Retired superintendent Dennis Smith engaged in serious corrupt conduct while working as the university's security operations manager, the Independent Commission Against Corruption says in a report.

Commissioner Stephen Rushton SC says Mr Smith could be prosecuted for bribery and giving false or misleading evidence to ICAC.

The inquiry uncovered security guards had, for years, submitted hundreds of timesheets under false identities, slept on the job and sometimes worked 36 hours straight.

In four separate weeks between 2016 and 2018, about $120,000 charged to the university was claimed using the details of ghost guards - some while the person receiving the funds was working a shift at the same time on another campus.

Mr Rushton's report found the university ignored red flags, including a damning 2016 internal audit, and didn't take the steps necessary to prevent corruption.

"Ultimately, while it is difficult to quantify the threat to student and staff safety arising from the corrupt conduct ... the practice of ghosting at the university created the likelihood that campus safety was compromised," the ICAC report released on Tuesday states.

"Shifts for guarding services were not performed, performed poorly or undertaken by fatigued guards."

ICAC said it was difficult to know the precise cost of the scam but estimates "many hundreds of thousands of dollars" were paid between December 2015 and April 2018 out of the $2.6 million Sydney University forked out for "non-standard services".

In one week in October 2016, one security guard claimed 505 hours in extra shifts on top of his weekly wage.

That included nine 10-hour night shifts when guards were booked to support police evicting sit-in protesters from the Sydney College of the Arts and 306 hours in guarding shifts during a subsequent three-day power outage.

That guard, Emir Balicevac, and another employee of Sydney Night Patrol, Frank Lu, also pitched in for a $10,000 Spider-Man pinball machine Mr Smith received as a reward for using his position to favour the interests of the security subcontractor enabling the scam.

The commission found both the contracted security firm SNP and subcontractor SIG made about $4 to $7 per subcontracted hour.

SIG owner-manager Taher "Tommy" Sirour financially benefited from the scheme and gave weekly cash payments - increasing from $300 to $500 - to the most senior SNP guards at Sydney University.

The commission was satisfied Mr Sirour footed the bill for Mr Smith's $425-a-night stay at the Shangri-La Hotel and a $370 dinner in October 2015, and offered other inducements over time.

The ICAC found Mr Sirour also paid up to 80 per cent of his staff in cash using a shell company set up by a friend, likely to avoid GST, payroll tax, workers compensation premiums and basic employee entitlements.

The commission said Mr Sirour, who moved to Egypt in March 2018 and denied he broke laws, should be considered for charges over alleged fraud, tax evasion and bribery.

Charges should also be considered against Mr Balicevac, Mr Lu, SNP employee Daryl McCreadie and SIG guard George Boutros.

Mr Smith resigned days before ICAC's public inquiry in February 2019.

He joined Sydney University in 2012 having been medically discharged from NSW Police in 2005 after 26 years of service.

Sydney University said it had anticipated many of ICAC's 24 recommendations and had made significant improvements to contract and risk management processes.

It has yet to receive any complaints to indicate students or staff were at increased risk due to the scam, but steps have been taken to prevent a similar situation happening again, a university spokeswoman said.

SNP in a statement said the behaviour of a small number of its employees was regrettable and not representative of the organisation. Changes since 2018 include a confidential system for whistleblowers.

Australian Associated Press