She wasn't one of them.
She wanted the aircraft to be used responsibly.
And she wanted the people operating it to understand that professionalism mattered more than flattering the owner.
The audit team began with the most recent sixty days of flight records.
They compared approved itineraries with operator releases.
Then they examined passenger manifests, invoice allocations, dispatch changes, and relevant communications.
At first, the differences looked administrative.
A missing internal reference number.
A late passenger update.
A billing description that didn't match the corporate travel system.
Then the auditors found a pattern.
Seven flights had been charged to accounts reserved for urgent executive logistics.
But the listed passengers didn't match the authorized business purposes.
Several travelers were associated with outside investment and acquisition advisers.
Others were personal guests of the CFO.
And the aircraft's use hadn't been disclosed through the proper approval process.
The total direct cost of those flights was substantial.
But the money wasn't the most alarming part.
The records suggested someone had deliberately bypassed the controls the CEO established when Meridian Atlas acquired the aircraft.
The audit team examined the authorization signatures.
Each questionable flight carried a document claiming approval from the CEO's office.
The digital signature images appeared consistent.
At first glance, that might have reassured someone unfamiliar with the company's procedures.
But the audit logs told a different story.
The approvals hadn't been issued through the normal authenticated workflow.
They were PDF files uploaded into the scheduling system by an account associated with the CFO's administrative staff.
The signature image appeared to have been reproduced from an earlier legitimate document.
That didn't prove which person copied it.
But it established that the approvals weren't created through the procedure the CEO had authorized.
Outside counsel preserved the files.
Then interviewed the employees who handled the requests.
One administrative assistant explained that the CFO's office frequently instructed staff to upload travel documents marked as urgent.
She believed the required approvals had already been obtained.
Another employee said she questioned the absence of the normal authentication record.
Her supervisor told her the CFO had personally resolved it.
The employee accepted that explanation.
Now she regretted it.
The investigators didn't treat every administrative employee as a conspirator.
They needed to distinguish people who knowingly bypassed controls from people who relied on false assurances.
But the pattern showed a serious failure.
A senior executive's authority had been used to pressure lower-level employees into processing documents without normal verification.
The CEO recognized the pattern immediately.
It was the same behavior she'd seen on the tarmac.
Powerful people issuing instructions.
Less powerful people afraid to ask questions.