A report into the circumstances surrounding the killing of a retired accountant by a mental health patient has highlighted failures by health and social services in Cardiff.

Paul Khan was convicted last year of manslaughter with diminished responsibility for the killing of Brian Dodd in March 2003 in Prestatyn, north Wales.

At the time, Khan, who was diagnosed with paranoid schizophrenia and had a history of drug misuse, was under the care of the Cardiff community forensic psychiatric team. He had been assessed the day before the killing. The report, commissioned by Cardiff Local Health Board, said the "12-hour missing rule" had not been enforced by Cardiff's community mental health team. Khan should have been reported to the police because he had been missing from his Cardiff flat for more than 12 hours. But the team told Khan's parents to contact the police themselves and only registered him missing three days later.

The report recommends tightening arrangements for discharging patients into the community and a greater use of 24-hour supervised hostels across Wales. It calls for local health boards and the Health Commission Wales to monitor progress on these proposals.

The report also highlights the failure of clinicians to set "specific and measurable" indicators for the community team to assess whether Khan was in danger of unpredictable behaviour. It calls on the NHS trusts involved in his care to examine these.

Marjorie Wallace, chief executive of mental health charity Sane, said the safeguards to protect Khan from himself and others were ignored. "It is shocking that when he went missing, those in charge of his care took no action, leaving his parents to sound the alarm."

The Welsh assembly has ordered the Health Commission to audit discharges from medium secure units and for the Healthcare Inspectorate to inspect clinical governance. It will give a formal response to the report early next year.