Actually both. The larger, more recent incident was due to lack of controls, but I consider the non-existence of employee account review in that statement also. It could have at least served as a second, if not third line of defense or detection when the primary controls were not properly carried out.
I did however have at least 2-3 other situations at my previous f/i that were not necessarily preventable through internal controls. One case for instance, was a Sr. L/O personally lending money to a large cml borrower to payoff a non-accrual loan. Further investigation led to some other not so up-n-up transactions.
A second case was an employee who had borrowed money from an elderly, fairly incompetent person on several occasions. The she decided to take the money from the customers account without asking on several occasions.
A third case involved depositing money orders purchased at another f/i by forging his/her grandmothers signature on checks drawn on that bank. They would deposit the money orders and then write a check a few days later off of their own account to pay back the grandmother. I have to admit unless the employees mother also worked at the bank we might not have uncovered this whole story.
A fourth case involved a bookkeeper that refunded herself and her brother in-law nsf fees charged to their accounts. We first noticed hers and more research brought up the other account.
I agree controls are your first and best defense, but they are never guartanteed. The larger the bank the more stringent your controls should become, but you have to consider efficiencies also. One compensating control I found to be effective when other controls are no longer efficient is an automated effective review of employee accounts. I have also found that a separate disclosure to all employees annually reminding them their accounts will be reviewed, along with the requirement to provide a list of all accounts to which they have access, can serve somewhat as a deterent. I implemented that requirement after we started finding several issues at the prev f/i and at my current f/i when I first accepted employment to implement the audit department. The looks you get from some when they are asked to complete the form and return to I/A can also be scarry...