A review of Motor Vehicle Administration procedures found the agency's internal security lax and chastised the MVA for not spelling out security policies to employees, state Transportation Secretary O. James Lighthizer said yesterday.

"We've got to do a better job of putting into writing the procedures for handling documents," Mr. Lighthizer said.

He declined to release copies of the report, which he ordered last week to assess the MVA's vulnerability to fraud.

The issue arose in the wake of publicity surrounding Dontay Carter, 18, who allegedly obtained a duplicate driver's license in the name of a 37-year-old man he is charged with abducting and killing.

The MVA review was prepared by the Transportation Department's internal audit division. Mr. Lighthizer received it Monday.

Releasing the full document, he said, would be tantamount to advertising ways to defraud the MVA.

Instead, officials distributed a one-page summary with scant details. But a source within the department described the full report as "very, very critical."