Warning that schools are vulnerable to fraud during the pandemic when internal controls 'may have slipped'