This post feels like poetry.

The difficulty in this structure is that someone, somewhere along the chain is laid off, fired made redundant and that person may have been in charge of the invoice.

That type of disconnect can be exploited: billing for services not rendered intermittently, etc.... We used to receive thermal printing paper at random times from a random company because they knew the invoice was sent to a different address and...who really commits fraud for printer paper? It could have just been a mistake because we received that paper....Right? Such a low key crime thats hard to spot and prove mal intentions.

Love a good ol scream test. Only problem is you have to make sure to keep the disconnected thing or the data within for a solid year in case it's only used once annually by "very important process that makes sure the doors stay open" and no one realizes that thing you disconnected is where it's pulled from. Learned that one the hard way

With scream tests I unusually unplug the nic or whatever the equivalent is in a VM because a server can always have weird startup requirements that no one knows anymore while an unplugged nic doesn't change the running state if you need to bring it back online.

Anxiously waiting for a follow up.

Is the official name for this "the scream test"?

I do this in lots of jobs; I tend to come in on cleanup jobs after gross incompetence, sometimes for many years. In addition to fixing problems, I have to help companies learn what should be happening and realign them to normal operating practices. Stopping pointless, worthless, outdated and redundant practices are something I do, and sometimes I apply the method above, though with many fewer degrees of separation than you have to those who may be affected. I find cutting pointless stuff to be one of the best ways to focus energy on things that do matter, get people to a better place and sometimes even save money doing it.