The Kisumu courier depot smelled of canvas, paper and vehicle oil. Aisha arrived before the morning route sacks were opened. Internal audit, dispatch and an agent representative watched.
“Weigh before opening.”
Three sacks went onto the scale.
Two matched their expected weights.
The third was light.
Its seal was intact.
“That means it was loaded this way,” the depot manager said.
“Or the manifest changed,” Aisha replied.
Under normal dual control, they opened the sack. Five pouches inside matched the corrected manifest, not the original dispatch plan.
The courier, Juma, produced the copy he had received before departure.
Original route: KSh 150,000.
Corrected route: KSh 90,000.
The correction had been sent after he was already moving.
A dispatch message told him the difference had been rerouted to the central reserve. The courier had not stolen cash. The pouch had not been opened. The decision occurred upstream.
Then they found the exception slip.
**ACQ STABILIZATION — TEMP REROUTE.**
Internal audit traced the slip to a treasury-operations account with second-level approval through executive operations. IT security found the same credential family already associated with the disputed journal path.
The agent representative asked the obvious question.
“So they took agent cash to make the central picture look stable?”
“They rerouted agent-bound liquidity to reserve during the acquisition window,” Aisha said. “That is the demonstrated effect. Intent stays tied to documents and statements.”
They reconciled the full route: planned cash, actual load, diverted amount, reserve entry and later restoration.
Most of the redirected liquidity returned after the snapshot. Some rolled into the following day.
That explained why the shortages could be temporary and still repeatedly hurt agents.
To avoid turning one sack into a story about the entire depot, they weighed an unaffected control route. Planned amount, actual amount and manifest matched.
They also reviewed three earlier route days. Late reroutes occurred for ordinary reasons such as cash availability, but `ACQ STABILIZATION` clustered around the snapshot period.
Again, Aisha refused to label every `STAB` code as harm. Scope remained tied to acquisition timing plus demonstrated agent impact.
The agent representative requested all manifests. Internal audit refused because the documents contained route-security information.
They compromised on a summary extract: route ID, planned amount, actual amount, correction time, reason and restoration.
Juma explained the human consequence.
“When I arrive short, the kiosk blames me.”
“The dashboard never sees that argument,” Aisha said.
They drafted a control: post-dispatch central reroutes had to become visible to the agent-liquidity desk, with enough reason information for the kiosk to understand the shortage. That did not solve identity fraud. It solved the physical-custody consequence the investigation had uncovered.
Before the sacks returned to custody, they were weighed and resealed in front of all parties. Original manifests stayed at the depot; audit took certified copies only.
Aisha also noted a limitation: the exception slip documented the reason for rerouting. It did not, by itself, prove the final use of every shilling. Reserve-account reconciliation supplied that next link.
A paper seal had stayed intact.
The cash was not missing from the bag because someone opened it.
It had been redirected before the bag arrived.
The depot manager agreed to preserve the original correction slips under ordinary route-retention rules rather than creating a special private archive for Aisha. If the investigation continued, reviewers could return to the same source repository. The agent representative also raised compensation for lost business time, not merely missing float. Njeri said the current product terms did not automatically compensate lost trade. Aisha recorded the issue without pretending physical reconciliation could answer it. The depot chapter established when and where cash was redirected; the financial value of missed business would require a separate remedy rule.
And the reason written on the exception slip was **acquisition stabilization**.