Acme is bound by Bob's actions so long as they were conducted with "apparent authority" from the perspective of Client C and involved his work duties, even if he carried them out contrary to company policy - unless Client C knew for a fact that Bob was violating company policy and didn't have authority within the company to do so when he was doing these things.
Acme, directly, or Acme's insurance carrier, in a subrogation suit after it has settled the claim from Client C, could probably sue Bob, especially if he willfully violated company policy for the purpose of harming client C. This is rarely done, but ultimately Bob owes duties to Acme which he violated which probably give rise to liability, although proving that and collecting the judgment would both be difficult. If Bob had authority within the organization to deviate from company policy, however, which he would have a good cause to claim that he did, this would be a full defense to such a suit, since Bob was always acting as a disclosed agent of Acme.
Client C probably cannot sue Bob directly, whether or not it sues Acme. In contract matters (which this would include) a disclosed agent is not responsible for the acts he carries out on behalf of his principal.
For example, an employee who signs a promissory note on behalf of a company in an official capacity as a disclosed agent of the company isn't responsible for paying the note.
This is different than the rule in tort cases where the principal and anyone whose actions personally caused the tort caused the problem is liable.
For example, if the employee got into a car accident that was his fault while he was driving on the job for the company, both the company and the employee would be liable to the person who was hurt.
The circumstances that you describe sound more like a breach of contract than they do like a tort, so Bob would probably not have any personal liability to Client C.
Could Bob or Acme (or both) face any criminal liability?
Unless Bob was the CEO or other senior officer of the company, Acme wouldn't face criminal liability, because he is too far down the chain of command to cause Acme the entity to have the requisite criminal intent.
Realistically, failing to "verify that equipment rental invoices match delivery records before notifying the client to approve the invoices for payment" does not amount to a crime no matter who does it. This might be careless or a breach of contract, but it is not fraud or theft because it lack the necessary criminal intent.
If Bob actively photoshopped equipment rental invoices with a specific intent to defraud Client C, he would probably be criminally liable for fraud, although even that isn't an open and shut case as it still basically involves failure to perform a contract according to its terms and a mere breach of contract is generally not a crime unless you intended not to perform it in the first place, when you entered into the contract.