Chapter 154
The Exceptions After Retirement
Franklin Lowe taught me to distrust any audit that began with a desired answer.
Paige has put his name behind Jonah's memo, and I have to decide whether I learned that rule from a hypocrite or a man whose role she has remembered wrong.
I join the protected witness call from the city evidence room. Rina sits at the opposite end of the table with an independent investigator. Malcolm has taken the chair farthest from me. Paige appears by audio only. Her counsel controls the connection, and no location data enters Wondervale's systems.
"Tell us the part you observed," the investigator says.
Paige does not begin with a theory. Four years ago, Jonah asked her to prepare director briefing packets about the proposed employee procurement committee. His final memo carried a routing code rather than a printed name. Paige says Jonah told her to place one sealed copy in Franklin Lowe's board-floor box and send another through the portal under Lowe's director profile.
"Did you see Mr. Lowe open either copy?"
"No."
"Did he answer the memo in your presence?"
"No. Jonah told me the chair agreed."
The last sentence proves what Jonah said to Paige. It does not prove Lowe agreed.
Paige adds a detail she had not understood at the time. Jonah insisted on the code because Lowe did not want his name in procurement correspondence during an audit-committee independence review. She remembers the code ending in forty-one.
The investigator has her describe the board box, the color of the seal, and where she stood. Counsel asks whether any record or recent conversation refreshed her memory. Paige says she heard the public memo but has not seen the unredacted routing log. Her memory is specific, four years old, and vulnerable to Jonah's instruction. We record all three conditions.
Rina opens the archived routing file obtained for the city hearing.
The board portal created the route entry at 6:44 on March 18 from Jonah's assistant's authenticated account. The corporate secretary's archive retained the received PDF, delivery code, and access event. The outside forensic administrator exported the file under the city order yesterday and stored its verified copy in the evidence room. Its vulnerability is identity. A profile and routing code can show which director account received a file, but delegated staff access or credential misuse could separate the account from the person.
The redacted code is AC-FL-41.
Lowe served as audit chair. The initials fit. Forty-one matches his board-box number in the facilities directory for that year. Together, those records corroborate Paige's memory about the intended recipient. They still do not prove Lowe read the memo or approved Jonah's recommendation.
Malcolm looks at the code longer than anyone else.
"He would have read it," he says.
"That is your belief," I tell him.
His gaze rises to mine. "Franklin read every paper copy delivered to that box."
"Then help us find records of the habit. Do not turn friendship into authentication."
He accepts the correction with a stiff nod.
We move to travel.
The committee calendar shows Lowe in Chicago on March 18 and at Wondervale the next morning for a vendor-control review. The corporate travel office created his itinerary when his assistant booked the trip on March 3. The airline and hotel later produced matching invoices, and the company reimbursement archive holds the approved expense report. The records place travel and expenses in sequence. They cannot show what Lowe discussed or whether he carried the memo.
The next morning's visitor log records his board badge entering Story Street at 8:11. Facilities created the access event through the building system; the security contractor retains the native log, and city investigators hold an export. A badge event shows credential use at a door. It cannot identify the person without camera or witness support.
Paige remembers seeing Lowe in the executive corridor before Jonah's control review. Malcolm remembers breakfast with him that morning. A hotel receipt supports Malcolm's presence near the board floor. None of that turns conversation content into fact.
"This gets us to recipient and opportunity," Rina says. "We need action."
The investigator asks the corporate secretary to search for audit-committee directions issued within thirty days of the memo. She finds a vendor-exception protocol signed by Lowe nine days later. It required procurement to report exceptions to the audit chair each quarter, yet allowed emergency approvals to proceed before review.
I know the document. Franklin defended the clause as necessary during peak seasons.
"The protocol is broad enough to be abused," I say. "It was also a common continuity measure."
Rina agrees. A dangerous control design is not proof of a scheme. We add it to the chronology without claiming more.
The harder complication arrives in Lowe's retirement file.
He left the board twenty-two months ago. The newest benefits hold, fourth substituted part, proxy charter, and effort to remove Elliot occurred after his formal authority ended. His retirement agreement revoked board access and ended his committee appointment. If Lowe sponsored the old structure, retirement alone cannot make him the director behind every recent act.
