Hillary Clinton has said for months that her use of a private email server was a permitted, well-known fact in the State Department.

However, an audit released Wednesday by the State Department inspector general revealed that Clinton did not seek “guidance or approval to conduct official business via a personal email account on her private server,” even though she was obligated to. If information security officials had been consulted, the report stated, they would not have allowed Clinton to rely on private email for official business considering the “security risks.”