Chapter 9: The Executive Who Needed a Scapegoat
The name was Richard Lawson.
Sterling Financial's chief transformation officer.
He was the executive responsible for the accelerated migration project, the one who had promised the board that the new platform would be fully operational before the end of the quarter.
He had appeared at the quarterly meeting in an immaculate navy suit, speaking confidently about efficiency, modernization, and the company's ability to outperform its competitors.
When Marcus had raised concerns about the testing schedule, Richard had smiled.
“Every major project carries risk,” he had said.
“Our job is to manage it, not allow it to paralyze us.””
Marcus had explained that the risk was not simply a delayed launch. The configuration could allow a corrupted process to affect the transaction environment.
Richard had thanked him for his diligence and moved to the next agenda item.
Now his name was connected to a privileged account that had modified a risk-acceptance document.
Daniel looked at Raymond.
“Are you certain the account was Richard's?””
“The account identifier matches his assigned credentials,” Raymond replied.
“We still need to establish who operated the account at the time and whether the activity was authorized.””
Evelyn stood very still.
“I approved the original schedule-risk acknowledgment,” she said.
“I did not approve the altered document.””
Raymond nodded.
“That's consistent with the original version.””
Daniel turned toward Marcus.
“Let's give the review team room to work.””
Marcus nodded and stepped away from the conference-room door.
He could feel the tension in the hallway. Two employees passed them carrying folders, then slowed when they recognized the senior executives. One looked at Evelyn's face and quickly continued toward the elevators.
The company was beginning to understand that the incident might reach far beyond a manager's treatment of an exhausted employee.
Marcus had expected an investigation into his performance.
Instead, he was watching executives examine a document that might have been altered to make an unapproved security decision appear legitimate.
Daniel escorted him to a quieter area beside the windows.
“Marcus, I need you to stay out of the investigation unless the review team asks for something specific,” he said.
“Don't discuss the details with coworkers. Don't try to access records on your own.””
“I won't.””
“I know you're curious about what happened.””
“Curious isn't the word I'd use.””
Daniel gave a brief, sympathetic smile.
“Fair enough.””
Marcus looked across the office.
“Did Richard have a reason to blame me?””
Daniel considered his answer.
“He was under pressure to deliver the migration on schedule. Your security report delayed the demonstration. That gives us a possible motive for wanting the risk to appear accepted, but it does not prove he altered anything or directed anyone to do so.””
Marcus nodded.
He had spent too long watching people turn assumptions into facts. He didn't want to do the same thing just because the evidence was beginning to point toward someone powerful.
Daniel continued.
“Let the investigators establish what happened.””
Marcus left the office shortly afterward.
He spent the afternoon at home, resisting the urge to check his work email every few minutes. Andre came by with groceries and made him promise to eat before opening his laptop.
“You look less dead today,” Andre said, setting a bag on the kitchen counter.
“That's encouraging.””
“I'm serious. You were shaking yesterday.””
“I was tired.””
“You were beyond tired.””
Marcus helped unpack the groceries, grateful for the ordinary rhythm of the task. Milk in the refrigerator. Bread in the cupboard. A pan heating on the stove.
For once, he wasn't responsible for keeping a financial system alive.
He was simply a person making dinner.
His phone rang just as Andre placed two plates on the table.
It was Patricia Cole, the independent investigator.
“Marcus, I have a brief update. The review team has identified the account used to modify the risk-acceptance form. We are examining the access records and related communications.””
“Does that mean Richard altered it?””
“I can't confirm that. The account is assigned to him, but account attribution is not the same as proving who performed an action. We are checking whether the account was accessed remotely, whether any delegation was recorded, and whether the changes were authorized.””
Marcus sat down.
“Understood.””
“There's another matter. The original form included a project-level risk acknowledgment signed by Evelyn Price. The modified version added language that could be read as accepting the specific vulnerability you reported. The revision history shows that the additional language was entered after your security report was submitted.””
