I think the general rule is that if the amount that the person is embezzling is less than the anticipated PR cost to the organization (of the embezzlement being public knowledge), then the organization will seek to not draw attention to it.