tdons

  d. As  part  of  its  due  diligence  process,  the  Audit  Firm had an employee
     (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas,
     Nevada.  The Auditor was directed by a more senior Audit Firm employee to have
     someone from NS8 log in to the online portal for each NS8 bank account, display
     the current account balance, and download monthly bank statements for fiscal
     year 2019.
  
  e. Based  on  my  interview  with  a  member  of  the  NS8 finance department
     (“Finance Employee-1”), I have learned, among other things, that on or about
     March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s
     office.  The purpose of that meeting was for ROGAS and Finance Employee-1 each
     to log into the online portals for the bank accounts to which they had access
     (for ROGAS, the Revenue Bank Account) and download monthly account statements
     for the Auditor.  During that meeting, Finance Employee-1 logged into the online
     portal for the Expense Bank Account -- to which  Finance Employee-1  had  access
     -- and  downloaded  monthly  account statements.  Finance Employee-1 understood
     that ROGAS was doing the same for the Revenue Bank Account during the meeting.
  
  f. Late in the evening on or about March 11, 2020, the Auditor  emailed  another
     employee  as  follows:    “Attached  please  find the bank statements and
     screenshots that I observed [Finance Employee-1] and Adam [ROGAS] download this
     afternoon.”  Attached to  that  email,  among  other things,  were  the
     Fraudulent  Bank  Statements for the Revenue Bank Account for the period from
     January 2019 through February 2020.