Audit finds agency never verified identity of aid recipients, wasted millions