“We apparently did not have the same level of controls and audit capabilities on that because it was a standalone, closed system,” lawmakers told of compromised pilot program.