Police body caught up in damaging credit card scandal years after internal auditors red-flagged flaws in the claims regime