Traditional Enterprise Resource Planning (ERP) systems excel at quantifying budgetary variances but fail to identify their root causes, leaving financial analysts with time-consuming manual investigation. We present Causal-LLM, a hybrid framework that integrates causal discovery algorithms with Large Language Models (LLMs) to automate root cause diagnosis in budgetary variance analysis. Our approach combines constraint-based causal inference to construct financial causal graphs with LLM-powered contextual reasoning to generate human-interpretable explanations. By leveraging a domain-specific Financial Causal Knowledge Graph, Causal-LLM bridges the gap between statistical correlation and genuine causation. Experimental evaluation on 240 labeled variance cases from a real-world enterprise (24 months of data) demonstrates that our framework achieves 0.87 top-1 accuracy in root cause identification (95% CI: [0.82, 0.91]), outperforming traditional statistical methods (0.68), pure LLM approaches (0.76), and standalone causal methods (0.72). The system generates actionable insights with 0.92 explainability scores (inter-rater agreement ICC=0.84), reducing investigation time from an estimated 2--4 hours (mean: 3.2 hours, based on internal workflow estimates from five senior analysts) to under 10 seconds per case. Results are demonstrated on one manufacturing enterprise; generalization to other industries requires domain-specific ontology adaptation.

This paper targets key challenges in enterprise financial anomaly monitoring, including coupled multi-source heterogeneous features, concealed anomaly signals, and cost-sensitive alerting. It proposes a unified monitoring framework based on representation-driven data modeling. The approach first normalizes and encodes transaction and identity-related fields within a unified feature space. A learnable representation mapping function is then used to obtain low-dimensional latent representations. A reconstruction consistency mechanism is introduced to suppress noise while preserving essential behavioral information. In the latent space, normal behavior structures are statistically characterized. Structural anomaly signals are derived by measuring the deviation between representation centers and sample representations. These signals are combined with reconstruction errors from the original inputs to form a unified anomaly score. This enables continuous ranking of samples and threshold-based anomaly decisions. To ensure controllability in training and deployment, the framework is systematically analyzed from the perspectives of hyperparameter sensitivity, including learning rate, optimizer choice, and network depth, as well as environmental sensitivity under input noise injection. The analysis delineates the impact boundaries of key configurations on overall detection performance and stability. The results demonstrate that the framework maintains consistent risk identification characteristics under different configurations and perturbations. It provides sortable and configurable anomaly signals for enterprise risk alerts, audit sampling, and compliance inspection.