The audit also revealed problems with PennDOT’s data security protocols and recommended tighter internal controls.