"All the advice is very clear that how that OIA was handled at the time wasn't appropriate and shouldn't have happened," Woods said in a statement.
The State commission said Southern Response Earthquake Services(SRES) had requested TCIL review the OIA documents and suggest redactions or amendments to proposed responses.
"Responsibility for redaction, withholding or releasing information, and responding to the requester following any such assessment remains the sole responsibility of the agency, in this case SRES.
"It is not appropriate that SRES outsourced the management of the OIA response, including the tasks of considering redactions and drafting a response letter. This should have been done by SRES. This is particularly relevant in this case as TCIL was the subject of the request, presenting a potential conflict of interest," it said.
Southern Response previously said that when an OIA request involved large volumes of information from a third party, it considered that party's request to be reimbursed for their time and resources.
"On two occasions Southern Response has reimbursed TCIL for the cost of labour and materials for reviewing OIA material as part of its third party consultation process."
Woods said today Southern Response would be changing its policy and practices around the OIA to ensure it didn't happen again.
"I've made clear my expectations that the agency follow the appropriate procedures around transparency and taxpayer's money. I have received an assurance from the chief executive that the approach is being changed for the future."
Southern Response initially engaged TCIL in 2014 to keep staff safe. But according to a review of the use of external security firms by government agencies, the arrangement morphed into protecting Southern Response's brand.