State audit finds lack of control