Ellis asked him to wait while the team verified the source files. Nolan went to a small conference room and began outlining the additional tests that would produce a more reliable answer for the consortium. His notes were simple and practical: identify the conditions that triggered the lag, repeat them under controlled circumstances, compare the results with the acceptance requirements, and document what changed if the engineering team introduced a correction. He did not believe the problem would fix itself merely because an audit had begun.
Meanwhile Ellis traced the report through the document system. He found the original pending status, Nolan's retest request, and the final acceptance file. For most of the morning, the history seemed consistent with Nolan's explanation. Then a junior auditor named Priya Shah opened the electronic approval record and asked Ellis to look at the signature field.
Nolan Mercer was listed as the approver. The system showed the approval as completed late on December 22, after the final summary had been circulated. Priya checked the electronic certificate, then checked the timestamp again because something about the record felt out of place. The approval had been entered at 11:52 p.m., more than two hours after the usual shift ended.
Ellis brought the screen into Audrey's office. "We have a complication," he said. "The report carries Mercer's electronic signature."
"Is it authentic?" Audrey asked.
"The system accepted it. That's not the same question."
They called Nolan back and showed him the record. He leaned closer, read the approval line, and sat down slowly. The date was familiar; he had spoken with Claire that evening from his car. He remembered the time because she had sent him a photograph of her crooked tree just after they hung up. "I never signed that," he said.
Ellis asked him to repeat the statement for the recorded interview, then requested verification from the access-control team. The company's logs showed that Nolan had ended his session at 9:14 p.m. and used his badge to leave the garage. At 11:52, an administrative session with elevated privileges had changed the report status and associated Nolan's credentials with an approval event. The access trail established that the recorded action was not part of his ordinary user session, though it did not immediately identify the individual at the terminal.
The auditors worked carefully. They secured read-only forensic copies of the logs, documented who had access to the evidence, and compared the primary system history with backups created under routine retention procedures. A separate information-security team checked whether a clock synchronization error or software malfunction might explain the discrepancy. Ellis refused to announce a finding until those alternatives had been considered, even though the timing looked troubling.
When Nolan heard about the administrative session, he felt a sensation colder than fear. Someone had placed his name on a statement he had refused to make, then tried to remove him from the company for objecting to the same result. The sequence seemed absurd in its cruelty. For a moment he imagined the consortium receiving the report, later discovering the discrepancy, and finding his electronic signature at the bottom. His reputation might have been destroyed by a file he never approved.
"Can they tell who did it?" he asked.
"Not yet," Ellis replied. "But we can tell where to look."
Audrey ordered the investigation expanded and arranged for outside technical advisers to review the evidence independently. She also directed General Counsel to place a preservation hold on communications related to the project and the personnel action. That included email, relevant messages, document revisions, and authorization histories. The goal was to prevent anyone—on either side of the dispute—from claiming that a key record had been quietly changed after the inquiry began.