathrm{i}}$.

4. Experimental Design

4.1. Sample Data

Over the past 12 years (2010–2022), most financial statement fraud cases occurred in the manufacturing; agriculture; forestry, animal husbandry and fisheries; and information transmission, software, and IT service industries [11]. Concurrently, due to the effects of economic downturns and structural adjustments, China’s capital market has entered a period with a high incidence of financial fraud. Concerning the extreme imbalance between fraud and non-fraud companies across all industries, we confine our experiments to the above high-risk industries to improve sample quality. Through experiments, we aim to validate the effectiveness of the proposed FSFD framework, and we attempt to open the FSFD “black box” to reveal the essence of fraud risk.

4.2. Data Collection

With a comprehensive sampling approach, experimental data were collected from company research series in the CSMAR database (https://data.csmar.com/, accessed on 27 October 2025), covering basic finance, operation, audit, governance, social responsibility, and corporate information. The obtained data directly correspond to indicators across these dimensions on a one-to-one basis. The constructed dataset consists of 24,982 firm-year observations. We also manually extracted the violation information of those observations. Observations associated with reported violations are assigned a positive label (1), resulting in 11,247 positive instances, while the remaining 13,734 compliant instances are labeled as negative (0). This constitutes a 45.1% positive and 54.9% negative class distribution.

4.3. Data Preprocessing

We processed the data according to the following steps to prepare them for model training and evaluation:

(1)

First, we filled missing spaces with the mean values of their corresponding attributes. This method was selected to preserve the sample size and the dataset’s overall distribution.

(2)

Second, as financial statement fraud is detected based on annual reports, we set the year as the minimum time granularity and standardized all temporal data to a uniform yearly level. This step ensures consistency with the annual disclosure cycle.

(3)

We then standardized all indicators to have a mean of 0 and a standard deviation of 1 using Z-score normalization. This process removes the influence of different measurement scales and distribution ranges, which helped our model to learn effectively by transforming all indicators to the same statistical scale while preserving their original distribution shapes and relative relationships.

(4)

Finally, we randomly divided the processed data into training and testing sets at an 8:2 ratio. The training set was used for model training, hyperparameter tuning, and validation, while the testing test set was reserved solely for final evaluation to report the model’s performance.

4.4. Model Training and Hyperparameter Tuning

In our experiment, all algorithms were implemented in pycharm community edition 2023 on an AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx (2.10 GHz). The training process of the proposed framework was iterated over 1000 epochs using the Adam optimizer with a learning rate of 0.001, which ensured stable and efficient convergence. In FSFD, we use corporate data from year t-2 to predict fraud occurrence in year t, which provides a two-year early-warning window. The model’s architecture employs bidirectional LSTM layers with 128 units, a global average pooling 1D attention mechanism, and dense layers comprising 64 and 1 unit with sigmoid activation. Regularization includes a dropout rate of 0.3 and L2 regularization of 0.001. Additional parameters include a batch size of 32; PCA with 95% variance retention; K-means clustering with 2–8 automatic cluster determinations; balanced class weighting; early stopping with a patience of 5; learning rate reduction with a patience of 3; and data preprocessing using fixed 3-step sequences.

4.5. Model Validation and Evaluation

To ensure the generalization ability of the proposed framework and mitigate possible overfitting, we adopted K-fold cross-validation on the training set. The original training data after the initial 8:2 split were partitioned into K = 5 folds with a fixed random seed of 42 to ensure reproducibility. For each unique fold, we carried out the following:

(1)

Treated the selected fold as a validation fold;

(2)

Trained the model on the remaining 4-fold subset;

(3)

Evaluated the model on the selected fold.

The final performance metrics, reported as the mean across all 5 folds, provide a reliable estimate of the model’s efficacy.

As illustrated in

Table 3. The Confusion matrix.

	Positive	Negative
Positive	TP	FN
Negative	FP	TN

, we use a confusion matrix to evaluate detection performance. The matrix calculates five metrics, namely, accuracy, precision, recall, F1 score, and AUC (area under the ROC curve), as shown in

Table 4. Specific of each metric.

