Unemployment agency failed to limit access to sensitive information, audit says