Not as many loopholes as you would think to be honest and it’s really not a ‘policing’ knowledge base that would find the ones she’d need. Essentially everything has to be substantiated to the HMRC as a functional operation of the business.
Say she put through Jo’s salary as full time to the CIC, but Jo spent most of her week running PTWM. That would then be fraud as Jo isn’t a full time operative within the CIC, she could only claim a directors salary for the hours she can prove are necessary. The same goes for Rachael.
I would say their books are in a right old state and that’s why she’s taken the 6 months extension. Without external funding, this will be an expensive project and the money she spends will all have to have a back trail from where it came, which will most likely also be taxable income. If it’s not 100% legit, she’ll be doing ever decreasing circles until she has to face consequences for what seems like a money pit idea.