Auditors found the state often pays providers before verifying documentation, relying instead on audits after the fact, a system critics describe as “pay and chase.”