Metric	Formula	Code
Accuracy	$\text{Accuracy}={\displaystyle \frac{\text{TP}+\text{TN}}{\text{TP}+\text{FP}+\text{FN}+\text{TNTP}+\text{TN}}}$	24
Precision	$\text{Precision}={\displaystyle \frac{\text{TP}}{\text{TP}+\text{FP}}}$	25
Recall	$\text{Recall}={\displaystyle \frac{\text{TP}}{\text{TP}+\text{FN}}}$	26
F1-Score	$\text{F1-Score}=2\times {\displaystyle \frac{\text{Precision}\times \text{Recall}}{\text{Precision}+\text{Recall}}}$	27
AUC	$\text{TPR}={\displaystyle \frac{\text{TP}}{\text{TP}+\text{FN}}}$ $\text{FPR}={\displaystyle \frac{\text{FP}}{\text{FP}+\text{TN}}}$	28 29

.

TP and TN represent the number of companies correctly classified as fraudulent and non-fraudulent companies, respectively. FP and FN represent the number of companies falsely classified as fraudulent and non-fraudulent, respectively.

5. Results and Further Research

The analytical techniques adopted in this study are clearly outlined as follows. For performance evaluation, comparative analysis of key metrics served as our primary analytical technique. This involved using a set of widely recognized statistical indicators, namely, accuracy, precision, recall, F1 score, and auc, to assess all models on a test set. The models were then directly compared based on the results of these metrics to objectively determine the optimal performer. Furthermore, to enhance the interpretability of our framework, we incorporated SHAP method as a quantitative analytical technique from the field of explainable AI. This technique provides a rigorous, quantitative measure of feature importance and contribution for each indicator, thereby allowing for analyzing the framework’s decision-making process and exploring intrinsic patterns of fraud risk.

We firstly validate the effectiveness of LSTM networks and the K-means clustering approach in our proposed FSFD-ETSP framework. Then, we verified the performance of FSFD-ETSP with other classical machine learning and deep learning techniques. Finally, we applied the SHAP method to provide a holistic interpretation of the framework and reveal fraud risk patterns consistent with the enterprise STS framework. It is important to note that SHAP provides an interpretable breakdown of model predictions rather than inferring causality on its own.

5.1. Validate the Effectiveness of Temporal Behavior Patterns

Within an enterprise STS, a firm’s sequential data can reflect its operational status, and from the status, we can extract strategic shifts and anomalies (e.g., unusual revenue cycles or irregular expense) as temporal patterns for FSFD. In the proposed framework, we apply LSTM for temporal pattern extraction, and compare it with three other commonly used methods, namely, CNN, RNN, and GRU. The detection results from the test set are shown in

Table 5. The detection performance of temporal behavior pattern extraction model. All methods utilized the same identical strategies listed in Section 4.4.

Method	Accuracy	Precision	Recall	F1 Score	AUC
LSTM	0.9804	0.9767	0.9800	0.9783	0.9977
CNN	0.9718	0.9720	0.9718	0.9718	0.9934
GRU	0.9474	0.9165	0.9715	0.9432	0.9945
RNN	0.9337	0.9363	0.9337	0.9339	0.9876

. To ensure robust performance assessments, all reported metrics are computed using the weighted average method. This approach ensures that the performance contribution of each class is proportional to its size, providing a more reliable and aggregate view of the model’s effectiveness.

According to Table 5, LSTM outperforms the other three deep learning models across all metrics. This is primarily because LSTM excels at capturing long-term dependencies in time series, has strong memory capabilities, and allows for more flexible model tuning. In contrast, RNN struggles with these dependencies and often experiences gradient vanishing or explosion. GRU simplifies the LSTM structure, but this weakens its ability to handle long sequences. CNN is good at extracting local features, but it is generally less effective in processing global contextual information compared to LSTM. In summary, the proposed LSTM model performs best in temporal behavior pattern extraction procedures.

5.2. Validate the Effectiveness of Spatial Behavior Patterns

Since fraudulent behaviors can spread in an enterprise STS, companies exhibiting similar behavioral patterns are usually considered as “peer firms”. These structural correlations could comprise key factors affecting FSFD performance, which are usually ignored by current detection models. In this section, we compare detection performance using either temporal behavior patterns (T) alone or temporal–spatial patterns together (T+S) as input features. We conduct the entire experiment using four types of temporal behavior pattern extraction models, namely, LSTM, CNN, GRU, and RNN. The detection performance on the test set can be observed in

Table 6. The detection performance of models with the features T and T+S. All methods utilized the same identical strategies listed in Section 4.4. ROC demonstrates the rate of change in model performance.

