********** issued of company debit card.

I have a business with various accounts linked to it. I gave my GM authority on 2 of these account where she have 2 debit cards to draw money on and transact on these accounts. Nedbank then told me they have to issue het 2 new cards so the sms functionality could work properly. After some time the bank called her to come and collect the cards. There was only 1 card they issued her and when she drew statements on this account she realized this card is not linked to the accounts she has access to. After investigation I realized this card is linked to my main business account with lot of sensitive information where my staff member could do transactions on my company main account. My question is this whoever gave Nedbank the right to issue a company card to somebody without approval, and how many other companies this happens too?