An employee, since terminated, approved more than $200,000 in credits without authorization and, for months, without detection, the report finds.