Chapter 6 - The audit trail
By noon, Rachel’s team had more.
The questionable consent had been uploaded to First Western Bank nine months earlier.
Not newly created for the audit.
Good.
That eliminated one theory:
Someone fabricated it recently to frame Arturo.
The bank’s document portal recorded:
Uploader account: Arturo Vega.
Upload time: 6:43 p.m., February 12.
That did not prove he created the signature.
It proved he submitted the document.
Rachel found an earlier version in a corporate shared drive.
Unsigned.
Created by Arturo’s executive assistant, Denise Hall.
Denise had retired seven months earlier.
Company counsel interviewed her.
She remembered preparing the draft.
“I sent it to Arturo and Elena for review.”
Did I receive it?
My email archive showed:
Draft sent to Arturo.
CC allegedly Elena?
No.
The address in the archived sent message was:
elena.vega.vgd@...
Looked correct.
Except the real internal address was:
The longer address did not exist internally.
It was an outside mailbox.
Registered privately?
Corporate IT traced domain? Better not overreach. It was a Gmail account made to look like mine? Let's make simpler: Denise had typed an external address Arturo gave her: [email protected]. It was not mine. She assumed it was my private work address because Arturo supplied it. Later records showed recovery phone ended in digits matching Arturo's second business phone? This could be strong but maybe too operational. Better bank's e-sign vendor had audit logs. The signature consent was not handwritten; it was a pasted image in PDF. Harder to attribute.
We needed grounded authentication.
Arturo had emailed the executed PDF to Denise:
“Signed. Please upload.”
Denise then? But portal shows Arturo uploaded. Email body doesn't say who signed. Still.
The PDF metadata showed it had been saved from a laptop assigned to Arturo? Metadata can be manipulated, but supporting.
Rebecca cautioned:
“Useful. Not dispositive.”
Good.
Then auditors traced the $187,500.
VGD to AV Strategic.
AV Strategic paid:
$82,000 toward Arturo’s line of credit.
$31,400 for expenses related to his Arizona condominium.
$18,000 to Lucía’s graduate-school account.
$12,600 toward the family vacation club.
Remainder:
Business and legal expenses with unclear classification.
My jaw tightened at Lucía’s tuition.
I had also been paying tuition personally.
I called the university bursar.
Not to accuse.
To verify account history after proper identity permissions from Lucía? I couldn't get without authorization. But I already know audit found payment to "university account" maybe from bank records.
Possible double funding.
If Arturo paid $18k from the company and I paid $12k personally, Lucía’s tuition for that year was around $26k.
Did she know?
Maybe she believed Arturo’s portion came from his money.
We needed not assume.
May you like
Again.
Verbs later.
