All good points.  The city auditor shared a confidential memo with the council chair (Martin).  No one seems to have a copy of that memo, including the HART board, but it may indicate exactly which controls were weak.  (The audit may also have details on that, but it's been a while since I've read it.)