The picture, by an unknown artist, was put up in room 59, which contains works by Rembrandt. It was discovered when two tourists tried to identify it.
The traumatised museum announced late on Thursday - a week after the hoax was perpetrated - that it would investigate what went wrong and make public the results. A former Prado director, Alfonso Perez Sanchez, described the lapse as "an unpardonable and very serious failure" of the museum's security systems.
The stunt has revealed a seething malaise that has long afflicted employees of the museum, which has one of the world's finest art collections.
The 30cm by 40cm fake, signed by "VR Roizo"and depicting a skull, is entitled The Aftermath. Framed in the same gilded style as its fellows, it rested inconspicuously amid a clutch of distinguished Flemish still- lifes. The museum's curator of Flemish paintings, Matias Diaz Padron, said it was "quite well done, the work of a painter of some quality".
The hoax is thought to have been carried out while the museum was closed, prompting speculation that it was an inside job. A security guard reported an extra painting in room 59 on Friday 11 October but the offending work was not removed until the following Tuesday.
A row is raging between security guards responsible for the museum's interior - public employees on the Prado payroll - and those on the doors who are employed by a security company. Those responsible for the interior say they are desperately short-staffed and that the management never informs them of constant changes in paintings' whereabouts caused by an extensive programme of repairs.