Page 43 of Emil

The forensic team from the accounting firm I’d hired for the merger looked around the table, their expressions uniformly attentive. Maybe it was because they were accountants, but not a single one of them smiled. They were dressed like they were headed to testify in court. The overall vibe was not great.

“It’s not a problem under the circumstances,” the woman who appeared to be the spokesperson said. “It’s best we do this when the offices are closed.” She paused, then added, “Mr. Nicholy and I are with the forensic accounting team. Mr. Freeman is from legal.”

“Then let’s get to it. What did you find?”

She opened a folder and slid it across the table. It was thick with paper, but the name on the first page jumped out immediately.

“Are you familiar with an employee named Anders at the firm?” she asked.

“Yes. I’ve heard of him.” They didn’t need to know how familiar I was with that particular employee.

“He’s the dedicated access point for the firm’s charity projects. In fact, he’s the only person who ever accesses those files. That account is being used as a pass-through to remove money.”

“Interesting.”

“What’s interesting is that he logged into particular files at very specific times from a specific computer. When we traced the logins, they occurred at times when it would be unusual for him to be in the office. More importantly, when we cross-referenced those times with the electronic key system, his badge was never used.”

The group remained grim-faced, which made it hard to tell where this was going.

“Is he involved in this?”

“On paper, yes,” the spokeswoman said. The phrasing was deliberate. “When we cross-referenced his logins with documents related to the merger, there was overlap. Again, all at unusual times. All from the same workstation. And never when his key card had been used.”

“Wait. You said the same workstation?”

One of the men passed me another folder. I opened it and exhaled slowly.

“Translate this into something that doesn’t sound like a tech lecture.”

“Unlike television, we can’t just isolate an IP address and call it a day,” he said. “What we do instead is triangulate behavior across multiple data points. Login timing, device signatures, access patterns. Taken together, we can say with confidence it’s the same person using the same device.”

He flipped a page.

“Have you ever heard of Occam’s razor?”

“The simplest answer is usually the right one.”

“Yes. And when every data point points to the same employee every single time, it starts to look very clean. Too clean. That’s why we cross-checked the keycard logs.”

The spokeswoman picked up again. “Anders’s badge was never used during any of the access windows, but his boyfriend’s badge was.”

The room went quiet.

“That leaves two possibilities,” she continued. “Either Anders took his boyfriend’s badge and used his own credentials to steal from the company, or someone else used Anders’s credentials to hide their own activity and didn’t account for the badge system.”

“The simplest answer is usually the truth,” I said again. “What about the merger documents?”

“They’re largely false,” she said after taking a deep breath. “They were structured to conceal the company’s actual debt. Cash flow was being siphoned off while liabilities were shuffled to mask it. There’s clear evidence the documents were materially untruthful.”

“How was this missed?” I asked.

The two accountants exchanged glances. Mr. Freeman sat stone-faced. No one spoke.

“I asked a question.”

“It should have been caught,” the spokeswoman said carefully. “The documents were signed off by an associate at our firm. That associate is no longer with us.”

“Were they fired over this?”