FSFD-ETSP	Features	Accuracy	Precision	Recall	F1 Score	AUC
LSTM	T	0.8135	0.7734	0.8284	0.8000	0.8909
	T+S	0.9804	0.9767	0.9800	0.9783	0.9977
	ROC	0.1669	0.2033	0.1516	0.1783	0.1068
CNN	T	0.8421	0.8264	0.8201	0.8232	0.9188
	T+S	0.9718	0.9720	0.9718	0.9718	0.9934
	ROC	0.1297	0.1456	0.1517	0.1486	0.0746
GRU	T	0.7597	0.7235	0.7547	0.7387	0.8415
	T+S	0.9474	0.9165	0.9715	0.9432	0.9945
	ROC	0.1877	0.193	0.2168	0.2045	0.153
RNN	T	0.7775	0.7461	0.7667	0.7562	0.8638
	T+S	0.9337	0.9363	0.9337	0.9339	0.9876
	ROC	0.1562	0.1902	0.167	0.1777	0.1238

. Similarly to Section 5.2, all reported metrics are computed using the weighted average method.

Using temporal–spatial behavior patterns provides an overall improvement with respect to all models, with a maximum increase of 0.1877 in accuracy, 0.2033 in precision, 0.2168 in recall, 0.2045 in F1 score, and 0.153 with respect to AUC. Among these models, LSTM exhibited superior performance, demonstrating the effectiveness of the proposed framework (FSFD-ETSP).

Models relying solely on temporal patterns can detect isolated enterprise violations; however, they ignore collective fraud signals. Spatial behavior patterns can capture structural correlations and offer a crucial complementary view among companies. For example, geographically proximate companies generally face the same regulatory pressures and policy incentives, which can exacerbate coordinated fraud. Industry peers exhibit correlated risk signals when adopting similar aggressive accounting practices. Consequently, these spatial behavior patterns usually expose collective fraud signals or shared external risks. Models incorporating temporal–spatial patterns outperform those that rely solely on temporal patterns.

5.3. Validate the Effectiveness of FSFD-ETSP

To test whether our proposed framework can enhance FSFD, we compared FSFD-ETSP with eight benchmark methods.

Table 7. The detection performance of various methods. All methods utilized the same identical strategies listed in Section 4.4.

Method	Accuracy	Precision	Recall	F1 Score	AUC
FSFD-ETSP	0.9804	0.9767	0.9800	0.9783	0.9977
CNN	0.7124	0.6602	0.7444	0.6998	0.7889
RNN	0.7645	0.7162	0.7898	0.7512	0.8504
GRU	0.7923	0.7681	0.7716	0.7698	0.8759
LR	0.6240	0.5744	0.6223	0.5974	0.6719
SVM	0.7244	0.6831	0.7188	0.7005	0.8002
DT	0.7130	0.6751	0.6937	0.6843	0.7112
RF	0.8785	0.9049	0.8160	0.8581	0.9534
XGB	0.9248	0.9298	0.9009	0.9151	0.9784

Note: The specific hyperparameter settings for benchmark methods. LR: max_iter = 1000, solver = ‘liblinear’; SVM: kernel = ‘rbf’, C = 1.0, probability = True; DT: criterion = ‘gini’, max_depth = None; RF: n_estimators = 300, max_depth = None; XGB: n_estimators = 300, max_depth = 6, learning_rate = 0.1; CNN: Conv1D layer (32 filters, kernel_size = 2); GlobalAveragePooling, Dense(16), Dropout(0.3); GRU: 64 units, Dropout(0.2), Recurrent Dropout(0.2), Dense(32); RNN: SimpleRNN (64 units), Dropout(0.2), Recurrent Dropout(0.2), Dense(32); LSTM: Bidirectional architecture [128, 64 units], attention mechanism.

summarizes the weighted average results of all performance metrics on the test set.

