A controller moved $26 million over seven years behind falsified records. Who reconciles the accounts matters as much as who approves the payments.