I used to do Accounts Payable for a large tech company. Any invoice >$5,000 had to be matched to a PO. POs had to be approved by an appropriate level. Payment information was maintained by a separate team and POs were linked to that payee. Nearly all payments were done via ACH; we actively discouraged wire transfers wherever possible by charging ridiculous fees. The payment process itself was also audited daily by the payments team. We also had an entire org of finance people responsible for controllership. This fraud would have been hard, though not impossible to pull off in this system.