Prosecuting would require contacting an authority that would be willing to take the case, and would also require going public with the fact that one of your "trusted" employees had invalidated your security systems, potentially opening you up to untold amounts of liability from customers who may believe their security has been compromised.
Go ahead, call the cops and media. I hope you have a ton of money on hand and some jewelry stashed away in various locations before you do so.
Why couldn't who prosecute? That's a function of the government; a prosecutor is not obliged to engage in a case (formally, get an indictment out of a grand jury) whenever they believe a crime to have been committed.
Undercover agents at all levels of law enforcement commit apparently criminal acts every day, with no fear of prosecution. There's no reason for this to be any different.