Poor internal controls.<p>Getting internal security threats like this dealt with requires strong controls and frequent audit. That means 5x or more staff.<p>In the old days, the lotto used ping pong balls to pick numbers and all operations were observed by a third party auditor. IMO, you need physicial processes that can be observed and understood by a layman to have a high level of assurance.