If I were advising the employer, I would advise it to pay the money into the plan, with some reasonable interest factor. Probably a breach of fiduciary duty in causing the money to be paid to the wrong person (lack of sufficient internal controls, etc.). The employer can then attempt to collect from the individual to whom it was paid, but the employer should face up to the fact that it may have to suffer the loss if it can't collect.
Here is a secret trick, but don't tell anyone: you can have a new plan effective 12/1/2016 with a 6/30/2017 plan year end. This satisfies the "at least 3 month" plan year rule. And a 6/30 plan year might be nice for a CPA firm.
Does not have to be January 1 but it is too late to start a Safe Harbor Plan for calendar year 2016 as you need 3 months effective deferral to be a 1st year safe harbor plan. Plan would have needed to be in place by September 30th, 2016 for safe harbor.
You can be a regular 401(k) for 2016 with profit sharing or match feature but you are subject to ADP/ACP testing on deferral and match.
You can also use prior year testing for 2016 allowing the HCEs to get 5% of pay plus catch-up for 2016 as prior year assumed to be 3%.
You could set up safe harbor for 2017 or amend regular 2016 401(k) to 2017 safe harbor at the same time as the plan is set up.