There was a DMV clerk around here that got away with stealing money for about a year before it was discovered. It should have been caught within days, but those responsible for checking, as part of their job responsibilities, were pencil whipping the daily reports. It took a lot to figure out the depth of the damage, but that person should have been caught immediately without any type of audit.
If the place were using even minimal controls/oversight, an audit wouldn't have been necessary. Seems like no one above this jackass was paying a lick of attention to invoices for food they didn't serve.