The next morning Aisha left the office with Otieno and route auditor Zawadi. They drove from Kisumu toward Ahero to inspect three kiosks chosen before they saw the results: one high-volume, one average and one rural.
“Why only three?” Otieno asked.
“Because I want a defined sample, not a tour where we keep searching until we find something dramatic.”
At the first kiosk, agent Bwire refused to let anyone touch his cash box.
“Good,” Aisha said. “We do not need your cash. Show us usable float and reserved balance.”
His total balance was KSh 260,000. KSh 95,000 had been reserved at 2:05 a.m. Part returned after three.
“Did you know it would leave?”
“I saw it in the morning. Support called it a risk adjustment.”
“Any advance agreement?”
“A seasonal-float facility, yes. But I was not told the reserve could become unavailable like this.”
The second kiosk had filed no complaint. Its agent said the night had been normal. Yet the statement showed a reserve debit that reversed about an hour later.
“That matters,” Zawadi said. “The feature may have legitimate overnight use.”
“Exactly,” Aisha replied. “We are not proving wrongdoing by finding the feature.”
At Ahero, the problem became physical.
A SawaLink courier had arrived with cash pouches for a float top-up. The route manifest originally listed KSh 150,000 for one pouch. A handwritten correction changed the amount to KSh 90,000 and added a code: `STAB-ACQ`.
The courier, Juma, said head office had ordered the reroute.
They weighed the sealed pouch before opening it. The seal matched. The cash inside matched KSh 90,000.
No one had stolen money on the road.
The route plan had changed.
Juma produced the original manifest from before departure. It still showed KSh 150,000.
“When was the correction sent?”
“After I was already moving.”
Aisha requested the official dispatch extract. It said: **stabilize reserve pool before morning snapshot; restore routes after 09:00**.
Zawadi stared at the line.
“Snapshot again.”
“Record it. Do not decorate it.”
On the drive back they added a control kiosk with similar volume that was not in the reserve cohort. It showed no debit and no corresponding shortage.
Aisha wrote the criteria for any next sample before looking at more data: same reserve product, same overnight window, different route volumes and at least one unaffected control. A larger sample without rules would become a fishing expedition.
They also recorded weather and road conditions so later reviewers would not confuse treasury rerouting with transport delay. The road had been clear that morning.
Back in Kisumu, Zawadi built a table with `planned cash`, `delivered cash`, `reserve debit`, `reversal time` and `snapshot window`. She kept agents anonymous in the working comparison.
Two affected routes showed reserve pressure before the snapshot and restoration afterward. A third did not restore completely, which made the pattern less neat but more credible.
Aisha refused to hide the awkward row.
“An inconsistency is a question, not a reason to remove data.”
She also asked dispatch not to send a vague message saying the “system issue” was resolved. Each sampled kiosk received a short factual statement showing planned amount, actual delivery and correction reason.
The Ahero agent read it and said, “At least now I can explain why the courier arrived light.”
The route had not been robbed.
Cash had been redirected by head-office instruction.
At the office, treasury supplied a normal reroute example caused by a bank cash-delivery delay. That correction had a ticket opened before dispatch, an agent-liquidity notice and a reason visible to the route desk. Aisha placed it beside the acquisition-window corrections. She was not arguing that changing a route was inherently improper. The issue was timing, disclosure and the link to a reserve snapshot. The normal example made the contrast sharper without requiring anyone to invent a new rule. SawaLink already knew how to reroute cash transparently when it chose to.
And the correction appeared on the manifest only after the journey had already begun.