It also challenged the contention by Navy officials that the Rapidgate program amounted to a money saving move because of the fees paid by contractors for credentials.
"The cost reportedly absorbed by contractors to obtain Rapidgate credentials are transferred back to the Navy in the form of higher contract overhead costs and other contract fees," the audit said, adding that the lack of transparent accounting meant that the Navy "is unable to account for actual NCACS-related charges from contractor companies."
For example, it said, the Navy incurred NCACS-related charges of at least $1.28 million for 17 of the more than 30,000 contractor companies enrolled in the program.
In a statement Wednesday, Eid Passport CEO Steve Larson said the company welcomed audits and "looks forward to working with the Department of Defense to further refine and advance the world's best high-assurance identity management solution."
The statement contained no direct response to specific findings of the audit.
Hagel ordered a worldwide review of physical security measures at all U.S. military installations following Monday's shooting.
The Pentagon also is expected to review security clearances and access standards for contractors and other employees, according to a Defense Department official.
At the White House on Tuesday, spokesman Jay Carney told reporters that the Director of National Intelligence "is currently undertaking a review of the security clearance policy for certain contractors."
In addition, he said, President Barack Obama directed the Office of Management and Budget was "examining standards for contractors and employees across federal agencies."