Would have to be the state auditor as a city audit would lack credibility. Mayor's minions would be influenced to not dig deep enough, be thorough.

City would do well to pay the state to do the audit to remove any image of impropriety. 

Take a year? Not necessarily. Put more people on it, finish faster. 

Or if it does take a year, stop all work until it is done.