Are you unconcerned that there's very big loop holes, by not having records that materials and services actually received, yet those amounts are being paid out.   Other concerns are that OP has possibly double paid at times.  And there's examples noted where no invoice was involved, and payments were sent out based on estimates. Why bother with invoices, just  pay based on an estimate Golly Gee!!!  And there's examples where quantities were not shown on invoices -- thus OP could be paying the price for a couple tons of gravel, but only receiving a small quantity, (maybe a wheel barrow load -- who knows)

Same kinds of concerns reported by the forensic report that contractor's services were actually received.

Do you have concern for these kinds of loopholes  ??????  And that safeguarding & securing OP's assets & resources is appropriate.  Very logical that OP's assets should be protected with an inside auditor.

Tom