A new State Department directorate charged with addressing diplomatic security after the 2012 Benghazi attack is short-staffed and lacks the authority to be effective, according to a watchdog review.

The State Department inspector general said in a report Wednesday that the High Threat Programs division “suffers from staffing gaps and position shortages” and “does not have the authority to cause peer bureaus to implement its recommendations.”

The directorate is responsible for 30 high-threat posts in Africa, the Middle East and South Asia, but the report said the State Department has not published information about the office’s role, leading to confusion about its authorities at overseas posts.

On the other hand, auditors found that the directorate “has helped create a culture of shared responsibility for security within the department and has forged strong partnerships with regional security officers.” Both accomplishments match recommendations from the Accountability Review Board, which was created after the Benghazi attack to examine the government’s security systems abroad and suggest ways to improve them.

The State Department said Wednesday that the agency is on track toward strengthening security abroad and that the inspector general’s report offers useful guidance for continuing that work. “This is a timely snapshot of the progress being made, and we welcome and agree with the IG’s further recommendations for diplomatic security,” said department spokesman Alec Gerlach.

Similarly, the top Democrat on the House Select Committee on Benghazi, Rep. Elijah Cummings (Md.), said in a statement that the State Department has “significantly improved the focus on security at our most dangerous posts,” but he added that “more work needs to be done.”

The Benghazi attack killed four Americans, including U.S. Ambassador Chris Stevens. The Accountability Review Board said in a 2012 report that widespread management and leadership failures at the State Department left U.S. diplomats and other personnel vulnerable.

Correction: An earlier version of this article incorrectly stated that three Americans had been killed in the Benghazi attack. Four were killed in the assault.