"You can make it clear the IRS can be brought in to examine the banking flow."

Yes, their is probably a breach of their compliance process and operational control but I'm not sure if that really gives the IRS or other regulators cause to do a wholesale audit of the credit union, especially since the transmittal originated from the IRS, which is a legitimate source.