What's missing is that before each credit card bill is paid, it is reviewed by someone else, preferably the supervisor and someone from accounting. The problem in a small organization is that there are not many levels of people to successfuly do this.
It's hard, no one really wants to question the people they work with, especially volunteers.
There is something called the fraud triangle. You need three things:
1. Opportunity to steal
3. Rationalization, or the ability to justify the theft