When an auditor suspects that an unnamed employee is submitting and approving bills for payment, which of the following processes would be most useful in supplying additional proof?