Presumably, they have the transaction data from the software, and the transaction data is saying he's lying. Software bugs are perfectly capable of creating bad transactions (i.e. by converting currencies incorrectly, double-submitting transactions, failing to actual cancel orders if the user cancels, etc).
In those cases, the presumption is that the software is working correctly. Those transactions are deemed legitimate because the software is presumed to be working correctly. That is the evidence against Bob; an "infallible" transaction registry that says he's embezzling.
If you are Bob, you have to prove that those transactions aren't legitimate, and never actually occurred. Or that they did occur, but the actual amount transacted was less than what the computer recorded. In essence, Bob is fucked, because he has to prove that something didn't happen. Probably something that he wasn't even there for (since presumably other employees would have handled the actual transaction).
