If there is some credible reason to believe this might be the case, then an audit should be done. Carefully, not recklessly. With oversight, especially if the auditor gets write access to anything. That oversight should include, at an absolute minimum, a system, not controlled by the auditor, that logs every interaction with the system being audited.

Why do they need write access for this?

Here's the thing, I'm very happy with uncovering fraudulent spending. I strongly doubt that's actually happening. If it was we'd be seeing careful audits and lawsuits against those submitting fraudulent invoices, not this fly by night takeover of systems.

I see your X post and raise you this one

https://x.com/Quaker_Opes/status/1886596488505053618

I invite you to think through the implications.

The nebulous use of fraudulent is doing some rather heavy lifting here.

Angry? Why are you coming off so strongly? There's nothing wrong in questioning an unethical approach. If a kid is good in AI/ML to spot a pattern in an image, maybe they should work in healthcare and, not forcefully and illegally poke into someone's financial records. You are the one who needs some serious soul searching.