Usiku wa reenactment, Aisha alirudi head office na rule moja: hakuna mtu ange-run file ya zamani kwenye production.
Wekesa alikuwa ameandaa sandbox yenye sample data ya accounts ambazo identities zake zilikuwa masked. Njeri wa finance control, IT security na internal audit walikuwa observers.
“Tunaanza na normal night,” Wekesa alisema.
Waliingiza settlement inputs: customer repayments halisi, agent reserve movements, reversals na treasury top-ups. System ilifanya reconcile bila surprises.
Kisha Wekesa akaonyesha folder ambako emergency journal files zilikuwa zikifika.
“Shared folder hii ndiyo night operator anaangalia saa mbili.”
“Nani anaweza kuandika?” internal auditor akauliza.
“Service account kutoka executive operations workflow.”
“Na nani anaapprove?”
“Maker-checker. Normally treasury plus executive ops.”
Waliweka file ya sample yenye structure sawa na ile ya Mama Atieno, lakini amounts na IDs zikiwa synthetic. Wekesa akabonyeza validate.
System ikatengeneza borrower repayment entries kutoka reserve allocations.
Njeri akasema, “Hiyo inaweza kuwa by design.”
“Ndiyo,” Aisha akasema. “Question ni approval na disclosure.”
Wekesa akaonyesha log ya siku ya Mama Atieno. File iliingia saa 02:09. Maker metadata ilikuwa service account. Checker request ilitumwa saa 02:11. Saa 02:13 override ikafanya batch run.
Hiyo ndiyo timestamp ya repayment ya marehemu.
“Kwa hiyo entry ya 02:13 haikuwa customer action,” internal auditor alisema.
“Kwenye hii case, source ni reserve journal,” Aisha akajibu. “Tusi-generalize kwa loans zote.”
Wekesa akafungua approval credential history. Account ya Victor Odede ilikuwa kwenye event.
“Nilisema jana inaweza kuwa delegated,” Aisha akasema. “Leo tunahitaji access record.”
IT security ilileta managed-device logs. Session ilikuwa imeanza kwa corporate laptop assigned COO office, kupitia MFA token iliyosajiliwa kwa Victor.
Njeri akavuta pumzi.
Wekesa alikuwa kimya. Aisha akamuuliza, “Usiku huo uliiona?”
“Niliiona override. Nilidhani executive exception.”
“Uliuliza?”
Wekesa akatikisa kichwa. “Hapana. Ukiwa junior na COO account imeapprove, una-run.”
“Na leo?”
Wekesa akatazama sandbox file. “Leo sitarun bila checker wa pili.”
Njeri akasema, “Hiyo ni insubordination ikiwa policy ina emergency override.”
“Basi policy ndiyo tunarekodi,” Wekesa akajibu. “Lakini sitaifanya kuwa automatic kwenye disputed cohort.”
Aisha hakumsaidia kwa maneno. Choice ilikuwa yake.
Walifanya reenactment ya second path: recycled-number ingestion. Legacy death code ilikosa exclusion, customer key ikarudi active, loan engine ikafungua eligible profile, reserve journal ikapata borrower target, executive override ikafanya reporting repayment.
Hakuna hatua moja iliyokuwa “magic fraud button”. Mfumo ulikuwa chain ya shortcuts ambazo pamoja ziliweza kufanya mtu aliyekufa aonekane akilipa.
Internal auditor aliandika sequence kwenye whiteboard.
“Ni sehemu ipi Victor ali-create?” akauliza.
“Hatujui kama ali-create identity bug,” Aisha alisema. “Tunajua credential yake ilitumia override kwenye journal batch, na operations messages zinataja investor snapshot.”
Waliweka evidence tiers: proven system behavior, attributed approval, inferred business motive, unresolved design history.
Hiyo ilifanya case iwe ndogo kuliko rumor lakini nzito kuliko accusation ya kawaida.
Wakati session ikiisha, Wekesa ali-create change request: emergency journal file kwa disputed reserve cohort lazima iwe na second approver asiye chini ya commercial reporting line.
“Unaweza ku-submit?” Aisha akauliza.
“Nita-submit. Iki-reject, rejection nayo ni record.”
Alibonyeza send.
Dakika mbili baadaye approval request ya policy change ikaingia.
Kwa mara ya kwanza, junior operator ambaye usiku uliopita ange-run file kwa kuona jina la boss, alikataa kufanya hivyo bila checker.
Internal auditor aliomba reenactment ifanywe mara ya pili na operator tofauti. Aisha alikubali. Operator wa mchana ambaye hakuwa kwenye incident alifuata documentation ile ile na kupata path sawa: legacy identity link, reserve target, emergency file, checker bypass. Hilo lilipunguza uwezekano kwamba Wekesa alikuwa ameunda demo kwa namna ya kuthibitisha story yake.
Kisha walibadilisha variable moja: closure code mpya badala ya legacy. Profile haikureactivate. Walibadilisha nyingine: reserve journal bila customer-repayment classification. KPI haikupanda. Kwa kila hatua waliona sehemu ya chain inayohitajika. Scheme, kama ingeendelea, ilitegemea combinations, si button moja.
Wekesa alikiri kwamba shared folder ilikuwa na culture ya “file ikitoka juu, run”. Internal audit ikaandika hiyo kama control weakness tofauti na technical bug. Aisha akauliza kama operator angeweza kukataa bila kuadhibiwa. Hakuna mtu alikuwa na jibu nzuri. Hivyo policy request ya second approver iliambatana na protected escalation route. Wekesa hakuhitaji kuwa shujaa kila usiku; system ilipaswa kumpa njia ya kusema stop bila kutegemea ujasiri wake binafsi.
Njeri aliomba waone pia path ambayo emergency override ilikuwa halali. Waliunda scenario ya real-time fraud lock ambapo treasury checker hakuwa available na customer funds zilikuwa at immediate risk. Policy iliruhusu executive override, lakini reason code, incident link na retrospective review vilihitajika. Kwenye Mama Atieno batch, reason code ilikuwa blank na hakuna incident ticket. Hivyo team haikusema “override yenyewe ni kosa”; walisema use hii haikuwa na safeguards ambazo policy yenyewe ilidai.
Internal auditor akauliza kama Victor account ingeweza kutumiwa na assistant. IT security ilionyesha MFA token assignment na login zone, lakini haikuweza kuthibitisha nani aliketi mbele ya laptop kwa macho. Aisha akaweka attribution level kama “credential and managed-device evidence consistent with Victor account use”, si video proof ya mtu. Huo ulikuwa mpaka muhimu. Report haikuhitaji kuzidi evidence ili kuwa serious.
Mwisho wa reenactment, Wekesa alichapisha process map mpya yenye sehemu nyekundu kwenye checker bypass. Hakuitia jina la Victor. Aliitia “single-executive approval risk.” Kwa Aisha, hiyo ilikuwa ishara kwamba work ilikuwa inaanza kutoka kwa person kwenda kwa control. Hata kama Victor angeondoka kesho, shared folder, emergency role na operator culture vingebaki kama havijabadilishwa.
Auditor ali-save sandbox configuration pamoja na reenactment logs, kwa sababu demo isiyoweza kurudiwa baadaye ni memory nyingine tu. Wekesa akaweka version ya code na configuration timestamp. Hivyo ikiwa system ingebadilishwa kesho, review bado ingeweza kuonyesha behavior iliyojaribiwa usiku huo.
Na kwenye batch history iliyohifadhiwa, credential ya Victor Odede ilibaki kwenye entry ya saa 02:13.