If the PTO is an independent entity, then the PTO should control how funds are used. Does it have its own separate bank account, taxpayer ID, etc.? However, if the PTO acts as a volunteer arm of the school - basically a committee, then the funds might be the school's.
Also, was it clearly communicated how the funds would be distributed from the beginning? Sometimes the PTO/school run a fundraiser as a partnership. Or could it be that the Principal's view is that this was a "school" fundraiser and that the PTO had merely volunteered to run it?
Communication on any school-related fundraiser is very important right from the beginning. Ownership isn't always as clear as each side thinks.