- you can punish the employee harshly to boost morale among the "good" employees, and to deter future malfeasance; or
- you can offer leniency in exchange for information from the employee that will help you design better safeguards.
The answer depends on whether the value of the information is bigger than the "cost" leniency, in terms of lower deterrence, or morale.
Note that, just like a prosecutor, you should expect adverse selection. Only employees who think the leniency looks like a good option will choose it, and those are the ones who have committed more bad acts. This is just like the adverse selection associated with plea bargaining--pleas are accepted by only those who think the plea bargain looks attractive (those with low chance of winning at trial), e.g.,