The CFO must legally account to the Board of Directors or can be terminated. The records belong to the company, not the CFO. You won't know about crimes until the records are examined, but there is a breach of fiduciary duty on the CFO's part based on the facts you disclose.
The above is general legal and business analysis. It is not "legal advice" but analysis, and different lawyers may analyse this matter differently, especially if there are additional facts not reflected in the question. I am not your attorney until retained by a written retainer agreement signed by both of us. I am only licensed in California. See also avvo.com terms and conditions item 9, incorporated as if it was reprinted here.
What the CFO has done is a breach of her fiduciary duty to the corporation and its shareholders.
The president, pursuant to a resolution of the board of directors, should retain a business litigator to advise the corporation as to how it should proceed.
The CFO may have committed one or more crimes. However, police and the local prosecutor probably would consider this a civil, rather than criminal, matter (they have more-serious crimes to focus on).
This information does not constitute legal advice and does not establish an attorney-client relationship.