---
title: "Aberdeen £1.1m fraud: what COSO says went wrong"
description: "An employee diverted 655 council tax refunds over 17 years. The Audit Scotland release read through COSO, with a five-question check for small firms."
url: "https://staging.khoi.co.uk/en/blog/gian-lan-hoan-thue-aberdeen"
lang: en-GB
author: "Lê Quốc Khôi"
date: 2026-11-03
updated: 2026-11-03
topics: ["Ethics & corporate governance"]
tags: ["Internal control", "COSO", "Fraud prevention", "Whistleblowing", "Public sector audit"]
---

# The £1.1 million fraud: where internal control broke

## Key takeaways

- According to Audit Scotland (9 January 2025), between 2006 and 2023 an Aberdeen City Council employee transferred 655 council tax refund payments, £1.109m in total, into his own bank account (Audit Scotland (Accounts Commission), 2025).
- The Accounts Commission found that a system of controls existed but was not adhered to and lacked scrutiny. A colleague reported their suspicions in September 2023 (Audit Scotland (Accounts Commission), 2025).
- COSO requires each component of internal control to be "present" and "functioning" (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 8). On my reading, Aberdeen had controls that were present but not functioning.
- The release does not say which specific control failed. The five-question check and the firm called "Company X" are my own reasoning and a hypothetical example.

For 17 years an employee of Aberdeen City Council in Scotland moved 655 council tax refunds into his own bank account. The council had a system of controls. If you are a finance manager or an SME owner who feels safe because the procedure is written down, the question this case leaves you with is: who checks that people follow it?

## What did Audit Scotland publish about the Aberdeen case?

On 9 January 2025 Audit Scotland, Scotland's public audit body, published a news release about a report from the Accounts Commission. According to the release, between 2006 and 2023 a council employee transferred 655 council tax refund payments, £1.109m in total, into his own bank account. In September 2023 another member of staff became suspicious and alerted senior colleagues. As of that release, the council expects to recover the money, with no loss to the taxpayers whose accounts were affected (Audit Scotland (Accounts Commission), 2025).

The Commission said it was concerned that the council had a system of controls, but they were not adhered to and lacked scrutiny, so the conduct went unnoticed for nearly two decades. The council acted quickly to identify improvement actions and took immediate steps. Even so, as of 9 January 2025, a year after the perpetrator was charged, the Commission said the council needed to increase momentum on the actions still outstanding (Audit Scotland (Accounts Commission), 2025). I have not checked what has happened since. A short record of the case is at [the Aberdeen case](https://staging.khoi.co.uk/en/case/aberdeen-council-fraud).

From those two figures I work out an average of about £1,700 a payment and about 38 payments a year, roughly three a month. The division is mine; the release does not say whether the payments were similar in size.

The release does not say which department the employee worked in, how each payment was approved, or which control was bypassed.

## When does COSO call a control system "effective"?

COSO, the Treadway Commission's committee of sponsoring organisations, defines internal control as a process, carried out by the board, management and other personnel, designed to give reasonable assurance that objectives for operations, reporting and compliance are met (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 3). Two details in the definition are worth keeping: it is carried out by people, and is not just manuals and forms, and it gives reasonable assurance, not absolute (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 3).

> **Figure:** [COSO internal control framework](https://staging.khoi.co.uk/en/framework/coso-internal-control) The five components of internal control (redrawn from COSO, 2013).

To conclude that a system is effective, each component and relevant principle must be "present" and "functioning", and the five components must work together. COSO explains "present" as existing in the design and implementation of the system, and "functioning" as continuing to exist in day-to-day operation (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 8). Where a component has a major deficiency, the organisation cannot conclude the system is effective (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 8). COSO also writes that an effective system demands more than rigorous adherence to policies and procedures: it requires judgement (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 1).

## What does the release show for each component, and what does it leave out?

The table sets each COSO component beside what the release says. The middle column comes from the release; the right-hand column is my own questions, not the Commission's conclusions.

| COSO component | What the release says | What it does not say |
|:--|:--|:--|
| Control environment | Controls were "not adhered to"; Andrew Burns, the Commission's Deputy Chair, says checks need to be followed | Why they were not followed: too few people, habit, or no one asking |
| Risk assessment | No detail | Whether the council treated refunds as a fraud-prone area (COSO principle 8 is about considering the potential for fraud (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 7)) |
| Control activities | A system of controls was in place | Which ones: approval, reconciliation or segregation of duties |
| Information and communication | One member of staff became suspicious and alerted senior colleagues; Burns praises them and calls whistleblowing policies important | Through which channel, and why no one reported in 17 years |
| Monitoring | Controls lacked scrutiny; routine testing of systems is needed, and recommendations from internal and external auditors must be acted on; improvement actions are still outstanding | What earlier audits had seen |

On my reading, control activities and monitoring are the two rows the release speaks to most directly: controls existed but did not run, and no one checked whether they ran. Risk assessment and the control environment are close to blank, so I draw no conclusion there.

## Why does having a control not stop the loss?

Because present is not the same as functioning. On my reading, Aberdeen is a case of a control that was present on paper and not functioning in practice. A preventive control that is not followed prevents nothing. A detective control that nobody runs detects nothing. COSO writes that control activities may be preventive or detective and include approvals, verifications, reconciliations and business performance reviews (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 4).

