An audit found PPE purchases wasted $30 million, but 18 months later there’s no record of action.