State auditor unearths missing security controls at departments.