The Dunedin City Council is being criticised for not picking up the Citifleet fraud sooner than it did.
A Deloitte report into the council's missing fleet vehicles has found a long-standing head of Citifleet, Brent Bachop, apparently responsible for more than $1.5 million of fraud.
It also found huge pitfalls in the city council's culture and processes and said that enabled the fraud to occur.
Listen to the story
The council called in Deloitte in May to find out how many vehicles it actually owned in its Citifleet and Citipark departments. It went to police in August.
Mr Bachop suddenly died in May and the police investigation into the fraud is continuing.
The report covered deposits of $349,000 by Mr Bachop that were most likely from the sale of vehicles. The report said many other sales were cash transactions.
In one case, a cheque made out to the city council for the sale of a car was overwritten to change the payee name to Mr Bachop's.
The report also detailed how he transferred vehicles to his own name and sold them on, including some to fellow staff and councillors.
Dunedin Mayor Dave Cull said the only employee involved in the fraud was Mr Bachop.
"Deloitte have concluded that there was no other staff member that benefited financially from the fraud," he said.
"There were control failures and responsibilities but it was clear there was only one perpetrator in the council."
Deloitte also found severe failings at the city council over the 11-year period, saying a number of aspects of the council's culture allowed long-term fraud.
It said the processes for accounting for and monitoring fixed assets were severely deficient and there was little oversight of Mr Bachop.
Mr Cull admitted there were serious failings.
"Deloitte's review has identified control failures - lamentable ones, appalling ones - and anything that was detected, anything any of those control failures that were identified are either being dealt with or have been dealt with now."
Dunedin City Councillor Lee Vandervis said he tried to blow the whistle on the scam years ago.
"Most of the issues in the Deloitte report had been known about for many years. Certainly as far back as 2011 and nothing was done about it."
Local Government New Zealand President Lawrence Yule said it was beyond belief that the council allowed this to happen for so long.
"It is astonishing. It is pretty damning around the council processes that allowed that to occur," he said.
"They can get away with these types of things and I think that's it's really important that there's proper auditing and reporting processes."
He said this would serve as a warning to other councils.
"While 99.9 percent of staff will be honest and very hard working, every now and again one doesn't have the same code of practice and, if it's not checked, things can happen, just like what's happened here."
Jim Harland, the former chief executive of the city council, was in charge from 2000 until early 2011 - the majority of the time Mr Bachop was apparently committing the fraud.
He hung up on Radio New Zealand and did not return any further calls.