I'm mapping out a timeline with critical deadlines. August 2 is Monday, and the server purge happens this weekend on the 7th and 8th. Since messages disappear after 7 days, anything before July 26 is already gone—I need to pull those chats today. The finance audit logs roll over every 21 days, so entries before mid-July are lost; I should image those immediately. There's also a payment schedule in four installments I need to verify.

The key issue is the documentary evidence: an invoice mentioning border facilitation, a chat from a consultant discussing making the border problem disappear with explicit instructions not to include government names, and a spreadsheet showing reimbursements. These three documents corroborate each other and show intent to conceal, which likely crosses the threshold for credible evidence of a covered payment as of August 2. I'm treating August 2 as day 1 of the 30-day clock, making September 1 the deadline—that's 30 calendar days from receipt.

Rather than waiting until day 30, I'm recommending an accelerated timeline: a special committee of independent directors (excluding Cole's two allies) should meet by day 8 (August 9) to review the investigative findings, with a decision date set for August 12 (day 11). I need to verify the authenticity of these documents quickly—especially the chat against Cole's device—and preserve everything now. The concealment instruction itself might also trigger separate books-and-records or obstruction concerns, though I'm focusing on the covered payment analysis under the given rules.

For governance, the CFO is conflicted since the reimbursements flowed through finance with four approved installments, and internal audit reports to the CFO anyway, so that's not independent. The CFO also suggested tipping off Cole, which is a spoliation risk. The CCO is a custodian of the hotline and uses a personal phone for work messages, so I should image that device too, but the CCO can stay in a reporting role as long as outside counsel directs the investigation. I'm structuring this with a special committee retaining outside counsel under an engagement letter for legal advice, then having forensic accountants work under counsel in a Kovel-like arrangement to keep privilege intact while maintaining a separate factual chronology that isn't privileged.

For the Upjohn warnings, I need to make clear there's no personal confidentiality promise and warn against deletion. I'll sequence interviews starting with peripheral people, then Cole after we've imaged his devices—interviewing him first would be a tip-off. On payments, I'm suspending the $240,000 reimbursements and any pending installments, putting East Reach on hold for the facilitation line items, but continuing legitimate brokerage under tighter controls with per-transaction approval, no cash, documented tariff codes, and senior compliance sign-off.

Abrupt termination risks tipping Cole off and destroying records, so I need to balance that against stopping reasonably suspected ongoing payments. I'm sending a contractual preservation and audit-rights notice to East Reach within the first day or two—their records are critical and could disappear, plus the whistleblower may be inside the company. For Cole, I'm moving him to administrative leave or reassignment away from customs and payment authority, removing his approval rights and system deletion access, but framing it as non-disciplinary paid leave to avoid triggering spoliation.

Now I'm identifying the key custodians and devices to preserve: Cole, the East Reach relationship manager, his admin, the logistics and customs manager, the AP clerk who processed those four payments, plus the controller, CFO, CCO, and regional finance director. I need to image company laptops and export messaging apps before the seven-day deletion window closes, handle personal phones through the BYOD policy's work-container imaging, and pull everything from OneDrive, SharePoint, the ERP system, and expense records. For documents, I'm targeting the East Reach vendor master file, contracts, the four payment vouchers, wire confirmations with beneficiary details, and the SWIFT messages to trace the actual receiving bank and account.

I'm also pulling general ledger entries, approval workflow logs, and finance audit logs before the 21-day rollover, plus customs declarations, shipment timelines, duty payments, and any prior audits or due diligence files on East Reach. For the nonretaliation piece, I need a written directive protecting the reporter's identity, limiting who sees the investigation, and making sure Cole has no contact with witnesses—documenting any attempts he makes. I'm also arranging separate counsel for individuals at company expense and monitoring for any adverse HR actions against the reporter.

Now I'm mapping out what facts are still missing: who actually received the $240k and where it went, whether the consultant is connected to government officials, the East Reach subledger showing those outflows, whether any customs official benefited, whether the customs entries show red flags like duty reductions or waived inspections, and whether the timing of payments correlates with clearance events. I need to verify if the invoice and chat are authentic, who approved this and how high it goes, whether there are similar payments elsewhere, how this was recorded in the books, and what country and currency we're dealing with.

For the timeline and decision-making: I'm weighing two positions on what we can act on with incomplete information. The key insight is that the combination of the invoice, the chat instructing concealment, and the reimbursement trail creates enough credible evidence to treat this as a covered payment even without all details. So I shouldn't use missing facts as an excuse to delay—I need to authenticate within 72 hours, treat August 2 as the starting point, and make the decision by August 12 while treating September 1 as the outer limit. I'm also documenting this reasoning in a dated memo because when regulators review this, they'll scrutinize exactly when compliance obtained credible evidence.

There's also a hard cutoff independent of the 30-day window: I need to disclose before the regulator contacts the company. If there are signs the reporter has already gone to regulators or a whistleblower path is active, that compresses the timeline significantly—disclosure could become urgent any day. When I do disclose, I'm laying out the facts with clear sourcing and confidence levels, distinguishing what's confirmed versus supported versus still unresolved, and identifying all known participants and transaction details like Cole, East Reach, the owner, invoice numbers, the four installments, dates, and amounts.

I'll flag that the beneficiary identity remains unresolved and the investigation is ongoing, commit to a supplemental disclosure date, and provide underlying documents along with factual chronology and interview summaries. The key is producing documents and offering witness access rather than legal conclusions—I'm disclosing facts while withholding legal analysis and mental impressions, ideally with a non-waiver understanding in writing. I need to avoid speculation presented as fact, selective counsel quotes that could waive privilege, and statements like "we conclude no violation" when nothing's proven. I'm maintaining dual-track documentation: a factual chronology and document binder as the disclosure product, kept separate from privileged advice memos.

I should also surface books-and-records issues, internal controls gaps, tax and duty implications, and any potential local law concerns.

On preservation, I'm directing IT to disable auto-deletion on messaging apps immediately and export retained chats before end of day, imaging finance audit logs now, and suspending the quarterly server purge with written confirmation from IT and a named owner. I'm pulling and quarantining backup tapes, issuing a written preservation directive for personal devices with collection appointments, and confirming email journaling is active. I'm also documenting the CFO's rejected proposals in writing with reasons and noting the escalation to the committee.

Now I'm structuring this as an eight-day plan from August 2 through August 8, with the weekend purge happening August 7-8. Within the first two hours on Day 0, I need to brief the GC, CCO, and independent board chair, draft the hold notice, and issue the IT freeze order. The special committee meets August 12 to decide on disclosure, with interim checkpoints on August 5 to verify authenticity and request bank data, and August 9 for the end-of-week report. I'm also flagging an immediate trigger if the bank beneficiary data or East Reach subledger confirms payment to an official-linked recipient.

The company can