Overall, FSFD-ETSP outperformed all benchmark methods in terms of all performance metrics, with an accuracy of 98.04%, precision of 97.69%, recall of 98%, F1 score of 97.83%, and AUC of 99.77%. FSFD-ETSP is a favorable candidate for FSFD, as it is able to extract complex patterns in both temporal and spatial dimensions. In FSFD-ETSP, PCA is first used to reduce the high dimensionality of corporate data while preserving critical information. The clustering step accounts for structural similarities and differences among firms, identifying subgroups with homogeneous risk profiles. A BiLSTM network then models the temporal sequences within each cluster to capture evolving risk patterns. An attention mechanism is also incorporated to improve feature fusion by adaptively setting weights, ensuring the model focuses on the most critical time periods. This PCA + clustering + BiLSTM + attention + SHAP-based architecture is appropriate as it systematically addresses the high dimensionality, heterogeneity, and temporal complexity inherent in financial fraud data. Simpler models often fail to simultaneously capture these intertwined spatial and temporal risk patterns. Furthermore, the inclusion of SHAP provides essential model interpretability, transcending a “black-box” prediction to offer reasonable insights into risk factors.

XGBoost and random forest ensemble weak classifiers achieve good performance, with accuracies of 92.48% and 87.85%, respectively. CNN, RNN, and GRU are deep learning models that can extract nonlinear patterns among data; however, they are inferior to ensemble methods. LR, SVM, and DT are traditional machine learning methods that have limitations when applied in complicated conditions, exhibiting the poorest detection performance.

As for CNN, RNN, and GRU, their performance varies, as can be observed in the results shown in Table 5 and Table 7. In Table 5, they are substitutes for LSTM networks and embedded to extract temporal patterns. As part of FSFD-ETSP, their excellent performance demonstrates the effectiveness of the framework. In contrast, the other deep learning models are applied independently as end-to-end classifiers to extract nonlinear patterns and carry out FSFD. They were trained and evaluated on the complete and raw input dataset without the specialized feature engineering and fusion modules present in FSFD-ETSP. As shown in Table 7, their performance is inferior to ensemble methods. This also identifies the importance of spatial and temporal patterns in FSFD.

5.4. Interpret the Detection Process in FSFD-ETSP

In this study, for better comparability across features, the SHAP values were first standardized (z-score normalization). We then averaged the absolute values of the final Shapley values to generate a global interpretation of FSFD-ETSP. Summing SHAP values across all samples provides a global indicator importance ranking, showing which indicator exerts the most influence on the overall model. These values can be positive or negative, indicating whether an indicator increases or decreases the likelihood of fraud. Red represents a positive contribution, increasing fraud risk; blue represents a negative contribution, reducing the risk. In Figure 5, the x-axis denotes the standardized SHAP value, indicating the feature’s marginal contribution to the predicted fraud risk, and the y-axis represents the feature value.

From an STS perspective, financial statement fraud arises from the complex interplay of four core elements, as shown in Figure 5. The analysis of the top 10 most important indicators validates this system, as they can be distinctly categorized into these four elements.

Task-related pressures—which comprise operational dependencies, ambitious earning targets, and intense performance reporting demands—often encourage fraudulent activities. This is evidenced by indicators such as customer concentration, which can motivate fraudulent activities. Actors play a central role within this system, with their decisions and incentives driving spatial behavior patterns. This is strongly supported by the dominance of geographical indicators, such as office latitude and the longitude of the registered address. Structural elements determine opportunities for fraud by defining governance structure. Indicators such as the chairman’s shareholding ratio, the top 10 shareholders, the total number of shareholders, and the number of senior executives reveal that governance mechanisms and organizational scale can create critical vulnerabilities in oversight. Technology serves as a catalyst for manipulation. Accounting indicators, such as capital reserve and undistributed profits, represent the technical tools and flexibilities in financial reporting that can be adjusted in response to performance pressures.

In conclusion, these indicators confirm that financial statement fraud is a systemic risk. The interconnectedness of tasks, actors, structures, and technology means that a vulnerability in one element can amplify weaknesses and propagate risks throughout the entire sociotechnical system.

