A forensic-style review of all inventory adjustments in the account, independently audited by a second AI model. Three transactions examined; every one of them is anomalous.
The account contains exactly three inventory adjustments — IA02, IA08, IA09 — spanning 2026-07-01 to 2026-08-08. All three exhibit metadata anomalies: impossible timestamps, missing creator attribution, absent audit trails, or audit-trail entries that predate the record they describe. Six earlier adjustments (IA01, IA03–IA07) were deleted, four of them in a system-context burst.
The weight of evidence — including the most direct piece, IA09’s own memo (“POS demo seed — initial stock”) — indicates these artifacts are demo-data seeding fingerprints, not fraud. The business content of the transactions is mundane; the metadata around them is what is broken.
A secondary control observation: IA08 posts an $8,255 balance-sheet increase, backdated 41 days into a still-open prior month, with no creator and no audit trail. In a live environment that combination — regardless of direction — is a control gap worth closing.
| Doc # | Internal ID | Tran Date | Created | Created By | Lines | GL Impact |
|---|---|---|---|---|---|---|
| IA08 | 41760 | 2026-07-01 | 2026-08-11 18:02 | — none — | +10 ASUS PG348Q monitors, LA DC | Dr Inventory $8,255.00 Cr COGS: Stock Adjustment |
| IA09 | 42231 | 2026-08-02 | 2026-08-02 12:00 | Tim Dietrich (158) | 36 items, +615 units, SF Store | $0.00 |
| IA02 | 27097 | 2026-08-08 | 2026-09-03 15:56 | — none — | −1 Grey Cotton Hoodie, SF Store | Dr COGS $29.99 Cr Inventory |
Both open periods (Jul 2026, Aug 2026) are unlocked and unclosed. Accounts hit: 1210 Inventory : Inventory in Stock ↔ 5370 Cost of Goods Sold : Stock Adjustment.
IA09 introduced 615 units across 36 electronics items (SSDs, laptops, monitors, peripherals) at $0.00 total value. All 36 items — created the same day as the adjustment — carry averagecost = 0, verified across the full set, not a sample.
This is not a future risk; it is happening. The items already appear on 8 cash sales, 1 cash refund (~$2,050 gross) and 1 open sales order ($3,432). Every COGS ledger line generated by those sales — 16 lines — posted $0.00. Consequences until corrected: 100% reported gross margin on these SKUs, understated inventory valuation, and a distorted P&L for the SF Store location.
Causality note (per independent review): the $0 adjustment did not “zero out” a real cost — the items never had one. A zero-value adjustment inherits, rather than causes, the zero. The fix is the same either way: establish real costs via a corrective adjustment or costed receipt.
Entered 2026-08-11, dated 2026-07-01 — a 41-day backdate across a month boundary into a still-open period. No createdby, no memo, no system notes. The posting debits Inventory $8,255 and credits COGS.
Direction matters (per independent review): this is a stock-in — found inventory raising an asset — not the shrinkage/write-off direction classically associated with theft concealment. The initial draft of this analysis over-weighted the “forensic red flag” framing. The genuine issue is narrower and still real: a material, backdated, prior-period balance-sheet entry with zero attribution or audit trail. The valuation itself is internally consistent (10 × $825.50 average cost; note the item’s standard cost is $750 — average cost was the basis used).
Notably, IA09 — initially treated as the one “clean” record because it has a creator and audit trail — has an impossible audit trail of its own. No surviving adjustment has a coherent metadata timeline. The independent review surfaced this; the primary analysis had computed the 92-day delta but failed to flag it.
Six adjustments (IA01, IA03–IA07) appear in deletedrecord: IA01 deleted 2019-12-03, IA06 in 2022, and a four-record burst (IA03–IA05, IA07) on 2024-11-29 – 2024-12-06 by user -5 (a NetSuite system/internal context — reasonable inference, not proof of a specific script). The deletions numerically account for the IA01–IA07 gap, but the dates cannot belong to the same timeline as the 2026 survivors — a document series does not span a 2019 deletion and a 2026 creation coherently. This reinforces the seeded-time-base conclusion rather than providing a clean audit narrative. The 3 surviving vs. 6 deleted records are distinct internal IDs; no overlap.
IA02 and IA08 have neither createdby nor any systemnote rows. Normal UI and SuiteScript entry produce both, so a non-UI injection path (seeding backend) is the likely explanation — but the independent review correctly notes this heuristic is weakened by IA09, whose “normal” audit trail is itself impossible, and that migration/import paths can also produce absent attribution. Treated here as supporting evidence only.
Stripped of metadata: a 1-unit $29.99 hoodie write-off (normal shrink direction), a 10-unit stock-in, and a demo seed. IA02 — the record with the most corrupted metadata — has the most trivially normal business content. The anomalies live in the metadata layer, which is exactly the signature of seeding tooling rather than transactional manipulation.
