WA Auditor General disappointed in agency treatment of information security