The next records concerned the financial investigation that had brought Malcolm to the station. Investigators had been examining inconsistencies in confidential informant payment entries, including reimbursements recorded on dates when the corresponding activity reports did not match. Some discrepancies could arise from ordinary clerical error. Others involved approvals, corrections, and transfers that required a more serious explanation. The federal team had not assumed that every inconsistency represented theft or misconduct; it had sought the original records to find out.
Bradley Knox's account appeared repeatedly in the routing history for those files. He had supervisory authority over the unit coordinating certain payment records and evidence movements. In the hours before Malcolm's arrival, his command credentials sent a message asking an evidence-room employee to delay a scheduled transfer. Another communication referred to records involving confidential informant payments. Neither message by itself proved that Knox had stolen money or destroyed evidence, but both showed that the categories of records mentioned in the delay instruction were already under active federal review.
Renee opened a summary of the first document comparisons. The accounting totals in one department report differed from the amounts reflected in the underlying approval history. A second report had been altered after a supervisor initially signed it, leaving a discrepancy between the archived version and the working copy. The investigators still needed to determine who authorized those changes and why. They did know that a direction to delay access had been sent shortly before a federal visitor arrived with process meant to secure the same records.
Malcolm listened without interrupting. He had seen investigators become so pleased with a strong sequence of facts that they rushed to complete the final sentence. He wanted no part of that habit. An accurate chronology could establish opportunity, conduct, and connection, but motive and criminal responsibility still required evidence specific to the person under review.
When Renee paused for questions, Malcolm asked only whether the investigators had preserved the original audit versions rather than relying exclusively on exported summaries. The analyst explained that authenticated copies had been collected through the authorized channels and that the versions would be compared independently. Malcolm nodded and wrote one short line in his notebook. It was the kind of procedural detail he had spent his career learning to appreciate, because the most compelling accusation in the world was useless if the underlying record could not be trusted.
The team broke for lunch shortly after noon. Hannah remained on the video connection while the others left the room, her face framed by the pale wall behind her. Malcolm approached the screen and asked whether she had any questions about the process. She hesitated, then asked what would happen to her if the department decided she had embarrassed it.