Weak invoicing systems allowed Dundee IT worker to embezzle over £1 million

Failures in "fundamental controls'' within Dundee City Council's financial systems allowed an employee to embezzle more than £1 million in almost seven years, a report has found.

The Accounts Commission report states the extent of the fraud, carried out by IT worker Mark Conway between August 2009 and May 2016, could have been limited if the local authority had addressed significant weaknesses in its invoicing systems.

Conway, who was 52 when he was jailed for more than five years in August last year, had unrestricted access to several systems which allowed him to submit fake invoices to the council with the names of genuine suppliers but giving his own bank account details for payment.

The fraud totalled £1,065,085 resulting from 57 transactions to two bank accounts, with payments ranging from £6,000 to more than £27,000.

The scheme was discovered in May 2016 when, as part of the council's year-end procedures, an invoice for £7,337 was highlighted where supporting information could not be found.

Finance staff notified senior management and Police Scotland were then called in.

The report states: In particular, the lack of segregation of duties allowed the perpetrator access to a number of systems, enabling them to carry out the fraud.

"Internal controls such as system reconciliations were not carried out or were ineffective, and as a result the payments were not identified as anomalies for further investigation at an early stage.

"On discovery of the erroneous payment the council acted promptly to deal with the individual and reporting the fraud to Police Scotland.''

The report said the council has since addressed the issues that led to the fraud, bringing in more robust management of their financial systems.

Since 2016 it has taken significant steps to improve its resilience to prevent future fraud and corruption, it found.

Graham Sharp, chair of the Accounts Commission, said: Lessons must be learnt from this serious and prolonged act of fraud.

"Our role is to provide the assurance people expect that all councils have in place robust checks to ensure public money is properly spent and accounted for.

"This case provides clear lessons for every council in Scotland.

"Councils must have fundamental internal controls in place to ensure secure IT systems and those responsible for using them must be managed appropriately.

"Managers in all Scottish councils are responsible for ensuring these arrangements are in place.''

A Dundee City Council spokesman said: A report considering the Accounts Commission's findings will go before a meeting of Dundee City Council on April 23.

"Following the discovery of this crime, the council has taken action to prevent a fraud of this type from happening again in the future.

"An independent review of procedures has already gone ahead and measures have been put in place to strengthen controls.

"The council has been engaging with Police Scotland to ensure that lessons are learned from the fraud by other local authorities and public sector agencies.

"Dundee City Council was involved in ongoing efforts which ensured that the funds taken from the authority by this individual were fully recovered".