The security company aren't without blame here. It's not hard to have a register of the fake bombs you left planted around, and making sure you pick them all up at the end of the day. Especially somewhere you know it's going to cause a massive fuss like a 75k seater stadium.
Thing is, even if we're saying the rag security should have found it on a sweep prior to the game - football stadiums are massive places. How in depth are these searches supposed to be? I bet doing a full nook and crannie search of the Etihad would take weeks. The searches are only ever going to be as good as is practically feasible. The main problem here is clearly no-one said "We put 5 fake bombs around the ground.. We've only got 4 back..We should find the other one before we fuck off to the pub".