An audit released Tuesday concluded that the city’s Office of Emergency Management and Communications had no “reasonable assurance that only approved personnel had accessed the surveillance system and used it appropriately.”