The cloud-based platform that Denver uses to track personnel matters for its more than 13,000 employees has lacked adequate and consistent supervision of who has access to the site, according to a Denver Auditor’s report released Thursday.

The audit focused on Workday, a software application that the city used to recruit, train, staff and manage from hiring to retirement. It also helps manage benefits and payroll systems.

“When Workday was implemented two years ago, it was a sweeping change for how we do business internally in the city,” Denver Auditor Timothy M. O’Brien said in a statement. “But in the extensive implementation  efforts, some of the key ongoing quality control steps and organizational oversight of the application controls were missed.”

The 21-page audit states that the city lacks documented policies and procedures on access to the platform. It also found that practices on how new and privileged users are added to the system were inconsistent from one agency to the next.

The report also faulted the city for not doing more periodic reviews as to who has access.

In one instance in the Denver Clerk and Recorder’s office, the audit cited a prospective employee who retained an active Workday account for 90 days after declining a job offer.

It also found instances where the Denver Police Department and the Clerk and Recorder’s office used email approvals to grant access to five users rather than through the platform itself.

The audit also said all city departments should take advantage of existing customer controls within the platform to better control security.

“The City’s failure to implement the customer control considerations increases the risk the City’s data in Workday could be accessed by unapproved users,” the audit states.

In response to the audit, city officials said they have agreed to implement all the audit’s recommendations.

“Technology Services agreed with all the recommendations set forth by the auditor and have already started remediation to develop, implement, and document better processes within the Workday platform, said Denver’s Chief Information Officer David Edinger.