reply for this How would the team determine what actions had been performed? The team would have to investigate in order to determine what actions had been performed. Firstly, start by documenting the events properly and finding out every action through the use of items/cameras. Reviewing logs would be a strong way to check if there was any uncommon activity or logins around the time of the event. Also, getting a thorough description from the payroll administrator of the event