Here’s how I would handle this:
1. If I knew for a fact that a fellow employee was embezzling from the company, and not just being slopping with receipt matching and expense reports, then I’d turn him in and hope the company would fire him. I don’t want to associate with criminals, and I won’t be tarred with their brush. I know without even asking my colleagues that they’d have the same attitude, whether or not they would actually attempt or want to find out the truth about such an event.
2. If the cash box has been unbalanced “for months”, and the receipts haven’t been replaced to balance out the checks to cash, then the first thing that I’d expect is that this is just very loose and sloppy accounting. There’s a reason that cash boxes are called “lockboxes”: they should be locked or at least kept under tight control. Okay, the fact that only you and one other person have access indicates relatively “tight” control, at least in terms of who can access, but this accounting has to be reconciled periodically. For this condition to go unreported “for months” is negligence. Whether that is “criminal negligence” may be an open question.
I would suggest to a superior that you have concerns about the lack of reconciliation, and suggest that either he control access to the cash box and demand receipts to balance every cash outlay, or that he assign EITHER you OR your colleague with that responsibility, and demand a reconciliation statement at least monthly. (And it wouldn’t hurt to suggest that he should pick you, for bringing this to his attention and for making the suggestion.)
An audit at this point would be embarrassing, but would be as likely to paint you as the negligent party as well as (or maybe even instead of) the other person. If you tell the boss, “the box is out of balance”, and here’s what I think needs to be done in the future, then there’s no surprise any more, and at least you’re up front with a suggestion and willingness to take responsibility.