“Was my name added at the same time?””
“Yes. Your name appears in the later version, but the audit record does not show that you signed it.””
Marcus closed his eyes briefly.
That was the confirmation he had needed.
Not a complete explanation, but proof that the document presented as his approval was not the original record.
“Thank you for letting me know,” he said.
“We'll contact you if we need further information.””
After the call, Marcus told Andre what the investigator had confirmed.
Andre shook his head.
“So somebody took a real document, changed it, and made it look like you approved something you never approved?””
“That's what the revision history indicates.””
“And Victoria tried to fire you.””
“Yes.””
Andre pushed his plate away.
“I'm trying very hard not to say something that'll get me in trouble.””
Marcus laughed for the first time in two days.
“Please don't. I can't afford another workplace investigation.””
They ate dinner while talking about ordinary things: Andre's new apartment, a leaking kitchen faucet, and whether Marcus should finally replace the old couch he had been promising to get rid of for a year.
For a little while, the company felt far away.
Then, at 8:17 p.m., Marcus received an email from Patricia.
The review team had completed a preliminary comparison of the documents.
The email requested that he attend a formal meeting the following morning, where the investigators would explain their findings and ask any remaining questions.
Marcus read it twice.
He didn't feel triumphant.
He felt apprehensive.
If Richard Lawson had used his executive privileges to alter the record, the consequences could be enormous. But if the investigation stopped at identifying an account, someone might still claim that the changes were an administrative error or an unauthorized action by another employee.
Marcus wanted the review to be thorough enough that nobody could quietly rewrite the story afterward.
The next morning, he returned to Sterling Financial.
This time, the reception desk had already been informed of his appointment. Patricia met him in the lobby and escorted him to a conference room on the executive floor.
Daniel was there, along with Raymond Ellis and a representative from Human Resources.
Richard Lawson sat at the far end of the table.
He was in his usual navy suit, his silver cuff links catching the light whenever he moved his hands. He looked at Marcus with the faint impatience of someone who believed the meeting had been scheduled unnecessarily.
“Mr. Reed,” Richard said.
“I understand you've had a difficult week.””
Marcus sat down.
“I have.””
Richard folded his hands.
“I want to be clear that no one in this company benefits from inaccurate records. If an administrative error occurred, we'll correct it.””
Marcus said nothing.
Patricia opened the meeting.
“We've reviewed the original project-governance document, the later version, the security incident report, and the available audit history. We have not reached a final conclusion about individual responsibility. However, we have established several facts.””
She placed two printed documents on the table.
“The original form acknowledged general schedule risks associated with the accelerated migration. It did not authorize proceeding with the specific vulnerability identified on October 9.””
Richard nodded.
“That was my understanding.””
Patricia continued.
“The later version contains additional language stating that the vulnerability was reviewed and accepted. It also identifies Marcus Reed as the technical employee who approved that decision.””
Marcus looked at Richard.
Richard's expression did not change.
Patricia turned to him.
“Did you authorize the addition of that language?””
Richard took a breath.
“I don't recall approving that specific wording.””
“Did you direct anyone to modify the original document?””
“No.””
“Did you review the modified version before it was submitted?””
Richard hesitated.
“I reviewed several documents during that period. I can't remember every version.””
Raymond opened his laptop.
“The audit record shows that the modification was performed using credentials assigned to your executive account. We have also identified a related access event on the same afternoon.””
Richard's eyes moved to the screen.
“What access event?””
Raymond displayed the record.
At 4:24 p.m. on October 9, the executive account had opened the project-governance archive. Two minutes later, the original risk-acceptance form had been accessed. Four minutes after that, a revised version had been created.
At 4:31 p.m., the modified document had been submitted for review.
Richard leaned back.
“I have an assistant who handles administrative tasks. My account may have been used for a legitimate business purpose.””
“Was that access delegated?”” Raymond asked.
