An official report into Craig Sweeney's abduction and sexual assault of a three-year-old girl in Cardiff has made 20 recommendations for change.
Sweeney was on early release from jail for abusing a child
Months before the attack, he allegedly touched a child's bottom and made inappropriate comments to three others.
It was reported to police but despite Sweeney, 24, being on licence he was not sent back to jail.
The report criticised procedures by agencies involved in the handling of Sweeney's case before he re-offended.
The Gwent Multi-Agency Public Protection Arrangements (Mappa) report revealed he had been accused of the incident involving the children during his time on licence.
It said police and probation workers were informed after Sweeney was accused of touching a girl on the bottom on 3 August 2005 and of making inappropriate comments to three children aged 10 and 11.
At the time he was on early release from a three-year sentence for another assault on a girl.
But he was still not recalled to prison, despite these incidents and just one month later his "risk of harm" being increased from medium to high.
The report said: "Sweeney's actions on 2 January 2006 were appalling and caused a young victim to suffer a horrific ordeal.
"However, offenders such as Sweeney are by no means uncommon within the Mappa and criminal justice system."
The report said Sweeney's victim suffered a 'terrifying ordeal'
One recommendation was for Gwent Probation Services to formally record decisions about the reasons why offenders on licence were not recalled to prison following allegations.
The report highlighted several areas where a lack of communication between agencies could have provided police and probation workers with vital information about the risk Sweeney posed.
It criticised certain procedures Gwent Police were using at the time which were not in line with national guidance.
It said staff had "a lack of clear understanding" about who was responsible for setting up Mappa meetings to review Sweeney's progress and urged clarification about who was responsible.
It also said Gwent Mappa needed to ensure a protocol for housing high-risk sex offenders as well as providing clear minutes about meetings.
It criticised how a meeting scheduled on 19 May 2005 was cancelled, indicating a lack of awareness by staff involved in the management of Sweeney and recommended staff training.
Report authors also urged Gwent Police to conduct intelligence checks with all agencies that may hold information about sex offenders and stressed that their public protection officers should be informed of any crimes or allegations committed by sex offenders.
The report said that as the licence of a high risk sex offender is due to expire a Mappa meeting should be held to review the risk management plan of the sex offender.
It also found that during Sweeney's time on licence no structures were in place for home visits from public protection officers and recommended home visit frequency should be stipulated in the risk management plan for each offender.
Sweeney abducted his victim from her family home in Rumney
It also noted that not all relevant information from home visits to Sweeney was shared or recorded with other agencies and recommended a system was put in place.
The report concluded that there was an over-reliance on informal arrangements.
It questioned the suitability of where Sweeney was staying in Newport. It said agencies must develop robust working practices that minimised the risk of harm, although risk could never be completely removed.
Representatives from Mappa said they could not have prevented what happened.
They added the family had seen the report and Mappa had expressed deep regret for what happened saying there were lessons to be learned from the incident.
The father of the three-year-old victim said: "We've been let down by the probation, by the police, by the judge, by the guidelines, by the attorney.
"Everyone has let us down in some way."
Gwent Police assistant chief constable Bill Horne said: "This is a terrible crime and we deeply regret that the child and family concerned have had to deal with it and the consequences.
"There were some things we could have done better.
"What we are not responsible for is that Craig Sweeney went out on 2 January and attacked a young girl."
There was controversy earlier this year when Sweeney was given a five-year minimum term for the January assault.
Sweeney kidnapped the girl from the Rumney area of Cardiff and was caught only after a high-speed chase in Wiltshire.