The audit caught eleven of the twelve discrepancies.
Nolan presented the findings on Thursday with the particular confidence of someone who had worked over a weekend. He’d found the mislabeled inventory, the double-counted shipments, the phantom vendor who existed only as a routing number. The board nodded along. Eleven findings, each one documented with source records and corrective recommendations.
The twelfth discrepancy was that the audit methodology itself had been designed by the person who’d created the phantom vendor.
This wasn’t a flaw in Nolan’s work. His sampling protocol, his verification procedures, his cross-referencing — all textbook. The textbook had been written by someone who understood exactly which patterns the methodology would catch and which it would miss. Not a gap. A shaped absence.
After the meeting, Garcia from compliance pulled Nolan aside. “You’re not worried about what you didn’t find?”
“We found eleven,” Nolan said. “Out of twelve. That’s a ninety-two percent detection rate.”
“Ninety-two percent of the ones that were findable.”
Nolan looked at her for a long moment. “Every audit has a boundary.”
“Sure,” Garcia said. “The question is who drew it.”
He went back to his office and looked at the eleven findings spread across his desk. Each one was genuine. Each one was real. Each one had been placed — he understood this now, though he couldn’t prove it — specifically so that finding them would feel like thoroughness.
The eleventh one had been the hardest. He’d stayed late on Saturday, cross-referencing three databases, and when the pattern finally resolved he’d felt the particular satisfaction of a difficult problem yielding to careful work. That satisfaction was, he now suspected, the point.
He could report this suspicion to the board. He could say: I believe the audit was designed to succeed at exactly this level. He could explain that a ninety-two percent detection rate, far from proving rigor, might be evidence of its opposite — that the eight percent was not a residual but a sanctuary.
But the eleven findings were real. The corrective actions were warranted. The phantom vendor needed closing. And if he undermined his own audit, the eleven genuine problems would go unaddressed while the board debated methodology.
So he signed the report. Eleven of twelve. He added a recommendation for an external review of audit procedures — buried it in paragraph eight of the executive summary, where it would be noted and not acted upon, which was, he thought, about the right depth.
Garcia stopped him in the hallway the next morning.
“Did you sign it?”
“With an addendum.”
“Will they read the addendum?”
“They’ll read it,” Nolan said. “They’ll just calibrate around it.”