Unlike other states, Victoria's screening authority cannot stop people from working with children when there are concerns about the risks they pose unless they have been charged with a serious crime.
If concerns escalate after they have been granted clearance, officials can be left with no grounds to revoke it.
The ombudsman's investigation was prompted by ABC reports that revealed former Melbourne City Mission worker Alexander Jones misused his prior credentials to access sensitive information about children and young people.
Jones' credentials remained active for about 15 months after he moved into another role because of an oversight. His account was deactivated in October 2018 when the breach was identified.
A few days later, Working With Children Check Victoria was notified about Jones' contact with young people.
He sexually assaulted a child known by the pseudonym Zack in May 2018 after they met at Melbourne's Flinders Street Station.
He was also the subject of serious interstate child protection concerns and apprehended violence orders when he applied for a job in Victoria, the ombudsman revealed.
"Because he was never charged with a crime (interstate), these did not appear in his national police check, nor were they disclosed to Working With Children Check Victoria," Ombudsman Deborah Glass said.
"Even more remarkably, the inadequacies in Victoria's child safety screening legislation mean that these prior investigations would not have been grounds to refuse Jones a Working With Children clearance, even if the screening authority had been aware of them."
Jones' clearance wasn't revoked until May 2019.
About three months earlier, Zack told Child Protection Jones sexually assaulted him. Jones was subsequently arrested, charged and jailed for sexually assaulting Zack.
Jones was never qualified to work with children and lied to Melbourne City Mission about his previous employment and credentials.
Zack's family received conflicting reports from officials about how much of his information Jones inappropriately accessed.
They decided to move at "considerable inconvenience and emotional cost".
The ombudsman found Jones did not access Zack's information.
Ms Glass said it was imperative Victorian legislation was amended so officials could act on information that showed applicants posed an unjustifiable risk to children's safety, whether or not criminal charges were brought.
"For the safety of our children, more needs to be done," she said.
Victoria's Commissioner for Children and Young People accepted there needed to be improvements to the system.
"This case highlights that child abuse remains a constant threat," Commissioner Liana Buchanan told AAP.
"We must keep watching for child safety gaps and act urgently to close them."
Victoria has the weakest working with children safeguards in Australia and loopholes in legislation only benefit child abusers, shadow attorney-general Michael O'Brien said.
"Tragically, this is not a hypothetical situation," he said.
Melbourne City Mission has strengthened its pre-recruitment checks and accepted the ombudsman's recommendation to review staff grievance procedures.
The Department of Families, Fairness and Housing acknowledged more should have been done to protect clients' information and has accepted the ombudsman's recommendations to improve information security and develop a data breach response plan.
Despite his conviction, Jones told the ombudsman he was not inappropriate with children in Victoria and denied being investigated for alleged sexual offences in NSW or being served an apprehended violence order there.
He never contacted a family or young person using information he accessed, he said.
Lifeline 13 11 14
Kids Helpline 1800 55 1800 (for people aged 5 to 25)
5°C