4-year audit finds management controls often "weak or nonexistent" at board that regulates doctors. While board leaders say they will address findings they agree with, lawmakers may force the issue.