I'm not in HR, but I believe that the disciplinary descision should be HR, to ensure consistancy with the bank policies and procedures. If there was a violation of policy, there may be a need for bank counsel to be involved.
There is a difference in training and expertise required for the different positions. Audit and security are trained to identify the weaknesses which allowed the fraud to occur, HR is the area that handles all other aspects of employee relations.
Integrity. With it, nothing else matters. Without it, nothing else matters.