The government is threatening sanctions against the £25,000-a-year Southbank International school in London because it has still not done enough to safeguard pupils following the abuse of at least 54 boys by a teacher, William Vahey.

Describing the case, which emerged in 2014, as “deeply disturbing” and “abhorrent”, a Department for Education spokesperson said the government had issued the elite school with a legal direction to improve and “remains concerned that improvements must still be made”. If the school fails to satisfy officials, the education secretary, Nicky Morgan, could potentially stop it enrolling new pupils or close it down altogether by removing it from the register.

Vahey, an American humanities teacher who worked at Southbank from 2009 to 2013, led pupils on foreign trips and put sleeping pills into biscuits he gave them at the end of the day. The married father of two abused the unconscious children – always boys and typically aged 12 to 14 – and took indecent photographs. When he was exposed in March 2014 after a 42-year career in 10 international schools around the world, he stabbed himself to death.

The government’s warning to the school, which is favoured by foreign diplomats and executives, comes after a serious case review published on Wednesday found Vahey got away by “hiding in plain sight”.

“The fact he worked in so many schools in so many countries, including this one, where we have have a robust child protection system, and still escaped detection is devastating,” said Dame Moira Gibb, a social work expert who led the review.

Southbank International said it had submitted an action plan to the government and was confident that “all safeguarding practice and procedures have and continue to be addressed”. It said it wanted to maintain “an open and productive dialogue” with Ofsted and the Department for Education.

The serious case review found that teachers and school leaders failed to piece together repeated clues about his crimes, which the FBI said made him one of the most prolific sex offenders they had ever seen.

He often altered pupils’ accommodation, insisted on having keys to their rooms, made sexual comments to pupils and cracked sexual jokes that made teachers uncomfortable, slapped boys’ bottoms and gave inappropriately graphic sex education lessons, the review found.

Pupils joked that he was “paedo Vahey” and he talked about pornography with the boys. He even gave slide shows after the trips in which he would show “inappropriate” pictures and tell embarrassing stories with sexual innuendo about pupils. One parent described feeling this was wrong, but did not complain because members of the school management were at the meeting.

The review called for all teachers in England and Wales to receive special training to root out child abusers in their midst.

The authors of the review said training in the modus operandi of sex offenders should be included for the first time in statutory guidance for schools. The Department for Education confirmed it would strengthen statutory guidance for professionals working with children and clarify training for staff.

The review found the school failed to grasp opportunities to stop Vahey and criticised the “low level of understanding of how sex offenders operate, which allowed significant indicators of concern to go unrecognised and unreported”.

The school’s handling of the aftermath of Vahey’s abuse emerging was also criticised as “insufficiently proactive”.

Hundreds of potential victims and witnesses have come forward to assist an ongoing international FBI investigation, which covers Vahey’s 42-year career at 10 international schools in the Middle East, Asia, Latin America and Europe.

The mother of one boy who suspected he was among Vahey’s victims said the school’s failure to do enough to safeguard children almost two years after Vahey’s abuse emerged was shocking and “incomprehensible”.

“You would have expected they would have moved heaven and earth to set things right and that student safety would have been comprehensively safeguarded by now,” the parent said. “It is completely unacceptable that there is still much more to be done.”

Southbank International’s chairman, David Smellie, said: “We will review the report in every detail to ensure any necessary further actions are implemented. The safeguarding of children is an ever-present priority and we will always look at opportunities to further strengthen our practices.”

The school said it had introduced mandatory criminal record checks on new staff in every country they had worked in, created an independently chaired safeguarding committee and placed more stringent reporting obligations on all staff. It said it was “determined to do everything necessary to help our school community to recover”.

Only two or three parents came forward to give evidence to the serious case review and fewer than 10 teachers, the Guardian understands.

Vahey’s abuse was exposed while he was working at the American Nicaraguan school, where a maid stole his computer equipment. His USB drive was loaded with images of naked boys catalogued according to the destination of the school trip on which they were taken, such as India, Nepal, Jordan and Panama.

When confronted, he confessed to using sleeping pills to drug boys. According to an FBI affidavit, he said: “I was molested as a boy, that is why I do this. I have been doing this my whole life.” Vahey then fled to the US and killed himself.

His method of sedation meant his victims often had no idea they had been abused. Scotland Yard detectives had to invite families to come and find out whether their sons were among those identified in Vahey’s images.

“It has been really difficult to navigate,” one parent said. “There is a divide between those who want to support the child in knowing and those that want the child to be protected and not find out.

“My husband didn’t think our son should go, on the basis that you can’t put the genie back in the bottle and not knowing the severity of what is in the photographs – whether it was full sexual assault, touching or nudity.

“I went on my own and had to decide whether to share what I was told with my husband and son. I thought, as the mother who sent him on the trip, I should find out. I had to ask myself: however awful it is, can I live with that?”

A teacher who worked with Vahey at the Jakarta Intercultural school (JIS), where the paedophile taught from 1992 to 2002, said he was “a sick man” who manipulated fellow educators.

“The devastating story of Vahey is incredibly sad, upsetting and painful,” the former colleague added. JIS said it had “robust protocols in place for recruitment, candidate screening and incident reporting” and was cooperating with the FBI.

The serious case review was ordered in September 2014 by the local safeguarding children board of the London boroughs of Westminster, Kensington and Chelsea, and Hammersmith and Fulham.

Shortly after Vahey’s abuse emerged, Sir Chris Woodhead, a former chief inspector of schools and then chairman of Southbank International’s governors, said only one incident had been raised during Vahey’s time at the school and “the boy’s parents agreed that there was nothing untoward”.

But the investigation commissioned by the school found that further concerns had been raised. Teachers on one trip were shocked when a student fell ill and Vahey altered the accommodation arrangements without consulting anyone. The trip leader challenged Vahey, who was “very defensive” and displayed a “horrible, creepy” attitude.

When a boy became unwell on another trip, Vahey was aggressive towards colleagues, adamant that they should all go to bed and that he would look after the child, the investigation found. One teacher said he was so worried that he couldn’t sleep.

“The look on Vahey’s face when he said he wanted to [alter the accommodation arrangement] stayed with me and I found it so weird that I wanted to get in touch with the deputy principal,” a teacher said.

That teacher tried repeatedly to contact the deputy principal but could not get through. She eventually told the then headmaster Terry Hedger that she did not want to go on a trip with Vahey again. Hedger said that was fine and asked no more questions, Davies reported in his investigation.

Hedger provided Vahey with a testimonial that highlighted his travel club activities and concluded: “I thoroughly recommend him for any teaching post.” Hedger has since said he was “desperately sorry”.