This differs from [Macy's hidden delivery costs](https://staging.khoi.co.uk/en/blog/macys-vuot-kiem-soat-chi-phi), where the control was designed without allowing for someone who sidesteps it. The site's [three types of control activity](https://staging.khoi.co.uk/en/framework/control-activity-types) table lists the weakness of preventive controls as being defeated by [override](https://staging.khoi.co.uk/en/glossary#management-override) or collusion, and of detective controls as arriving late. COSO also names override and collusion as limits of any system (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 9). The Aberdeen release mentions neither. What it describes is a duller kind of failure: controls existed, nobody checked them, and the years went by.

## What should an SME check this week?

The example below is entirely hypothetical; "Company X" and every detail are my invention and belong to no real business. Company X distributes agricultural supplies, has 40 staff in Can Tho, and refunds about 40 deposits or overpayments to dealers each year. One accountant creates the refund voucher, enters the receiving account number and also reconciles the ledger at month end. The owner looks at total spend each month. Five questions show where the gaps are:

| Question | Sign that something needs fixing | What to do | COSO component |
|:--|:--|:--|:--|
| Who creates, who approves, who enters the receiving account number? | All three are one person | Separate them; if the firm is too small, the owner approves every refund that involves a changed account number (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 4) | Control activities |
| Does the receiving account match the dealer's file from before the refund request? | No one compares | Each quarter, sample 10 refunds and compare with the dealer contract | Monitoring |
| Who reads the exception list, such as repeated refunds to one account? | There is no list | The owner or someone outside accounting reads it monthly | Risk assessment, monitoring |
| Whom does a staff member tell if the concern is about their own manager? | The only route is up to the department head | An email address or phone number for the owner, written in the staff rules | Information and communication |
| When did anyone last check that these steps are really done? | Nobody remembers or recorded it | Record the date and the checker's name; if there is none, start with a 10-refund sample | Monitoring |

The five questions and the "what to do" column are my own way of applying this, not a recommendation from COSO or Audit Scotland. The 10-refund sample per quarter is a number I chose for illustration; no source says that sample size is enough. This suits a firm with one cash-out step that a single person handles end to end. It does not suit one where an independent auditor already tests exactly that step, or a firm of a few people in which the owner already approves every payment.

The fourth question ties to the most useful detail in the release: the case came to light because a colleague spoke up, and Burns says this shows the value of whistleblowing policies (Audit Scotland (Accounts Commission), 2025). A [whistleblowing channel](https://staging.khoi.co.uk/en/glossary#whistleblowing-channel) works only if the person speaking knows whom they are speaking to.

## Going deeper: what did I read, and what could I not check?

I read the whole Audit Scotland news release of 9 January 2025. It links to the Accounts Commission's full report; I did not use that report, and I read no document from Aberdeen City Council itself, so this post cannot say which specific control was bypassed. The library's case card also says segregation of duties was lacking; that is not in the release, so I did not use it.

For COSO I read the Executive Summary (May 2013), a free download from COSO's site; page numbers in this post are the summary's own. I did not read the full Framework and appendices, which are sold separately. The summary names only two properties of control activities, preventive and detective (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 4). The library's three-types table adds a third, corrective, and cites COSO 2013; I could not find it in the summary, so I did not use it.

Three limits. First, this is one case from the Scottish public sector, not a private company, and no data here says how common such cases are. Second, "present but not functioning" is my reading of a short release; the Commission has not used those words. Third, Company X and the five questions have not been tested on any real business.

## Frequently asked questions

### Does good internal control stop all fraud?

No. COSO says internal control gives reasonable assurance, not absolute assurance, and among its limitations it lists management override and collusion between people (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 9). In Aberdeen the release mentions neither; it says controls existed but were not adhered to and lacked scrutiny (Audit Scotland (Accounts Commission), 2025).

### Was segregation of duties the main cause of the Aberdeen fraud?

The release I read does not name which control was bypassed, so I do not claim that (Audit Scotland (Accounts Commission), 2025). COSO says segregation of duties is typically built into the choice and design of control activities, and that where it is impractical management selects alternative controls (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 4). In a small firm the alternative is often the owner approving sensitive items personally.

### Who checks the controls in a firm with no internal audit?

COSO says a smaller entity's system may be less formal and less structured and still be effective (Committee of Sponsoring Organizations of the Treadway Commission, 2013, p. 2). It does not say who should check. My own suggestion is the owner or someone outside the cash-handling team, sampling documents on a schedule and recording the date and the checker's name.

### Why did the fraud go unnoticed for 17 years?

The release gives no mechanism. It says only that controls were not followed and lacked scrutiny, so the conduct went unnoticed for nearly two decades, and that a colleague reported suspicions in September 2023 (Audit Scotland (Accounts Commission), 2025). Any more specific explanation, such as the smallness of each payment, is my guess.

## References

- Audit Scotland (Accounts Commission) (2025) *£1 million fraud at Aberdeen City Council sends a warning across local government*. News release. Available at: https://audit.scot/news/%C2%A31-million-fraud-at-aberdeen-city-council-sends-a-warning-across-local-government.
- Committee of Sponsoring Organizations of the Treadway Commission (2013) *Internal Control – Integrated Framework*. Available at: https://www.coso.org/guidance-on-ic.

---

Canonical HTML version: https://staging.khoi.co.uk/en/blog/gian-lan-hoan-thue-aberdeen