I don't know what kind of audit was done, but apparently it wasn't sufficient.

At this point, we don't know if it's one person in particular or more than one. We don't have proof of anything. We can only wait for the outcome of the investigation.