The primary findings were submitted — source data first, claims stated neutrally — to a different AI model operating under an adversarial-reviewer charter. Its verdicts, and how this report changed in response:
| Claim | Verdict | Disposition in this report |
|---|---|---|
| C1 — IA02 timestamps impossible | CONFIRMED | Kept; “fabricated” framing softened to seeding-artifact (F3). |
| C2 — IA08 backdate = forensic red flag | CHALLENGED | Reframed: stock-in direction is not the theft pattern; the control gap (backdated + unattributed + material) is the finding (F2). Cost-basis note ($825.50 avg vs $750 std) added. |
| C3 — Zero-cost items distort COGS | CONFIRMED / CHALLENGED | Consequence confirmed; causal wording fixed; sample of 4 upgraded to full verification of all 36 items; consequence proven with post-review GL query — $0 COGS already posted (F1). |
| C4 — Deletions explain numbering gap | CHALLENGED | “Fully explained” retracted; incoherent deletion time base surfaced as the real story (F4). |
| C5 — No audit trail ⇒ backend injection | CHALLENGED | Downgraded to supporting evidence; heuristic self-falsified by IA09’s impossible notes (F5). |
| C6 — No fraud; only C3 consequential | CHALLENGED | “No fraud” retained with memo evidence now cited; IA08 elevated from dismissed to control-gap finding (F2). |
All data was pulled live via SuiteQL on 2026-08-24 under the Administrator role. Arithmetic was verified by sandboxed computation, then independently re-verified by the reviewing model. Key queries (trimmed for layout; logic unaltered):
SELECT t.id, t.tranid, t.trandate, t.status, t.memo, t.createdby,
e.entityid AS created_by_name, t.createddate
FROM transaction t
LEFT JOIN employee e ON t.createdby = e.id
WHERE t.type = 'InvAdjst'
ORDER BY t.trandate DESC
SELECT tl.transaction, t.tranid, tl.linesequencenumber, tl.item, i.itemid,
tl.quantity, tl.netamount, tl.location, l.name AS location_name
FROM transactionline tl
JOIN transaction t ON tl.transaction = t.id
LEFT JOIN item i ON tl.item = i.id
LEFT JOIN location l ON tl.location = l.id
WHERE t.type = 'InvAdjst' AND tl.mainline = 'F'
ORDER BY t.tranid, tl.linesequencenumber
SELECT t.tranid, a.acctnumber, a.fullname AS account, a.accttype,
tal.amount, tal.debit, tal.credit
FROM transactionaccountingline tal
JOIN transaction t ON tal.transaction = t.id
JOIN account a ON tal.account = a.id
WHERE t.type = 'InvAdjst'
SELECT t.tranid, TO_CHAR(t.trandate,'YYYY-MM-DD') AS tran_date,
TO_CHAR(t.createddate,'YYYY-MM-DD HH24:MI') AS created,
TO_CHAR(t.lastmodifieddate,'YYYY-MM-DD HH24:MI') AS last_modified
FROM transaction t WHERE t.type = 'InvAdjst'
SELECT sn.recordid, sn.field, sn.oldvalue, sn.newvalue,
TO_CHAR(sn.date,'YYYY-MM-DD HH24:MI') AS changed,
e.entityid AS who, sn.context
FROM systemnote sn
LEFT JOIN employee e ON sn.name = e.id
WHERE sn.recordid IN (27097, 41760, 42231)
ORDER BY sn.recordid, sn.date
SELECT recordtypeid, recordid, name,
TO_CHAR(deleteddate,'YYYY-MM-DD') AS deleted_on, deletedby
FROM deletedrecord
WHERE recordtypeid = 'inventoryadjustment' OR name LIKE 'IA%'
ORDER BY deleteddate DESC
SELECT COUNT(*) AS total_items,
SUM(CASE WHEN NVL(averagecost,0) = 0 THEN 1 ELSE 0 END) AS zero_avg_cost
FROM item WHERE id BETWEEN 19778 AND 19813
-- result: 36 / 36 at zero average cost
SELECT ROUND(SUM(tal.amount),2) AS cogs_posted, COUNT(*) AS gl_lines
FROM transactionaccountingline tal
JOIN transaction t ON tal.transaction = t.id
JOIN account a ON tal.account = a.id
JOIN transactionline tl ON tl.transaction = t.id AND tl.id = tal.transactionline
WHERE t.type IN ('CashSale','CashRfnd')
AND a.accttype = 'COGS'
AND tl.item BETWEEN 19778 AND 19813
-- result: cogs_posted = 0.00 across 16 GL lines