Malcolm presses two fingers against the table. "Then Paige has named a historical recipient, not the present sponsor."
"So far," the investigator says.
Rina asks for the consulting register.
The first search returns Lowe's personal name with a closed status. The second returns Franklin Advisory Group, a company he formed after leaving the board. Wondervale's audit committee retained it for limited transition advice on vendor-control history. The agreement barred operational approvals and access to participant or employee data.
The audit committee's governance manager created the register entry on Lowe's retirement date. The corporate secretary holds the signed engagement; procurement holds invoices, and an outside payment processor retains remittance records. The register can show the stated contract. It cannot reveal undeclared work or prove Lowe performed every billed task.
Rina follows the invoices rather than the name.
Six quarterly charges fit the contract. Three additional charges use a line called continuity exception consultation. The first appears two months after retirement. The most recent posted three weeks ago, during the thirty-day failure sequence.
"Who approved payment?" I ask.
The invoice workflow lists the current audit administrator for two and Jonah's procurement delegate for one. Approval proves the company paid Franklin Advisory. It does not show what advice Lowe gave.
Rina requests the supporting attachments. Two are missing from Wondervale's invoice repository. The third contains an exception worksheet.
The worksheet began with a procurement analyst at 2:18 on the afternoon of the fourth component shipment. The analyst's native file identifies the lab certification and a request to release the part before full cross-checking. At 3:02, the file entered Franklin Advisory's client portal. At 3:19, a returned PDF approved the exception under consultant code FAG-01. Procurement retains the returned copy; the client portal provider confirms the transfer times under the preservation request. Its vulnerability is attribution. The code and portal support use of Franklin Advisory's account, but they do not identify who sat at the keyboard or whether the approval reflected Lowe's personal judgment.
The signature block is worse.
It says F. Lowe, transition consultant.
"He was approving exceptions," Malcolm says.
"His company account approved this one," Rina corrects. "The signature names him. We still authenticate the signer."
The investigator calls Franklin Advisory's registered counsel and requests voluntary preservation of client devices, portal credentials, paper files, calendars, billing support, and communications tied to Wondervale. Counsel says the firm will respond through formal process and asks whether Lowe is a target.
The investigator gives no answer beyond the supported scope.
We find two more exception approvals in city-held certification packets. Both carry the same consultant code. One predates the newest substitution. One falls inside Paige's thirty-day map. The timestamps align with portal access from an address assigned to Franklin Advisory's office, though remote access could originate elsewhere.
The evidence changes Voss and Lowe from mentor and retired official into witness and possible participant. It does not finish the distance between those roles.
I think of the first audit he let me present. I had found a vendor overcharge and wanted to accuse the manager who signed it. Franklin made me trace the creator, time, custodian, and defect in every source before he allowed my conclusion into the minutes.
Either he kept teaching that discipline while violating it, or someone built this route through habits he left behind.
Both possibilities require preservation before accusation.
At 4:27, the investigator submits a supported application for an immediate preservation order. It includes Paige's bounded statement, the memo route, travel and billing sequence, consulting agreement, exception worksheets, portal confirmations, and the missing invoice attachments. It asks that Franklin Lowe and Franklin Advisory preserve devices, paper records, storage media, portal logs, calendars, and communications. It does not seek arrest, public guilt findings, or authority to search beyond the order.
The court clerk accepts the application at 4:34. A judge signs the preservation order at 5:06 after narrowing one request for unrelated client records. The clerk's docket holds the signed original, and a process server delivers a certified copy to Franklin Advisory's registered office at 5:31. The order can require retention and bar destruction. It cannot recover material already missing or establish that any preserved record is authentic.
I receive service confirmation in the city evidence room.
For six minutes, nobody speaks.
Then Franklin Advisory's office manager calls the investigator. Her lawyer is on the line. She says staff arrived after lunch and found Lowe's private office open. The paper cabinets remain locked. The small server is in place.
Every external drive listed on the firm's equipment register is gone.