The Auditor General has delivered a "red card" to the Scottish Parliament over the handling of its accounts.
Robert Black said he found "key weaknesses"
Robert Black told Holyrood's audit committee there was no evidence of impropriety - although he could not guarantee that there was no fraud.
He said parliament bosses had been given several warnings of shortfalls in procedures and his report was the equivalent of a red card.
At one point last year nearly 300 discrepancies totalled more than £5m.
Mr Black's report into the accounts of the Scottish Parliament Corporate Body (SPCB) was submitted before Christmas and published on the parliament's website.
He gave the all-clear to the accounts for 2002/2003 - but went on to give only a qualified all-clear to the question of whether or not the parliament spent all of its money properly.
Mr Black briefed the accounts committee on Tuesday.
He said: "What I mean in plain terms is that while there was sufficient evidence to confirm that the accounts are not materially mis-stated there were important shortcomings in the corporate body's internal financial controls.
"Specifically these weaknesses in control prevented me gaining sufficient assurance regarding the possibility of accounting errors or even fraud affecting the corporate body's affairs in some way."
He said it was "comparatively unusual" to qualify the accounts of a public body for significant control weaknesses.
He said the step had been necessary "because of the serious potential risks arising".
His report identified "key weaknesses" such as "ineffective" financial reporting and a failure to keep a prompt tally of spending.
The SPCB is responsible for the day-to-day functioning of the parliament and for projects such as the new Holyrood building.
Under questioning by MSPs, Mr Black said there were still no financial instructions of a "comprehensive nature" in place setting out how the accounts should be managed.
Day-to-day financial procedures had been borrowed from the pre-devolution model used at the Scottish Office.
The corporate body oversees the Holyrood project
"It is fair to say that these matters are being addressed very seriously at a number of different levels and I am satisfied that they are being addressed seriously," he said.
Mr Black also told MSPs: "It's very fair to go away from this session with the reassurance that there's been no financial loss and neither has there been any indication that expenditure has been used inappropriately.
"However, I do think that the control weaknesses were serious.
"Controls are not optional but fundamental to the running of any public body and it's reasonable to expect the corporate body to operate to best practice."
The committee will take evidence next month from Paul Grice, the Scottish Parliament's chief executive and the accountable officer for the SPCB's accounts.
In a letter to the committee, he said the SPCB was drawing up an action plan to address the concerns raised in the report.
He said weaknesses in the financial system were mitigated "to a very large extent" by the SPCB's own controls over contracts, invoices and MSPs' allowances.