Thousands of Bulgarians and Romanians were granted British visas even though immigration officials said they should be turned down, a report says.
Davis: Disgraceful situation
The Home Office over-ruled embassy officials in up to 90% of cases, the National Audit Office estimated.
Promising changes, Home Secretary David Blunkett admitted the system had been "insufficiently robust" and there was "clear evidence of exploitation".
But the Tories said the scandal may be just the tip of the iceberg.
Shadow home secretary David Davis said: "We have only looked at two countries. We haven't looked at a whole number of other areas."
He called for a "root and branch review of a whole series of areas" of the government's immigration policy.
"I am happy to give him (Mr Blunkett) a list," he added.
The NAO report found applicants had entered the UK under the pretence of setting up a business - often submitting fake business plans as supporting evidence - only to find work in the construction industry.
Immigration staff in Bulgaria and Sofia had "grave concerns" the system was being exploited, the report said.
And if they had been left to do their job less than 10% of the visas would have been issued,
But officials in the UK disregarded their advice and staff "were reduced to simply issuing visas on the instruction of the Home Office".
The NAO's David Clarke said there was "no common understanding between the UK visas staff in the country and the Home Office staff back in the UK as to what standard to apply when assessing applications."
Mr Blunkett said the confusion had now been cleared up but admitted it should have been done sooner.
In a separate report, commissioned by the government, civil servant Ken Sutton said there was "clear evidence" that the visa system for eastern European businessmen had been exploited.
But he cleared the Home Office of allegations it had been aware of the scam and failed to act.
And said there was no evidence applications had been waived through to meet asylum targets.
Mr Sutton found nearly 23,000 Romanians and Bulgarians came to Britain on the visas between April 2002 and March 2004 - but he said most were working rather than claiming benefits.
Hughes resigned over the row
Mr Blunkett told BBC News 24: "They came to work. They are working. Only 150 have been given leave to remain.
"The rest we are going to review as they come up for review, to make sure that the new, more rigorous procedure, the re-interpretation of the law actually will apply to them in the future."
From now on decisions on the granting of visas will be taken in the country of application, the Home Office said.
The issue was first exposed when whistleblower James Cameron, the British Consul in Bucharest, wrote to David Davis.
The diplomat is understood to have been disciplined over his conduct.
Mr Davis said both the NAO and the Sutton report demonstrated Mr Cameron, despite being moved from his job, had been "absolutely right".
He added: "If heads are going to roll it should be those who are responsible for the situation. Because this is a disgraceful situation."
The NAO report highlights a number of failings in the way the Home Office operated the European Community Association Agreements (ECAA) visa process which is intended for people who want to set up their own businesses in the UK.
The failings include:
Granting visas to applicants who had entered in the past illegally, or had been refused asylum
At least 150 applicants submitting near identical "business plans" from the same agent and applicants who had "no idea what was in their business plan"
Other applicants not possessing the necessary skills for their alleged business and having no command of English
Romanians and Bulgarians obtaining either a tourist or student visa and then switching quickly to ECAA visas.
There was no feedback to entry clearance staff about whether successful applicants were adhering to the terms of their entry into Britain, for example whether they were setting up the type of businesses they described during the visa application process.
In the Bulgarian capital Sofia the increase in applications was from 63 in 2001/2 to 8,034 in 2003/4 - enough to set "alarm bells ringing".
Controversy over the visa scam led to Beverley Hughes' resignation as a Home Office minister earlier this year.