She wrote that she had approved the revised schedule after Adrian told her that finance had cleared the costs, while also noting that she had previously requested a breakdown and had not received one she could reconcile. She did not claim that this proved misconduct by anyone. She did not pretend the approval was meaningless. It was a decision she had made, and she would have to live with its consequences.
A week later, Margaret Ellis from the audit committee requested a second meeting. This time, she arrived without the other directors. She placed a notebook on the table and said that she wanted to understand how the board had received the original allegations.
“The presentation we saw before your removal described the payments as approved under your authority,” Margaret said. “It did not explain the limitations of the available records.”
“Did anyone ask whether I had reviewed the invoices?”
“Not that I recall.”
“Did anyone ask me?”
Margaret looked down at her notebook. “No.”
Evelyn felt anger rise, but she kept her voice level. “Then the board made a decision about my responsibility without asking me to explain my own actions.”
“Yes,” Margaret said. “That is one of the issues we are examining.”
Margaret explained that the board had received a summary from senior management. The summary emphasized the transaction codes and the amounts, but it did not clearly distinguish between a user account associated with an approval and proof that the named person had personally reviewed the underlying payment. The board had understood the distinction only after Bellamy’s team began asking for the original audit logs.
“Who prepared the summary?” Evelyn asked.
“I’m not able to answer that yet. We are checking the document history.”
“Was Adrian present when it was discussed?”
“Yes.”
“Did he say he had spoken to me?”
Margaret hesitated. “He said the matter had been handled internally.”
Evelyn looked at her. “That isn’t the same thing.”
“No,” Margaret said. “It isn’t.”
The meeting lasted forty minutes. Margaret did not promise that the board would reverse its decision or publicly apologize. She said only that the committee would examine both the financial controls and the decision-making process that had led to Evelyn’s removal.
Afterward, Rachel asked whether Evelyn felt the meeting had helped.
“It gave me one fact,” Evelyn said. “They didn’t ask me before they decided.”
“That fact matters.”
“It matters, but it doesn’t tell me why they didn’t ask.”
Rachel closed her notebook. “We may never know every motive. We can establish what they did, what information they had, and whether their actions were reasonable.”
The first significant finding came from a document that appeared almost meaningless.
Bellamy Forensic Partners had requested a transaction schedule from Hartwell's finance department. The schedule listed consulting payments, approval dates, project codes, and the individuals recorded as authorizing each transaction.
Most entries appeared ordinary.
One did not.
A payment of $184,600 to Alder Bridge Consulting had been recorded as approved by Evelyn Hartwell on a Thursday evening at 8:42 p.m.
Evelyn was certain she had not personally reviewed the payment.
Certainty, however, was not evidence.
Rachel arranged a meeting with Bellamy to discuss the discrepancy.
"Do you have a complete audit log?" Rachel asked.
"We have an initial export," Bellamy replied. "It is not yet sufficient to establish who performed the action."
"Was the approval recorded under Evelyn's account?"
"Yes."
"Was her account active at the time?"
"Yes."
Evelyn leaned forward.
"What does the system show about the device or session?"
"That information is being requested from the company's IT department. We have not completed the technical review."
"Can you tell whether the transaction was entered by someone else using delegated permissions?"
"Not from the export we have."
Bellamy turned the document toward them.
"The record contains an approval identifier, but the identifier is not necessarily the same as a verified human identity. We need to establish how the system generated it and whether the workflow allowed another user to act on your behalf."
Evelyn stared at the date.
Thursday, 8:42 p.m.
She remembered that evening.
She had been at home, sitting at the kitchen table with a laptop open while Adrian took a phone call upstairs. She had been working on a residential development proposal and answering messages from the finance team.
Had she clicked an approval request?
Perhaps.
Had she seen the supporting documents?
She could not remember.
"Is there a way to recover the original request?" she asked.
"We've asked for the workflow history," Bellamy said. "It may contain the document attachments, routing information, and any comments entered before approval."