In any case, I recommend that you do a review to verify the validity of the "accusing" employee's claims. They may very well be legitimate, but they may also be "sour grapes". I don't know that you will be able to protect the employee who first told you about this. If you move on this, that employee is going to be suspected regardless. I would recommend that the Board (or Audit Committee) provide a "safe harbor" for employees who wish to report things. Examples, sexual harassment to HR, suspected fraud (or this situation) to the auditor/compliance officer. I hope this helps. Good luck.
_________________________
Opinions expressed are solely my own.