"We've had suspicions periodically, but we've never been able to prove it, to document it, and we did in this case," the auditor told lawmakers.