I'd try the same, but with more emphasis on your last point. Have your effort or that of a consultant focused on someone else within sight/similar of the troubl

I'd try the same, but with more emphasis on your last point. Have your effort or that of a consultant focused on someone else within sight/similar of the troublemaker. Have the consultant ask the troublemaker for help in documenting this other staff member's processes so you build rapport and it's not obvious the focus will soon be directed at them. Prioritise the key bits first. Could some 'security testing' also require that consultants have overarching access, and at some point indirectly remind the troublemaker that there would be legal repercussions for an employee misusing access/control?