The headline on the news was "violates policy." That sounds very mild.
I guess it depends on exactly what the State Dept. auditors actually said. If, as the headline states, they said, "violated federal records rules," then I think we get into felony territory, and they must refer the matter to the relevant cops.
This ties in very neatly with the FBI investigation, by the way. A finding of violation by a separate Federal agency gives them further grounds to press forward with recommending an indictment.
All assuming, of course, that the highly politicized DoJ is willing to treat Hillary Clinton as equal under and subject to the law.