esragate, page-41

As I have said a few times. This story revolves around one crucial question.
Is she denying involvement?

When the indescrepency was found, the alleged perpetrator would have been confronted, either immediately or after waiting to detect and confirm further indiscretions, usually with computer tracking technology.

Once confronted the alleged perpetrator would be asked to explain the inconsistency with the figures.
Here they would either accept responsibility or deny involvement.
Usually the threat of a police investigation is enough to encourage cooperation, but if the perpetrator maintains innocence the whole investigative process would begin.
It's at this point that if co operation was not forthcoming and the prima facie evidence was so compelling, that it would warrant suspension for the evidence to be compiled to pursue criminal and civil penalties.

It's this type of stuff, although difficult to find sometimes, when exposed is usually pretty straight forward. There is money directed inappropriately, it's directed to someone specifically and there is no plausible reason for its occurrence.

The writing is on the wall, as any hint of internal error, computer glitches, misunderstandings would not leave you with prima facie evidence and the need to suspend your CEO.