The employer and the friend created an Agency Relationship. To establish consent, the principal (owner) must ask the agent (their friend) to do something in which they agree to do so. Principals are held accountable for their agent's actions because they have controlover them. If principals tell their agents to do something, it is only fair for the principal to take responsibility for whatever happens. Since the agent breached his duty, it is possible for the agent to recover from any of the damages caused. The agent might have to pay back the principal over time for buying too much from the vendor. Or if the agent breached their duty of loyalty and profited from the vendor, then they must turn over all their earnings. It is also possible, that if the agent violated their duty of loyalty, that the principal can cancel or revoke the transaction. So, I believe the agent would be held accountable and not the employer (principal) due to the fact they breached their duty of loyalty and duty to obey instructions and therefore would have to either compensate or reimburse the employer.