If he still has them, it’s probably ‘garden variety’ workplace embezzlement.

Make up some sources, pretend to pay them, cash the payments.

He probably just got sloppy, and it got too obvious.