On the day of his death, staff were focussed on stopping him leaving the facility through its front door, the finding said.
They visually checked the gates at the back of the facility were shut but failed to physically ensure they could not be opened, it said.
Those gates were able to be opened from the outside and could be left insecure at any time.
"I consider that, by having gates that could be opened from the outside, Spectrum Care failed to address a factor that contributed to the environment being insufficiently secure," the findings said.
Several of the staff on duty at the time of the death were inexperienced and the incident happened during a shift handover, the findings said.
Spectrum Care said Julian's death was the result of a number of factors coming together to hinder its staff's ability to care for him properly.
"This tragedy was not a result of complacency, but a profound interaction of situational and system variables that worked against best practice."
The HDC finding said while all the failings were minor, when layered together they showed a failure to meet reasonable standards of care.
In a statement, Spectrum Care said it accepted that finding.
"This event has been a tragedy for the grieving family and the many staff who formed an intense and loving bond with this individual. Spectrum Care apologises for the grief and despair that has resulted from this death and the loss of a cherished son and family member."
It said significant improvements had been made to help prevent another tragedy.
The disability sector was seeking meetings with the Ministry of Health to discuss wide ranging changes to respite support services, it said.
"It is our fervent hope that the legacy of this individual's tragic death will not only be a safer, more secure respite environment for children and young people with an intellectual disability or autism, but also a new respite model that maintains freedom and independence for the people we support."