The bank's head of security and an independent technology team reviewed the authorization records.
They established that the branch manager's credentials had been used to approve an exception allowing the disputed transfer to advance without a complete identity-verification package.
The manager claimed he'd relied on information supplied by the foundation's CFO.
But the approval record contained a statement saying the CEO had personally appeared at the downtown branch.
Investigators checked the visitor logs.
No entry matched her name.
They reviewed the appointment system.
No meeting had been scheduled.
Then they examined surveillance footage covering the relevant period.
At 4:12 p.m. Tuesday, the CEO wasn't in the bank.
The reception area was nearly empty.
A delivery worker crossed the lobby.
An older man spoke with a private banker.
And the branch manager was visible walking toward his office carrying a coffee cup.
No woman matching the CEO's identity entered the building.
The footage didn't merely fail to confirm the verification.
It contradicted the supposed meeting.
The investigators then examined the electronic approval file.
The manager had used his credentials to certify that the required identification check had been completed.
The relevant form contained no underlying authenticated record of the CEO presenting identification.
Instead, it referenced an image already stored in the bank's client files.
The risk team concluded that the approval relied on an existing identity record rather than a new verification.
That was contrary to the claimed procedure.
The branch manager had treated a previously verified identity as proof of consent to a completely new transaction.
And he'd certified an in-person meeting that hadn't occurred.
The bank suspended him from his duties while the review continued.
It also restricted the access of an operations supervisor who had processed the second authorization step without resolving the missing documentation.
The CEO learned about those actions through the bank's formal response.
She didn't celebrate.
She was relieved that the bank was investigating.
But she remained concerned about how the approval had passed through multiple employees.
One person's misconduct could be serious.
A system that allowed other people to accept it without checking was more dangerous.
The receptionist's interview revealed another part of the story.
She sat across from two human resources investigators with her hands folded tightly in her lap.
Her black blazer hung over the back of her chair.
She wore a plain cream-colored blouse and looked exhausted.
The investigators asked her to describe the CEO's arrival.
At first, she said the woman was disruptive.