“I'd need to check.””
“Was your assistant authorized to alter technical risk approvals?””
Richard's jaw tightened.
“I'm not aware of any alteration.””
Patricia made a note.
“We'll need to interview anyone who had access to your credentials or was authorized to act on your behalf.””
Richard looked toward Daniel.
“This is becoming disproportionate. We're discussing a document in a project that has since been stabilized.””
Daniel answered calmly.
“The security incident was stabilized. The question of whether the company maintained accurate approval records remains unresolved.””
Richard turned to Marcus.
“Mr. Reed, I understand that you believe the document misrepresents your actions. But there was considerable pressure on the team to deliver the project. People were working under difficult circumstances.””
Marcus held his gaze.
“I understand pressure. I was working under it when I reported the vulnerability.””
Richard gave a thin smile.
“And no one disputes that you reported it.””
“Your performance review said I concealed it.””
The smile disappeared.
Patricia intervened.
“Mr. Lawson, the performance-management submission referred to the modified form as evidence that Mr. Reed had bypassed an authorization restriction. We need to establish why that form was used and who knew it had been altered.””
Richard straightened his tie.
“I did not prepare Mr. Reed's performance review.””
“No one has said that you did.””
“Then I suggest you speak with his manager.””
“We have,” Patricia replied.
“The review is ongoing.””
Richard's expression hardened.
For the first time, Marcus saw something other than impatience in his face.
Fear.
It was brief, almost invisible, but it appeared when Patricia mentioned the document's revision history.
Richard looked down at the printed form.
Then he said something that changed the room.
“Victoria told me the security team had already accepted the risk.””
Daniel leaned forward.
“When did she tell you that?””
“During the project review.””
“Before or after October 9?””
Richard hesitated.
“I don't remember the exact date.””
Patricia wrote something down.
Marcus felt his pulse quicken.
Richard had just connected Victoria to the claim that the vulnerability had been accepted.
But the security records showed that the security team had restricted the configuration after Marcus reported it. They had never authorized the deployment to proceed with the vulnerability unresolved.
Daniel asked the obvious question.
“Did you verify Victoria's statement with the security team?””
Richard looked at him.
“I relied on the information provided by the project manager.””
“Did you verify it?””
“No.””
The word landed heavily.
Richard seemed to realize what he had admitted.
He shifted in his chair.
“That's not the same as authorizing a false document.””
“No,” Patricia said.
“It isn't. But it is relevant to the review.””
The meeting continued for another twenty minutes. Patricia asked about the project schedule, the executive account, and the communications between Richard and Victoria. Richard answered some questions directly and others with requests to review his calendar and correspondence.
No one declared him guilty.
No one cleared him, either.
When the meeting ended, Marcus stood and collected his notebook.
Richard remained seated.
As Marcus reached the door, the chief transformation officer spoke.
“Mr. Reed.””
Marcus turned.
“I hope you understand that I never intended to damage your career.””
Marcus looked at him for a long moment.
“Then I hope the records show what you actually intended.””
He left the room.
In the hallway, Daniel caught up with him.
“You did well.””
Marcus shook his head.
“I don't know what to think anymore.””
“You don't have to decide today.””
They walked toward the elevators.
Marcus looked through the glass wall at the office below.
Victoria's desk was empty.
Richard was still in the conference room.
And somewhere in the company's records was the full history of a document that had nearly been used to destroy his reputation.
Then Daniel's phone vibrated.
He read the message, stopped walking, and turned toward Marcus.
“The review team has just received a new statement from Victoria.””
Marcus's stomach tightened.
“What does it say?””
Daniel looked at the screen.
“She's claiming Richard instructed her to submit the altered form.””
Marcus stared at him.
“Can she prove it?””
Daniel didn't answer.
May you like
Because the message contained an attachment.
And according to the reviewer, it was a copy of an email that could either support Victoria's account—or expose a much bigger lie.
