Mark Conway, an IT expert who had worked for the council for more than 30 years, was able to make numerous payments to himself between 2009 and 2016, totalling £1.065m. He was jailed for five years and four months last year after the fraud was uncovered in June 2016.

The subsequent investigation identified 57 fraudulent transactions with payments to two bank accounts. These accounts were different accounts from the one Conway’s salary was paid into.

The report said Conway combined his knowledge of the systems, and his system access privileges, to insert fake invoices into the purchase ledger for payment. These invoices appeared to have come through an interface from a subsystem and were payable to known suppliers. The subsystems did not record these transactions.

He was also able to intercept these fake invoices and divert payments to bank accounts within his control. A genuine payment to the same supplier would not be intercepted, resulting in suppliers being paid as normal.

The report found there were failures in fundamental controls within the council that allowed this fraud to continue over a prolonged period resulting in a loss to the council. In particular, the lack of segregation of duties allowed the perpetrator access to a number of systems, enabling him to carry out the fraud. Internal controls such as system reconciliations were not carried out or were ineffective and as a result the payments were not identified as anomalies for further investigation at an early stage.

The report found that the council acted quickly in response to the discovery of the fraud, and has since addressed the issues that led to the fraud and brought in more robust management of their financial systems. Since 2016 it has taken significant steps to improve its resilience to prevent future fraud and corruption.

Graham Sharp, chair, Accounts Commission said: ‘Lessons must be learnt from this serious and prolonged act of fraud. Our role is to provide the assurance people expect that all councils have in place robust checks to ensure public money is properly spent and accounted for.

‘Councils must have fundamental internal controls in place to ensure secure IT systems, and those responsible for using them, must be managed appropriately. Managers in all Scottish councils are responsible for ensuring these arrangements are in place.’

Dundee council has made full recovery of the loss, excluding the policy excess of £10,000 and fees of £8,663, via a range of methods, including an insurance claim, Conway’s pension and an ex gratia payment from a third party, believed to be a gambling company with which he had an account.

2016/17 Audit of Dundee City Council Report on a significant fraud is here.

Report by Pat Sweet