Chapter 3: The Audit Trail
For a moment, I could hear only the air-conditioning.
Then the board secretary leaned across the table to inspect the page in front of me.
“Is this the version that was distributed before the meeting?” I asked.
She glanced at the packet in her hands. “I don’t know. It was included with the supplemental materials I received.”
“Who sent it to you?”
“I was told it came from the company’s document system.”
That answer identified a place, not a person. I set the page down carefully.
David sat across the table, his expression composed again. He looked as if the draft had nothing to do with him.
Eleanor spoke before I could.
“Please preserve the packet as distributed, including its cover email, file properties, and any available version history. No one should edit, replace, or circulate a revised copy until the source is established.”
The board chair nodded to the secretary.
“Make a note of that.”
I felt the urge to ask David, in front of everyone, whether he had put my name on the page. But the question would not authenticate the document. His answer would not establish who created it, when it was prepared, or whether anyone had acted on it.
I had spent too many years being told that confidence could substitute for proof. I wouldn’t let anger make me do the same thing.
The chair called a short recess while the secretary documented where the packet had come from and secured the copies already distributed. When the meeting resumed, the directors returned to the questions they could answer. They would wait for verified records before making a decision about access or responsibility.
No one approved the draft resolution. No one declared it genuine—or fraudulent.
As the directors filed out, David stayed behind.
“You’re turning a document issue into a spectacle,” he said.
“I didn’t put my name on that page.”
“You don’t know who did.”
“That’s why we’re checking.”
His mouth tightened, but he didn’t reply. Eleanor stepped between us—not dramatically, just enough to make the boundary clear.
“Any discussion of the loan should go through counsel,” she said.
David gave me a look that made the old version of me want to soothe him, to suggest we could sort it out privately. I let that impulse pass.
Then I gathered my notes and left the room.
In Eleanor’s office, two forensic specialists were waiting. They had been retained to examine the disputed signatures and the related records, not to announce a verdict after a glance. One of them, Ms. Chen, laid out a set of verified corporate documents beside the copies of the loan pages.
“These are comparison materials,” she said. “The point is to look for similarities and differences across multiple examples. A single signature can be misleading, especially in a scanned document.”
I studied the pages. The signature labeled with my name looked like mine at first glance. The slant, the long line through the last name—it was close enough to make my stomach tighten.
Ms. Chen pointed to a mark near the end of the signature.
“I see a feature worth examining more closely. It isn’t enough to draw a conclusion on its own.”
“So you can’t tell whether I signed it?” I asked.
“Not at this stage. We need the best available versions of the documents, more verified comparison samples, and information about how the pages were created and submitted.”
I nodded. It wasn’t the certainty I wanted. It was the answer the evidence could support.
Eleanor took out the lender’s preservation response. The bank had acknowledged the request and provided a limited set of records through its counsel. She checked the delivery information, confirmed that the files had arrived through the agreed secure channel, and recorded the date and time.
“This is what we asked them to preserve and produce,” she said. “We’re not going to treat an access log as proof of who was sitting at a computer.”
The records included submission timestamps and information about the company credentials used during the application process. They also contained data that did not belong in a broad fishing expedition—employee activity unrelated to the loan, ordinary communications, and personal information that had nothing to do with the review.
Eleanor set those materials aside.
“Those aren’t part of the inquiry,” she said. “We’ll keep the scope to the financial systems and records relevant to this application.”
That mattered to me. A company could not protect itself by treating every employee like a suspect. I wanted the trail preserved, not the entire organization turned inside out.
I called the head of IT and put the instructions in writing. Preserve the relevant system records. Restrict changes to those records while the review was underway. Do not conduct an unrestricted search of employees’ files. Any further access would need to be authorized and documented.
When I finished, I reread the message before sending it. The difference between preservation and accusation was more than a legal distinction. People who had nothing to do with this still had to come to work the next morning. They deserved care as well as clarity.
The first review of the lender’s records began late that afternoon. Eleanor sat beside the specialists while I waited at the end of the conference table, watching the timestamped entries appear on the screen.
At first, the log looked like a string of numbers and system labels. Then Ms. Chen stopped scrolling.
“Here’s the access event associated with the loan submission,” she said.
Eleanor leaned closer. “What can we establish from this entry?”
“The company credential recorded here was used to access the submission path at this time,” Ms. Chen said. “We can compare the credential with the company’s access records. But this entry alone doesn’t tell us who used it.”
“Was the application submitted from a company system?” I asked.
“The available record points to a company credential. We need the corresponding company-side records to understand where that credential was assigned and whether there were any relevant changes or exceptions.”
Eleanor wrote that down, without adding a name.
The IT director joined us by secure video. He pulled up the access assignments for the period identified in the lender’s records. He read from the relevant entries, then checked them against the company’s system inventory.
“This credential was assigned to the executive office,” he said.
“Was it assigned to one person?” Eleanor asked.
He paused. “It’s associated with that office. I can’t say from this record alone who personally entered or used the credential.”
The conference room seemed to contract around that sentence.
I looked again at the screen. A credential. A timestamp. An executive office. Each was a fact. None was a witness.
“Could someone else have used it?” I asked.
“It’s possible,” the IT director said. “We would need more information to determine whether that happened here.”
David’s office. David’s company. The same David who had transferred $680,000 into his private investment company, according to our financial review. The pieces pressed toward one another, but pressure wasn’t proof. I knew that.
Eleanor closed her notebook.
“Then that’s as far as we go tonight. We’ll ask the lender and the company specialists to continue the review within the authorized scope. No one should characterize this as identifying a user.”
Ms. Chen nodded. The IT director confirmed that the relevant records would remain preserved.
I sat back. Earlier that day, I had watched my name appear on an approval I had never given. Now a credential tied to an office I knew too well had surfaced in the submission trail. Still, there was a difference between seeing where the trail led and knowing whose hands had touched the keyboard.
My phone vibrated against the table. A message from a board member asked whether the review had identified who submitted the loan.
I typed, We’ve identified a company credential associated with an office. We have not identified the person who used it.
May you like
I read the sentence once, then sent it.
On the screen, the access entry remained highlighted. It pointed toward David’s executive office. It did not tell us who had been at the keyboard.
