Horowhenua District Council's chief executive has been blocking people's emails to the council without them knowing, an internal report shows.
But chief executive David Clapperton says it is flawed and incomplete.
RNZ has obtained part of the audit carried out in March.
In it, "governance concerning the chief executive" and "blocking of emails" are listed as extremely high risk.
It said emails from people or organisations on a black list were blocked by the council's IT team.
Individual emails were sent to council chief executive David Clapperton for his decision on whether to send them on.
But the system was changed in May 2016, so such emails would go directly to Mr Clapperton before being sent to their recipient.
The report showed an email titled "Strictly Confidential" sent to mayor Michael Feyen, who was on the black list, was diverted to Mr Clapperton.
Mr Clapperton said the report was being peer reviewed by KPMG, and was "substandard" and "incomplete".
In an email statement, Mr Clapperton said the council's legal advice was "that if the original (and flawed) internal audit report is circulated, Council is at risk" of legal action.
"The initial finding by KPMG is that certain issues raised by the report are out of scope and should not have formed part of the audit, there is insufficient evidence to support the findings and that there is no extreme risk to Council," his statement said.
"Individual council staff have been identified and have had no opportunity to comment about matters that affect their reputations."
Mr Feyen said he learned of the audit report in May, and had tried to have it tabled at the council, without success.
"I think if people found out that their emails were being interfered with that's definitely a concern, I would've thought," he said.
Mr Feyen said Mr Clapperton has asked him to resign, apparently blaming him for releasing the report. Mr Feyen did not release the document.
In a statement, Mr Clapperton said redirecting the emails was necessary to protect his employees, so they could carry out their roles safely.
He said all parties knew the emails were being re-directed at the time.
Mr Clapperton said the internal audit report was incomplete and therefore it was not appropriate to comment further.