When a Philadelphia grand jury slammed Visit Philadelphia in a March 16 report for quietly settling a $200,000 embezzlement and failing to go to prosecutors, the tourism agency claimed it had little choice.

Board chairman Manuel Stamatakis said the alleged embezzler, Joyce Levitt, offered through her lawyer to repay what was taken provided that the agency didn't go to the police. Had the agency reported the theft, Levitt likely would have spent all of her money on legal fees, leaving nothing for the agency.

But the tourism agency had another option.

Stamatakis now acknowledges Visit Philadelphia had enough insurance to reimburse it for the loss. He said the agency chose not to collect on its policy because Levitt was offering to pay immediately and it was unclear how quickly its insurers would pay.

"We were unsure how long it would take to get the money from the insurer," he said. "If the insurance company said you could have the check tomorrow, then it would not have mattered."

If Visit Philadelphia had chosen that course instead of keeping the matter quiet, it surely would have avoided or at least blunted the firestorm of criticism that enveloped the agency after the secret settlement was disclosed in an Inquirer article on June 7, 2014.

On March 16, a Philadelphia grand jury report described the settlement as a "cover up" and heaped scorn on its president and CEO, Meryl Levitz for failing to properly supervise Levitt and institute basic checks that would have helped the agency detect the thefts.

"It is the grand jury's view that VP allowed Levitt to resign in order to avoid having to answer to the taxpayers that Levitz's negligence allowed Levitt to steal from VP through her corporate credit card," the grand jury said.

The law offers little guidance to nonprofits and others on what to do when a theft is discovered. While individuals and institutions may have moral or ethical reasons to report a crime, there typically is no legal responsibility.

That was the advice that Visit Philadelphia's outside counsel, William Winning, gave when the agency negotiated its settlement with Levitt.

"This is a world where there are very few bright lines," said Joseph Lundy, a nonprofit lawyer at Schnader Harrison Segal & Lewis. "There are a lot of judgment calls that turn on specific facts."

But experts on charities and other nonprofits say institutions run a huge risk when they fail to go public with findings of fraud and theft, and the case of Visit Philadelphia shows why.

When the theft was disclosed, the agency was subjected to a double helping of public opprobrium: for failing to detect the misappropriation of funds over a period of years and then for covering it up.

Levitt was charged with theft, forgery and fraud on March 16, the day the grand jury report was issued.

"There are always exceptions but in most cases there would be a moral and ethical obligation to report" an embezzlement to law enforcement, said Tish Mogan, an expert on nonprofit governance and ethics at the Pennsylvania Association of Nonprofit Organizations. "It prevents the person from going to the next place and doing the same thing all over again.

"If an embezzlement or fraud happens, the tendency is to do exactly what Visit Philadelphia did because they don't want the black eye," Mogan added. "The risk is that it could come out later when the damage is worse."

Don Kramer, a lawyer at Montgomery McCracken Walker & Rhoads LLP, said nonprofits increasingly are reporting thefts to authorities because of the reputational harm when cases are quietly settled and information leaks out later. Moreover, they are required to report thefts over a certain threshold to the IRS, which Visit Philly did.

"There are many more people reporting thefts to law enforcement because they have to disclose that on their tax returns and because they want to reassure the public that they have done what they could to get the money back," Kramer said.

There's another reason to go public once evidence of theft emerges, said Philadelphia insurance broker Jim Domenick, who specializes in nonprofits. Most policies require that agencies report evidence of embezzlement immediately and failing to do so could prevent the agency from collecting, if it reverses course and decides to seek insurance coverage.

"I always tell people 'don't try to hide anything; you are better off disclosing,' " Domenick said.

Stamatakis now says that, given the public outcry, he wishes the agency had gone public once it had confirmation the funds were missing in 2012.

"We agonized over this," Stamatakis said, acknowledging that Visit Philadelphia had enough insurance to cover the $200,000 theft. "But because of all of this [public reaction] to do it is not worth it."

The grand jury said that Levitt, over a period of years, habitually had failed to document her spending in expense reports and at times even failed to file them. And while Levitt had not documented her spending, Levitz failed to follow through on her responsibility to monitor the CFO's expenses.

In an editorial board meeting at the Inquirer, Levitz said she couldn't be expected to focus on the details of the CFO's expense report and that checking that information was the job of the agency's auditors.

But the grand jury said it was her responsibility.

"Clearly, Levitz was not consistent in making sure that Levitt follow the credit card policy as it appears that Levitt was able to charge thousands of dollars of personal purchases to her corporate credit card without Levitz's knowledge for years," the grand jury said. "During her testimony, Levitz never admitted that Levitt's misappropriation went unnoticed for years due to her own negligence."