An outside forensic auditing firm recommended the state hire a third-party compliance officer after determining most of a mysterious $1.8 billion listing was not real money.