The local authority watchdog sounded the warning to Scotland’s local leaders following the theft at Aberdeen City Council.
Michael Paterson, 59, set up an internal pathway at the local authority which allowed him to fraudulently issue council tax refunds into his own bank account.
Between 2006 and 2023, Paterson, who was employed as a council tax and recovery team leader, issued 622 refunds totalling £1,087,444.
READ MORE: Scottish council employee accused of embezzling more than £1 million
He was jailed for four years at the High Court in Edinburgh in July after pleading guilty to a charge of embezzlement.
The theft was not stopped until another staff member became suspicious in September 2023 and alerted the council – nearly two decades after he began defrauding his employer.
Aberdeen City Council has said it expects to recover all the funds, meaning taxpayers will not be out of pocket.
But the Accounts Commission, which made the warning to Scotland’s 32 local authorities in its latest report, said it remains concerned that Aberdeen’s controls for fraud were not adhered to and lacked proper scrutiny.
The watchdog said while the local authority acted quickly to identify improvements to its system, it still needs to complete some of them.
The Accounts Commission warned councils they must learn from the fraud in Aberdeen.
It said officers and councillors have a duty to safeguard public money and protect against fraud.
READ MORE: Scottish shopping centre announces it will shut down in just 12 days
“At the heart of this is having and implementing effective systems and checks to monitor, manage and review financial systems,” the watchdog said.
“They must also act on recommendations from internal and external auditors to address identified weaknesses and risks in key processes.”
Andrew Burns, deputy chairman of the Accounts Commission, urged councils to ensure the rules against fraud are being followed.
He said: “This is a cautionary tale. All councils in Scotland need to learn from this prolonged and significant fraud.
“It isn’t enough to have controls to counter fraud; checks need to be followed, weaknesses identified, and routine testing of systems carried out. This case shows the risks when internal controls aren’t followed.
“The member of staff who identified and spoke out must be praised. It shows the value and importance of whistleblowing policies and procedures.
“These are critical to ensure staff across the public sector have the confidence to quickly escalate concerns if they suspect fraud.”