Company policy against shared logins

Company policy against shared logins is an internal control at Scanguards intended to preserve accountability for electronic transactions. Its importance becomes clear through Delilah’s audit: when employees share passwords despite the prohibition, a computer record can name an account without proving who was behind the activity.

Rule and Purpose

The policy strictly forbids employees from sharing logins, even though Delilah knows that staff sometimes do so when work is urgent and they are under pressure to get things done. That gap between the rule and workplace practice weakens the evidentiary value of a system record. An approval attached to a particular password may identify the credential used, but it cannot, by itself, establish who used it.

The distinction matters because Scanguards’ accounting system separates data entry from approval. Lower-level employees enter transactions, while approval is generally given by staff one or two levels higher. If credentials are shared, the electronic trail can appear to identify an approver while leaving the person who actually acted uncertain.

Delilah’s Audit Method

While investigating manipulated depreciation entries, Delilah finds that the suspicious transactions have been carried out methodically for close to a year. The records for the current and previous years are already in storage, an unusual circumstance that prompts her to examine the documentation more closely. She knows whose login appears to have approved the transactions, but does not treat that attribution as conclusive.

Instead, she asks John for the original paperwork. The computer entries do not show who first initiated a transaction and who authorized it; the original documents may establish those steps more reliably. Her approach makes the policy’s purpose concrete: auditability depends not merely on a password appearing in a system, but on evidence that can connect the recorded approval to the person responsible.

Connection to the Financial Scheme

The audit also uncovers a method for exploiting a separate control threshold. John was authorized to write off old assets worth less than $2,500 without an additional signature from headquarters. By accelerating depreciation until an asset’s book value fell below that limit, he could approve the write-off himself, bypassing the ordinary internal control. The assets could then be passed to someone outside the company and sold at their real value; the company received the written-off amount, while the difference was retained.

This scheme shows how transaction permissions and reliable attribution matter together. A threshold can be manipulated, and an electronic approval can be ambiguous if credentials are shared. Delilah’s insistence on tracing the initiating and approving steps, rather than relying on the displayed login alone, is central to determining who was responsible.

Digital Records and Their Limits

Later, a transaction screen displays Thomas logged in and authorizing John Reardon’s encrypted transactions, with approval notices filling the screen. The image presents a clear system record, but the wider problem identified by the policy remains: a login records the credential associated with an action, not necessarily the person operating it. The scene therefore sharpens the difference between what a system reports and what an investigation must establish.

The rule is more than a technical precaution in the novel. It is a condition for trustworthy financial oversight: without individual control of credentials and corroborating documentation, the audit trail can conceal the responsible actor as readily as it records a transaction.