Speaker Trevor Mallard has implied his office and the Parliamentary Library are not the source of the Simon Bridges expenses leak.
Members of Parliamentary services, the Speakers office and the entire National Party caucus appear to have received the information.
Mr Bridges spent $113,000 on Crown limos and accommodation in the past three months, according to information leaked to Newshub ahead of its public release later this week.
The leak raises two obvious question: Who leaked it? And why?
Mr Bridges has fiercely denied the leak came from his caucus, and Prime Minister Jacinda Ardern said an implication the Speaker may have had something to do with it was a "serious allegation".
Before entering Question Time on Tuesday afternoon, Mr Mallard briefly addressed media - an unusual move from the Speaker. He said the leaked information was set out in a different format to that seen by his staff.
"I have established today that the format that the document was in was not one that was supplied to the Parliamentary Library for upgrading or to my office," Mr Mallard said.
"I have indicated that to a number of parties, and [I am] going to take 24 hours and take soundings over whether there needs to be a further forensic investigation as to the source of the document."
If Mr Mallard is correct and his office and the Parliamentary Library were not the source, process of elimination leaves the National Party's own camp as suspect - along with any other bureaucratics who may have seen the expense forms.