5.5. Analyze the Intrinsic Associations of Fraud Risks Through Indicator Impact Patterns

We further carry out a deeper analysis of the specific relationships between the top 10 most important indicators and financial statement fraud using SHAP dependence plots. For better comparability across features, the SHAP values were standardized (z-score normalization) before generating the dependence plots and analysis. In Figure 6, Figure 7, Figure 8, Figure 9, Figure 10, Figure 11, Figure 12, Figure 13 and Figure 14, the x-axis represents the feature value, and the y-axis denotes the standardized SHAP value, indicating the feature’s marginal contribution to the predicted fraud risk.

(1)

Analysis of actor-related indicators

According to Figure 6 and Figure 7, actors’ behavior is significantly influenced by their geographic environment, which shapes fraud incentives via two primary aspects.

Figure 6 reveals a sharp spike in fraud risk within the 31.2° N–31.6° N latitude band—a major industrial zone and the core of the Yangtze River Delta. Here, SHAP values consistently exceed 0.05, peaking at 0.058 near 31.6° N, which indicates a pronounced “peer effect” in this high-risk region. When local firms engage in aggressive accounting and are rewarded by the market, they create powerful imitation incentives for their geographic peers.

Figure 7 shows persistently high risk within the coastal longitude range of 121.2° E–121.8° E, where SHAP values consistently exceed 0.045 and peak at 0.052 near 121.5°E. Here, actors face conflicting international and domestic institutional pressures. This environment fosters a specialized skillset in regulatory arbitrage, where firms learn to exploit loopholes across different regimes. These practices diffuse through local networks, forming a regional “accounting sub-culture”.

In essence, geography is not merely a location; it is a social and institutional environment that directly shapes how actors perceive opportunities and rationalize the manipulation of technology.

(2)

Analysis of technology-related indicators

Based on Figure 8 and Figure 9, technology-related indicators demonstrate that internal and external pressures can shape financial reporting behavior.

Figure 8 identifies an inverted U-shaped effect driven by internal profit allocation. When undistributed profits reach 15–25% of net assets with SHAP values increasing from 0.02 to 0.042, managers face conflicting objectives between profit retention and reinvestment, increasing incentives for accounting manipulation. Once this ratio exceeds 40%, evidenced by a drop in SHAP value to approximately 0.018, ample profit reserves and heightened external scrutiny jointly curb such behavior.

Figure 9 reveals that unusual capital accumulation often reflects technical adjustments aimed at meeting capital market expectations. Under weak internal controls, such adjustments are more likely to evolve into fraudulent reporting.

(3)

Analysis of task-related indicators

According to Figure 10, the accelerating growth pattern in SHAP values demonstrates that supply chain dependency drives technical manipulation. A high reliance on key customers creates significant operational pressure. This pressure compels management to employ technical methods to enhance reported performance.

(4)

Analysis of structure-related indicators

According to Figure 11, Figure 12, Figure 13 and Figure 14, the structural element determines opportunities for fraud. An analysis of the key structural features reveals a consistent pattern, where governance is most effective when power is balanced, and it is weakest when it is overly dispersed or concentrated.

Power distribution, measured using equity concentration, is a primary example. Below 35%, the SHAP value jumps from 0.038 to 0.048, and dispersed ownership results in ineffective monitoring. Above 65%, marked by a rebound in SHAP value from 0.021 to 0.034, dominant shareholders can overpower internal controls and manipulate technology for personal gain. Effective checks and balances are observed primarily within the moderate shareholding range of 35–65%, where the associated fraud risk remains low and stable, as evidenced by consistently low SHAP values around 0.02.

Decision-making dynamics, reflected in the number of senior executives, exhibit a similar nonlinear effect. Having fewer than five executives results in excessive power concentration, as indicated by an increase in SHAP value of approximately 0.019. On the other hand, teams with more than twelve executives result in high coordination costs and diffused responsibility, corresponding to a SHAP increase of about 0.021. A team of five to eight executives best balance efficiency with diverse oversight, as evidenced by consistently low SHAP values around 0.014.

Collective supervision, indicated by the total number of shareholders, also affects governance. Too few shareholders weaken oversight, while organizations with too many shareholders encourage free-rider behavior. Both scenarios reduce the incentive for individual shareholders to monitor management effectively.

In summary, the structure of an organization sets the foundation of its integrity. Imbalances in ownership or decision-making power undermine supervision. This creates critical vulnerabilities in the system, allowing actors to exploit technology under task-related pressures.

