HR rep Priya set my box down on the nearest desk without taking her eyes off the screen.
“What is that,” she said. It wasn’t really a question.
“It’s the access log for the server-room door,” I said. “Filtered to the night the reconciliation database was wiped. The night I supposedly destroyed it.” I pointed. “Every badge that opened that door between six in the evening and six in the morning. There are exactly two entries. Mine, at 5:52 — and the very next line is my badge leaving through the front door, because I went home. And this one.”
I tapped the highlighted row.
“Eleven forty-three at night. Badge ID ending four-four-one. Mine ends one-nine-zero.” I let her read it herself, because a thing you read with your own eyes is heavier than a thing you’re told. “Four-four-one is Grant Sefton’s.”
Behind the glass partition, Grant had stopped pretending to be on a call.
Here is what I could not prove on Friday, when they walked me out with a box and a story.
For about a month, I’d been quietly raising a flag about our reconciliation numbers. Money was sliding between two vendor accounts in a pattern that didn’t make sense — unless someone needed it not to make sense. I’d taken it to Grant, my own VP, twice. Both times he told me he’d “handle it,” and that I should keep my focus on the migration.
Then the acquisition put outside auditors three weeks away from our books. And the night before those auditors were due to get database access, somebody deleted the exact records that would have shown where the money had gone.
By Friday morning, the story was clean and simple and it had my name on it. Disgruntled director. Sabotage on the way out. It was a good story. It had only one flaw.
I was home, asleep, at 11:43.
Grant was not.
Priya called in our director of security, who pulled the full unedited logs — the ones that never make it onto a summary slide. Grant’s badge at the server room at 11:43. His laptop on the network at 11:47. A bulk deletion job started at 11:51 under credentials he’d “borrowed” from a junior admin who didn’t know any better.
It took the forensics team about a day to recover most of what he’d erased, because here is the thing panicking people always forget: in a real company, the file you delete is almost never the only copy. The reconciliation data came back. And it showed exactly what I’d been flagging for a month — the two vendor accounts, the missing money, and Grant’s fingerprints all over the routing.
The junior admin remembered it too, once security thought to ask. Grant had come to her desk that Friday afternoon, all easy charm, and asked to borrow her login to “test a migration script,” because his own access was “acting up.” She’d thought nothing of it. People rarely suspect the man whose whole job is telling them not to worry.
He hadn’t wiped the database to hurt the company. He’d wiped it to bury himself, and he’d reached for me as the shovel.
They walked Grant out on a Wednesday. No cardboard box this time. Security stood a little closer. The deal that had “collapsed” over “data-integrity concerns” came back to life the moment the buyer understood the integrity concern had a name, a termination date, and a referral to the regulators.
The company offered me my job back. The CEO did it himself, which I respected, with an apology, which I noted and filed away.
I thought about it over a weekend.
Then I told them I’d come back — as a VP, with the mandate to rebuild the controls that should have caught Grant a month sooner, and with my own badge access set by me and nobody else.
A few of the people who’d watched me carry a box out on Friday made a point of finding me that first week. Some apologized. Most just said they were glad. I learned which was which, and I filed that away too — the same way I’d learned, the hard way, that the loudest accusation in a building is almost never the truest one.
On my first morning back, I walked to the glass server room out of pure habit and tapped my badge on the reader.
The light went green.
This time, I had earned the door.