The Aljunied-Hougang-Punggol East Town Council (AHPETC) did not have sufficient internal controls and this exposed it to risks such as the loss of monies or valuables and wrong payment for goods and services, said the Auditor-General's Office (AGO).
The AGO cited issues such as inadequate protection of cheques and safes.
"Cheques received and not banked in by the end of the day were not safeguarded under lock and key," it said.
"All mail, including mail with cheques, was opened in an area accessible to the public. In addition, the mail-opening officer did not maintain a record of all cheques received through mail," it added.
The AGO also noted that AHPETC had not reconciled its bank statements with its records at least once a month, as required by the Town Councils Financial Rules.
In addition, it found a lack of segregation of payment duties.
The AHPETC general manager certified work done and also approved payment vouchers and cheques for the work - tasks that should be segregated.
In response, AHPETC said it has improved its safeguarding of cheques received by mail.
"Cheques not banked in by the end of the day are now placed in the safe. As an additional control, all cheques received are scanned by finance staff into a central server," it said.
Associate Professor Mak Yuen Teen of the National University of Singapore Business School said such internal control issues usually arise in small companies.
"Larger companies find it easier to manage, but for smaller organisations, sometimes you just don't have enough people.
"The key is to make sure you recognise the risk and have compensating controls," he added.