CISA program gave out $20k+ payments to unqualified employees, auditor says