Audit pins $37M in questionable child care payments on weak oversight, missing records