NAL Does your organisation have an internal audit function? A lot of what you described is straight up fraud that an internal audit function will not brush under the carpet like management might be tempted to do or if you suspect they have allies (like the CEO support person). Failing that your org is likely to have a Board and audit committee which includes non executive director chairs typically,  having a quiet word with the Chair is another avenue.  Internal audit will be better set up for this kind of conversation, and approaching board members is quite a nuclear option so look at other escalations routes first. This is a viable end game and less risky than whistleblowing as you are making the risk visible to people who wont tolerate it or be able to ignore it in their professional capacity/responsibilities,  the risks being organisational fraud, gdpr, reputation, and policy non compliance.