CompTIA Security+ (SY0-701) SY0-701 — Question 330

An employee used a company’s billing system to issue fraudulent checks. The administrator is looking for evidence of other occurrences of this activity. Which of the following should the administrator examine?