The audit involves an Education Department database created in 2008 that holds information about individual students provided to the department by local school districts.
The database contains information about both current students as well as past students.
Her audit recommended the Education Department cease asking local schools for the Social Security numbers of students.
"We know that transmitting, that anytime you collect, transmit and maintain Social Security numbers, it creates the opportunity for a data breach or for that information to fall into the wrong hands", Galloway said at news conference announcing the audit.
In response to the audit, the Education Department promised it would remove Social Security number information from its database by June 2016.
As to why the Education Department maintains a database of past students, a spokesperson for the department said it helped assess the outcomes of Missouri school students.
The audit recommended the department adopt policies to address how to handle when it becomes aware of a breach of data concerning student information. It also recommended ceasing a practice by which Education Department employees shared IDs and passwords to access student data.