A final report into the Hatfield rail crash has found engineering firm Balfour Beatty failed to manage track inspection and maintenance at the site.
Balfour Beatty has been fined £7.5m for its part in the crash
Also Railtrack, which then controlled infrastructure, did not effectively manage Balfour Beatty's work, said the Office of Rail Regulation (ORR).
Earlier this month a record £10m fine for Balfour Beatty's part in the crash was cut to £7.5m.
Four people died and more than 70 were hurt in the derailment in October 2000.
Last year Network Rail - Railtrack's successor - was fined £3.5m for breaching safety rules in relation to the crash.
In September 2005, five Balfour Beatty and Network Rail bosses were cleared of corporate manslaughter on the direction of a judge.
Monday's report by the ORR - an independent investigation board set up by the Health and Safety Executive with responsibility for rail safety - said the fracture and subsequent fragmentation of rail track near Hatfield caused the crash.
"The rail failure was due to the presence of multiple and pre-existing fatigue cracks in the rail," it said.
"The underlying causes identified by the HSE investigation were that the maintenance contractor at the time, Balfour Beatty Rail Maintenance Ltd (BBRML), failed to manage effectively the inspection and maintenance of the rail at the site of the accident.
"The investigation also found that Railtrack, the infrastructure controller at the time, failed to manage effectively the work of BBRML."
The report called for:
Network Rail to continue to build its health and safety leadership role
The industry to accept the importance and significance of risk assessment
A robust audit regime
Communication between all parties
The industry to guard against complacency
Sandra Caldwell, who chaired the independent investigation board, said it had been impressed with the "thorough and professional manner" in which the HSE investigation had been carried out, concluding in the successful prosecution of Railtrack and Balfour Beatty Rail for health and safety offences.
"These prosecutions resulted in the largest fine imposed in the English courts for health and safety offences on the railway and reflected the severity of the case," she said.
"The rail industry must guard against complacency and continue to seek reasonably practicable improvements to health and safety using effective risk assessment as an essential element of decision-making."
A Network Rail spokeswoman said it accepted the report's findings.
"The Hatfield tragedy was a terrible event for everyone involved, and our thoughts remain with those who died and were injured on that day and their families.
"Maintenance of the railway has fundamentally changed since the Hatfield tragedy in October 2000.
"Since Network Rail took over the nation's railway infrastructure some three-and-a-half years ago, maintenance has been taken in-house rather than being outsourced, and we have changed our approach from a 'find and fix' maintenance regime to one of 'predict and prevent'.
"We have also invested heavily in new maintenance technology and doubled the size of our company to some 30,000 employees. And this progress is reflected in the report."
A Balfour Beatty spokeswoman said the firm would not be commenting.