Failures in ‘fundamental controls’ within Dundee City Council’s financial systems allowed a former employee to steal £1m from the authority, auditors conclude.
IT officer Mark Conway, 52, was jailed for five years last year after stealing more than £1m between August 2009 and May 2016.
The Accounts Commission, whose report into the fraud was published today, found that the extent of the fraud could have been limited if the council had addressed ‘significant weaknesses’ in its invoicing systems.
Mr Conway had unrestricted access to several systems which allowed him to insert fake invoices and alter the bank payment details of suppliers without detection.
‘There were failures in fundamental controls within the council that allowed this fraud to continue over a prolonged period resulting in a loss to the council,’ the report states.
‘In particular, the lack of segregation of duties allowed the perpetrator access to a number of systems, enabling them to carry out the fraud.
‘Internal controls such as system reconciliations were not carried out or were ineffective and as a result the payments were not identified as anomalies for further investigation at an early stage.’
The report found the council acted quickly in response to the discovery of the fraud and brought in more robust management of their financial systems.
Graham Sharp, chair of the Accounts Commission commented: ‘Lessons must be learnt from this serious and prolonged act of fraud.
‘Our role is to provide the assurance people expect that all councils have in place robust checks to ensure public money is properly spent and accounted for.
‘This case provides clear lessons for every council in Scotland. Councils must have fundamental internal controls in place to ensure secure IT systems, and those responsible for using them, must be managed appropriately.
‘Managers in all Scottish councils are responsible for ensuring these arrangements are in place.’
Responding to the report, a Dundee City Council spokesperson said: 'A report considering the Accounts Commission's findings will go before a meeting of Dundee City Council on April 23.
'Following the discovery of this crime, the council has taken action to prevent a fraud of this type from happening again in the future.
'An independent review of procedures has already gone ahead and measures have been put in place to strengthen controls.
'The council has been engaging with Police Scotland to ensure that lessons are learned from the fraud by other local authorities and public sector agencies.
'Dundee City Council was involved in ongoing efforts which ensured that the funds taken from the authority by this individual were fully recovered.'