6. Conclusions

In this study, we constructed an STS-based multi-level indicator system for FSFD, providing the theoretical foundation and analytical framework for subsequent work. The effectiveness of current approaches can be attributed to pattern learning. With the influx of more data and the adoption of advanced technologies, these approaches are becoming increasingly capable of learning complex patterns. However, the employed data are normally fragmented and cannot provide a complete description of financial fraud, resulting in limited detection performance. Beyond traditional research, the proposed indicator system posits that fraud risk arises from long-term interactions among four core STS elements: task, technology, actor, and structure. Unlike data-driven approaches, the indicator system can capture fraudulent behaviors by accounting for all possible risk factors within an enterprise STS.

Furthermore, we developed a novel fraud detection framework, FSFD-ETSP, and validated its effectiveness with various baseline models. Concerning the dynamic changing and spreading nature of fraud risks in temporal and spatial dimensions, we integrated LSTM networks and the K-means approach to capture their temporal and spatial behavior patterns. Experiments on data from A-share listed companies demonstrate that firms exhibit explicit strategic shifts in the temporal dimension and peer contagion across the spatial dimension. Notably, the proposed FSFD-ETSP was found to clearly outperform other machine learning and deep learning techniques. The superior performance of FSFD-ETSP verifies the importance of spatial–temporal behavior patterns. Therefore, modeling these patterns is key to achieving early warning and supporting organizational resilience.

To gain deeper insights into the framework’s detection logic and validate theoretical hypotheses, we utilized the explainable SHAP technique to dissect key factors for FSFD and empirically validated the STS-based understanding of fraud risks. We opened the “black box” of the framework by analyzing the marginal contributions of the top 10 most important indicators with explainable AI techniques, specifically SHAP analysis. Moreover, we empirically validated the interaction patterns of four STS elements, associating the suggested potential patterns of fraud risks. These SHAP results not only reveal which indicators are most critical in FSFD but also align perfectly with our initial STS-based theoretical proposition on fraud risks.

In addition, the SHAP analysis carried out on each element in the enterprise STS provides some interesting insights regarding fraud risk. Inspired by our observations, we provide the following recommendations: (1) Dynamic resource allocation should be implemented. Fraud risks exhibit significant geographic concentration; for example, firms located at 31.2° N to 31.6° N and 121.2° E–121.8° E are more likely to exhibit fraudulent behaviors. Regulatory resources should be strategically concentrated in high-risk regions, rather than being evenly distributed. (2) A balanced governance structure should be built. Excessive concentration/decentralization of power distributions in a corporate setting could create opportunities for unethical manipulation; for example, if the top 10 shareholder indicator exceeds 65%, a great number of shareholders dominate the company and may manipulate internal control mechanisms for personal gain. In contrast, if the indicator falls below 35%, dispersive power usually results in ineffective monitoring. It is thus necessary to maintain reasonable ranges with respect to ownership concentration and size. Taken together, these observations suggest that indicators related to actor and structure elements are particularly crucial in prediction, which is in accordance with our STS-based understanding of fraud risk.

We acknowledge several limitations of this study. First, our data were sourced exclusively from high-risk industries of A-share listed companies in China, which may limit the generalizability of our findings to other economic contexts. We plan to incorporate data from other industries and countries to test the robustness of the proposed framework. Second, while the FSFD-ETSP framework demonstrates high performance, we did not conduct systematic ablation studies to explore the contribution of each component (e.g., LSTM and K-means). Future research could explore simpler or alternative architectures to confirm the necessity of our design.

Moreover, as our method integrates LSTM networks and the clustering approach, the proposed FSFD-ETSP framework requires higher computation power and storage capacity, reducing efficiencies in real-time applications. With respect to this limitation, we plan to utilize incremental data rather than complete data as inputs for FSFD, and we will attempt to integrate other techniques, such as incremental learning and model distillation, into the framework such that the FSFD solution can be used in resource-constrained environments. Finally, as noted in our conclusion, this study offers valuable insights with respect to indicator importance in FSFD; however, identifying the complex, nonlinear causal relationships among spatial and temporal features remains a challenge. In the future, we will employ various causal discovery algorithms—such as Peter–Clark-based algorithms—to identify causal relationships among multiple factors.