The State Services Commissioner says the Security Intelligence Service failed to provide a professional security service in its vetting of a former top defence official.
A Court of Inquiry found last year that Stephen Wilce, who had top-level security clearance for five years, had been dishonest about his qualifications.
Mr Wilce had been the Defence Force's chief scientist and head of the Defence Technology Agency. He resigned in September last year.
The Defence Force took responsibility for not properly checking Mr Wilce's CV.
However, State Services Commissioner Iain Rennie has reviewed the court's findings and a report his office commissioned and found that the SIS also failed.
Mr Rennie says the SIS did not consult overseas counterparts about Mr Wilce, did not follow up on his failure to disclose convictions and did not check information received about Mr Wilce after his appointment.
SIS failure embarrassing - PM
Prime Minister John Key says it is a little embarrassing for the Security Intelligence Service that they failed in their duties regarding Mr Wilce.
Mr Key, who is also the Minister for the SIS, says they were fairly basic mistakes.
"They just didn't follow up on all the leads they had. They should have made phone calls, they should have asked more questions and they didn't. I think it's a little embarrassing."
Mr Key says vetting procedures will be reviewed and a check done on other top-secret vetting carried out at the same time as Mr Wilce's.