“Good. Make sure nobody treats proximity as proof.”
Andrew nodded.
“I've been thinking about something else. The service account appears to have been used to change several records that should have required separate approval.”
“Then we need to know whether the permissions were configured incorrectly or whether someone deliberately used them that way.”
“Can you bring in the external forensic team?”
“I've already contacted them. They can begin tomorrow morning.”
Andrew leaned back.
“Do you think this goes beyond travel?”
Evelyn closed the report.
“I think the evidence gives us reason to investigate other systems. It does not yet tell us what we will find.”
She paused.
“Andrew, we should also consider whether the people who submitted complaints were exposed because of these access permissions.”
“You mean their identities?”
“Yes. If someone could access confidential case summaries without being assigned to the investigation, we need to establish whether that access was accidental, authorized, or improper.”
Andrew looked at the report again.
“We may have a much larger problem than we thought.”
“Possibly.”
Evelyn gathered her folder.
“But we must not let the size of the possible problem persuade us that every allegation is true. We have to be as careful with the evidence as we expect the people under investigation to be.”
After she left, Andrew sent Monica a message requesting an urgent meeting.
Monica was in her temporary office reviewing the acquisition documents when the message arrived.
She called him immediately.
“What have you found?”
“The first system comparison shows that your name was removed from the crew-facing manifest four minutes after the revised copy was generated. Your executive access profile was modified two minutes later.”
“Can we identify who did it?”
“Not yet. The account was accessed from a workstation in corporate operations.”
“Who had access to the room?”
“Several people. We're obtaining the physical access records.”
“Have you confirmed that the manifest and the access change were linked?”
“No.”
“Then don't describe them as a single action.”
“I won't.”
Monica stood and walked toward the window.
“Anything else?”
“The same service account was used in several employee access changes. Some occurred near the dates of the complaints Evelyn is reviewing.”
“Do we know whether those changes were authorized?”
“Not yet.”
“Then that's the next priority.”
Andrew hesitated.
“There is a complication.”
“Tell me.”
“Richard has asked the systems team for a copy of the preliminary audit. He says he needs it to prepare the department's response.”
Monica was silent for a moment.
“Did he receive it?”
“No. The team referred him to Evelyn.”
“Good.”
“He was unhappy.”
“I imagine he was.”
Andrew lowered his voice.
“He told the systems manager that the investigation was creating unnecessary disruption and that he expected corporate operations to remain in control of its own records.”
Monica looked toward the desk.
“That is not an unreasonable concern in every context. Departments do need access to their records. But an independent investigation cannot be controlled by the department whose actions are being examined.”
“That's what Evelyn told him.”
“Then we have nothing further to discuss on that point.”
Andrew paused.
“Monica, do you think Richard knows who used the account?”
“I don't know.”
“Martin sent the revised manifest to Rebecca. That has now been confirmed.”
“Did Martin explain why?”
“Not yet.”
“Then we ask him. We don't decide the answer in advance.”
She ended the call and returned to her desk.
For several minutes, she reviewed the acquisition's financial model. The numbers were complicated but not alarming on their own. Meridian Air Services operated a fleet of charter aircraft and provided maintenance support to several corporate clients. Its reported revenue had grown steadily, and the proposed acquisition would give Hayes Meridian greater control over executive transport and regional logistics.
But the supporting schedules contained several inconsistencies.
A maintenance reserve had been calculated using one set of aircraft utilization figures, while the operational report used another.
Two subcontractor expenses appeared in the acquisition model without corresponding invoices.
A liability related to an older aircraft lease had been classified as a contingent expense rather than a current obligation.
None of these issues proved misconduct.
Each required clarification.
Monica opened a new document and began listing the outstanding questions.
At the top, she wrote:
No final decision until the independent review is complete.
A message appeared on her phone.
It was from Thomas.
Richard says the acquisition is being delayed because of an administrative misunderstanding. I want to hear your assessment before tomorrow's board session.
Monica replied:
The acquisition is delayed because due diligence remains incomplete. The manifest is one issue under investigation, not the basis for the entire decision. I will brief you tonight.
Thomas responded:
Good. Bring the evidence, not the rumors.
She smiled faintly.
That was exactly what she intended to do.
At 6:03 p.m., Evelyn called.
“Monica, I have an update on the employee complaints.”
“Go ahead.”
“Olivia Bennett's access restriction was initiated through the same administrative service account. We have also found two other employees whose access privileges were reduced within forty-eight hours of submitting complaints.”
“Can we establish who requested the changes?”
“Not yet. But the official management records show that one change was approved by a department head who says he never submitted the request.”
Monica sat down.
“Has he provided a written statement?”
“Yes. He says the approval attached to the access request does not match his signature or his usual authorization method.”
“Could it have been generated automatically?”
“We're checking.”
“Good.”
Evelyn continued.
“There is another detail. One of the employees whose access was reduced is named Samuel Price. He works in aviation operations.”
“Is he related to you?”
“No. Same surname, no relation.”
“What was his complaint about?”
“He reported that a passenger manifest had been changed after approval and that the crew had received a version that did not match the central record.”
Monica felt the room become very still.
“When did he submit it?”
“Three weeks ago.”
“What happened afterward?”
“His access to the operations archive was removed. His manager said it was part of a routine permissions review.”
“Has he been interviewed?”
“Not yet. He initially agreed, then withdrew.”
“Why?”
“He said he was concerned that his identity had already been disclosed.”
Monica looked at the wall clock.
Three weeks ago.
A manifest had been changed after approval.
An employee had reported the discrepancy.
His access had been removed.