On the afternoon of the second week, Leah placed the incident summaries on a table in BEM’s coordination room. The first pages carried no school names; they had columns for notice received, channel used, payment status, and response. Joseph, Elias, Musa, and four school heads sat around the table. Some wanted to begin with the number that had changed its name. Leah asked them to wait.
“If we build a rule that depends only on this number, someone will use another number tomorrow,” she said. “We can keep it as incident evidence, not as the foundation of all our security.”
The head of Kijani moved his chair. “But the heads want a list of bad numbers. If they see the name, they’ll know not to accept it.”
“A changed number is not a reason to trust a different number,” Elias said. “We need a method that makes every request verifiable, even when it comes from a new number.”
Leah drew two lines on the board. The first was labelled *received message*. The second was *official channel*. “No payment or code leaves a school until these channels meet,” she said. “Then two people’s approval must leave an audit trail.”
Musa gave Bahari as an example. “If I had had a callback directory, I would have known the PDF number was not BEM’s before 8:31.”
“And if Ruth had no second approver to ask?” Joseph said.
“Then HOLD,” Elias said. “HOLD is not a denial of service. It is a pause with a reason and a review expiry.”
Some of the others feared the procedure would delay legitimate recruitment. Elias showed them Mwangaza’s budget draft. Payroll and recurring school expenses already had established references. The new protocol targeted notices outside the budget, codes, or deadlines without a source. He did not want verification to become a wall around every transaction.
“We can write three categories,” Leah said. “A routine expense with a record, a new request with a two-channel check, and an emergency request with an extra approval and a reason that expires.”
The head of Upendo, who had been sitting quietly at the back, asked what an “expiring reason” meant.
“No one can use the word emergency for an entire month,” Elias replied. “Every exception needs a review date and the name of the person who accepted it.”
They filled the paper with examples. The first notice belonged in the new-request category. The second code was a suspicious message. A legitimate recruitment letter would be routine or an approved external logistics expense if it carried a BEM reference. Each example showed them that the rule did not require knowledge of the villain; it required knowledge of the next action.
The Mlimani representative wanted BEM to issue an announcement naming the sender so people would feel they had received an answer. Leah said BEM could confirm the service and issue an official warning, but it could not name a person without an investigation that permitted it. Joseph agreed. “We will not save our reputation by damaging that of someone who may be innocent.”
Ruth sat to one side, listening. When they reached dual approval, she picked up her pen. “I asked for an override because Joseph was not in the building. I want the rule to say that the Head’s absence does not automatically make the deputy the second source.”
Elias looked at her with slight surprise. “Are you ready to put that in writing?”
“I’m ready to say what I did. This is a system, not a private apology.”
Leah wrote it into the draft: *delegation must be recorded; no person may self-approve a request by invoking urgency*. BEM would review the wording later, but the heads agreed to start using it immediately as a minimum protocol. They divided responsibilities: BEM would maintain the directory, each school would appoint two callback contacts, and incident records would preserve original messages without circulating personal numbers.
Elias proposed that the verification circle run a live drill every two weeks. Musa said schools might see it as a burden, but admitted that the ten-minute drill had stopped the code from reaching Upendo. Joseph ordered Mwangaza to begin at once, and schools that wanted to join would use the same template.
The head of Tunu asked who would carry the cost of the callbacks. Leah said the directory and portal were BEM services; schools would provide staff time and a call record. Elias added that no school was required to call private people using numbers from forwarded messages. That reduced the burden because the process did not require one person to be available every hour.
They tested the drill with an ordinary invoice. Ruth put down a notice from a vendor on the current register. Pendo opened the procurement file, found the contract number, and called the vendor through the verified route. The deposit was confirmed and the form passed. Then Elias placed a copy of the fake notice on the table without a working number. Pendo followed the same steps, wrote *no source*, and left the voucher on HOLD.
“The rule works for two different things,” Joseph said. “That is what we want.”
Another head wanted the protocol to carry a BEM signature every day. Leah said BEM could approve the minimum rules, but responsibility for the school’s controls had to remain with the school. Elias agreed. “If we wait for an upper-level stamp at every step, we will repeat the problem of relying on a seal instead of a trace.”
Before the draft was signed, they added an expiry for every exception, two people for each callback, and a rule that every alert be sent with a ticket reference. They agreed public information would concern the service and the protective steps; incident details would remain with the heads and BEM. This gave Musa space to acknowledge the loss without his name becoming a public shame notice.
Elias opened a shared sheet for the schools ready to join. Bahari, Mwangaza, Kijani, and Mlimani entered contact names. Upendo asked for two days to obtain board permission. Its Head did not reject the rule; he was afraid of publishing his loss. Leah told him the audit trail could be confidential at the school level, but it must not disappear.
“We will put the protocol in place now, then fill in the totals,” Joseph said.
The Upendo Head closed his folder. “There is information I have never included in the totals.”
Before leaving, they checked the missing-information list. Bahari’s loss was known. Kijani and Mlimani did not know whether money had left. Upendo had preserved the message but had not produced its ledger. Leah said the combined summary was incomplete. The Upendo Head stood holding his file in both hands.
The Upendo Head stopped at the door and said, “The whole loss is not there. There are other payments I did not mention.”
---