John Reardon fraud investigation

The John Reardon fraud investigation is the financial-detective spine of the novel’s larger conspiracy. What first appears to be a contained accounting irregularity becomes evidence of layered misconduct: John Reardon manipulates depreciation records for personal gain, while Milo later uses that vulnerability to move encrypted wire transfers through Scanguards. Delilah Sheridan’s audit transforms numbers, source documents, and login histories into a chain of responsibility, ultimately connecting an apparently modest embezzlement scheme to a much larger attack on the company.

Causes and Background

The investigation begins when routine statistical reviews at Scanguards headquarters identify abnormal accounting ratios in the San Francisco branch. Because an auditor with prior ties to local staff might become too familiar with the people being examined, headquarters deliberately sends an external freelancer with no previous contact with the West Coast personnel. Delilah Sheridan is particularly suited to the assignment: forensic accounting is her specialty, and she normally conducts specialized audits along the East Coast. This is her first business trip to San Francisco, which gives the investigation both professional distance and an outsider’s perspective.

The initial anomalies concern the relationship between fixed assets and depreciation. The figures could indicate incompetence, but they could also indicate an attempt to defraud the company. Delilah discovers that the manipulation has been carried out methodically for almost a year. The timing itself becomes suspicious: records from the current and immediately preceding year have already been placed in storage, even though most companies archive documents only when they are more than three years old. That unusual removal of records suggests that the paper trail may have been deliberately made harder to inspect.

Delilah therefore insists on seeing the original documents rather than relying solely on computer entries. Electronic records show which employee entered a transaction and which lower- or middle-management account approved it, but they do not necessarily establish who actually initiated or authorized the act. She also knows that employees sometimes share passwords despite company rules forbidding the practice. The original paperwork is consequently essential to reconstructing the true authorization chain and identifying the person behind the entries.

Discovery of the Depreciation Scheme

John Reardon becomes visibly anxious when Delilah asks whether the archived files have arrived. He confirms that the files are at the loading dock and says he will have them brought upstairs, while privately recognizing that examination of the booking documents will reveal his role in defrauding the company. Delilah, unaware of the full reason for his hostility, continues the audit and remains confident that the records will disclose the hidden mechanism.

The mechanism is later explained in concrete terms. John is authorized to write off old assets valued below $2,500 without obtaining an additional signature from headquarters. He accelerates depreciation so that assets whose real value is higher fall beneath the threshold he is permitted to approve, thereby bypassing Scanguards’ internal controls. He then transfers the assets to someone outside the company, who sells them at their actual value. John returns the written-off amount to the company and keeps the difference. His fraud is therefore not a simple false entry but a process that converts an approval threshold into an opportunity for private profit.

The investigation also clarifies why John targets depreciable assets instead of the company’s liquid cash. Scanguards has relatively little fixed property because many buildings are rented and vehicles are leased, but it holds substantial liquidity. Cash transfers, however, require dual approval, so John could not move money alone without defeating another control. The contrast between the vulnerable low-value-asset procedure and the stronger cash-transfer procedure explains the shape of his crime: he chooses the administrative channel in which one authorized employee can manipulate value without a second headquarters signature.

From Audit to Digital Forensics

The audit does not end with the depreciation entries. Delilah and Amaury recognize that John’s conduct may extend beyond the assets already identified and decide to examine every transaction he authorized and every file he accessed. Delilah asks whether the Scanguards computer system records which login has opened particular files. Amaury confirms that it does, allowing the inquiry to move from suspicious accounting ratios to an auditable history of digital behavior.

The access history proves decisive. A review of John’s activity during the previous month shows that he has entered files far outside the responsibilities of his position. He has moved through records that should have been handled by other staff, effectively mapping parts of the company’s internal structure that he had no legitimate reason to inspect. Delilah’s suggestion to examine all activity under his login therefore succeeds where a narrow review of depreciation entries might have stopped: it exposes a broader pattern of unauthorized access.

Amaury then asks Thomas, Scanguards’ resident IT expert, to examine the files. Amaury has discovered evidence that John Reardon was involved in something larger than siphoning off a few thousand dollars: John uploaded encrypted files to headquarters, and the contents must be determined. Amaury could eventually break the encryption himself, but Thomas can do it more quickly, so the work is divided between them. Their investigation treats the computer system not merely as a repository of transactions but as a record of movement, access, and concealed intent.

The Larger Conspiracy

The encrypted material reveals that John’s depreciation fraud has been exploited by Milo. Milo infiltrated Scanguards and learned enough about its internal workings to understand that stealing Thomas’s password alone would not be sufficient. He searched the records, found John’s depreciation fraud, and used it to blackmail him. The original audit thus becomes the pressure point in a larger criminal design: Delilah was right that the accounting irregularities would eventually lead to John, but the discovery also gives Milo leverage over the compromised employee.

Once Milo obtains John’s password, he can upload encrypted wire transfers. He then returns to the system using Thomas’s password to authorize them, creating the appearance of legitimate approval. The scheme exploits the distinction between initiating and approving a transaction while also abusing the trust and access associated with separate employees. It is a more ambitious operation than John’s asset write-offs, shifting from quietly extracting the value difference on depreciated property to moving substantial funds through concealed electronic instructions.

The crisis becomes visible when Samson Woodford is shown transaction screens filled with approval notices. Amaury explains that Thomas is logged in at that moment and is authorizing John Reardon’s encrypted transactions. The display makes the fraud immediate: the computer system is recording an active authorization process, but the person behind the keyboard is not necessarily the person whose credentials are being used for an honest business purpose. Digital evidence, once treated as a means of tracing the scheme, now shows that the theft is still unfolding.

Consequences and Significance

The investigation changes the meaning of Delilah’s assignment. She arrives to identify whether abnormal depreciation reflects incompetence or fraud, but the inquiry ultimately uncovers a chain linking premature write-offs, stolen passwords, blackmail, unauthorized file access, and encrypted transfers. Its method advances in stages: statistical anomaly leads to original documents; original documents lead to the question of who initiated and approved the entries; access logs reveal unauthorized exploration; and encrypted transaction records expose the wider conspiracy.

The fraud investigation also places professional verification against systems built on assumed identity. John’s accounting entries initially conceal responsibility behind employee logins and approval thresholds. Delilah’s insistence on originals challenges the false certainty of the electronic record, while her later use of access histories shows how the same system can preserve evidence of wrongdoing. The investigation’s central insight is that controls are only as reliable as the relationships and credentials through which people operate them.

Its final revelation is that John’s relatively small embezzlement is not the endpoint but the opening through which Milo enters Scanguards’ finances. Thomas is eventually overpowered and chained with silver, demonstrating that the digital scheme has consequences beyond accounting and reaches directly into the physical danger surrounding the company. The audit therefore functions simultaneously as financial inquiry, investigative structure, and warning: the smallest abnormality in a ledger can be the visible edge of a conspiracy whose real target is the organization’s entire store of assets, information, and trust.