The agency charged with building a high-speed rail system between San Francisco and Los Angeles violated state law when it awarded contracts for information-technology services without going through the mandatory bidding process, according to a report released Tuesday by State Auditor Elaine Howle.

The audit is a follow-up to the Bureau of State Audits' April 2010 report, a scathing survey titled "High-Speed Rail Authority: It Risks Delays or an Incomplete System Because of Inadequate Planning, Weak Oversight, and Lax Contract Management." The new audit offers a mixed picture of the $98.5 billion project. While it credits the California High-Speed Rail Authority with implementing four of the previous audit's nine recommendations from last year, it also faults the agency for lax contract management and a flawed business plan.

Among the report's most damning findings is its conclusion that the authority engaged in "inappropriate contracting practices" involving information-technology services. The agency split its $3.1 million IT contract into 13 individual contracts with one vendor, the company Paperless Knowledge, and awarded these contracts to the vendor without obtaining proper bids, the audit found. The State Contract Manual, the report notes, "expressly forbids agencies from splitting contracts to avoid competitive bidding requirements and purchasing thresholds for any series of related services that would normally be combined and bid as one job."

"As a result of the Authority's actions, we believe that it violated the prohibitions set forth in the 'State Contracting Manual.' Further, the nature of the problems we discovered suggests that the Authority needs to significantly improve its internal controls to ensure that it effectively manages its contracts," the report states.

In its response to the audit, the authority stated that it will develop procedures to detect and prevent contract splitting and that it has already "significantly revised the contract administration manual to ensure more effective management of the contract management process." It is also holding discussions with California Technology Agency (as the office of the state's Chief Information Officer is called) about possible service options.

"To the extent that services cannot be obtained through the California Technology Agency the Authority will obtain needed services through the appropriate procurement process," the authority's response states. "In addition, the Authority is reviewing current IT agreements to determine what if any can be canceled immediately."

The auditor's findings have prompted the state's Department of General Services to take a fresh look at the authority's IT contracts. The department, which oversees information-technology procurements, had approved the authority's proposal to noncompetitively award six of its IT contracts to the same provider. Even so, the report notes, the authority entered into these contracts before it had received the approval and it allegedly agreed to terms that were longer than what was approved by General Services.

Fred Klass, director of the Department of General Services (DGS), wrote in a letter to Howle that his department would conduct its audit of the rail authority's procurement process by Jan. 1, 2013.

"The DGS will contact the Authority to confirm that appropriate actions are being taken to competitively bid the services," Klass wrote. "As part of this process, the DGS will ensure that all services that cannot be fully justified as separate and distinct will be combined into one contract."

The authority's failure to follow state regulations about bidding is one of many deficiencies the audit uncovered in its survey of the agency's contract management. The audit paints a picture of a severely understaffed state agency that is struggling to keep track of its contractors, who outnumber the rail authority's staff by a factor of about 25 to 1. As of last August, the authority had only 21.5 filled positions and more than 500 contractors.

The agency's reliance on contractors, some of whom may have conflicts of interest in this project, further compromise its ability to effectively oversee the project, the report found. It particularly hinders the authority's ability to be involved in the project's risk-management process, a problem that the auditor had also identified in her 2010 report.

"The Authority's current organizational structure places the largest portion of the program's planning, construction, and most importantly, oversight in the hands of contractors who may not have the best interests of the State as their primary motivation," the report states. "As a result, the Authority lacks assurance that the program is implemented in a way that best serves the public."

For example, the audit found more than 50 errors or inconsistencies in the progress reports submitted by the agency's contracted program manager, the firm Parsons Brinckerhoff. The firm has more than 100 full-time-equivalent employees working on the project and is charged with providing day-to-day management for the project and overseeing subcontracts managing regional segments of the proposed line, according to the audit. But the audit found that the reports from the program manager "were often inaccurate and that at times the Program Manager misinformed the Authority about the speed with which contractors for each region -- called regional contractors -- performed tasks."

In some cases, the program manager "altered dates to make it appear that the regional contractors would perform work either more or less quickly than they estimated they could in their progress reports," the audit states. The lack of accurate reports "has compromised the quality of the information the Authority relies on."

The audit also reaffirms some of the scathing findings from other nonpartisan agencies, including the Legislative Analyst's Office and the rail authority's Peer Review Committee. All three agencies found major flaws in the rail authority's business plan, including questionable ridership projections and a reliance on federal funds that may never show up. It concludes that the "program's funding situation has become increasingly risky."

On the question of ridership, the audit gives the rail authority some credit for including more information about its methodology in the latest business plan than in the prior version. But the audit also states that "the Authority's process for overseeing the development of the model lacked transparency, which may raise concern about the model's credibility." For example, the peer-review group charged with reviewing the authority's ridership projections was selected by the agency's CEO Roelof van Ark -- a fact that undermined the panel's independent status.

"By handpicking the ridership review group, the chief executive officer may have inadvertently raised concerns about the objectivity of the members," the report states.

The audit's findings echo similar concerns from a growing number of critics of the increasingly controversial project. The Palo Alto City Council has consistently disputed the rail authority's financial and ridership figures, as has the local rail-watchdog group, Californians Advocating Responsible Rail Design.

The Palo Alto council also took the dramatic step last December of adopting as the city's official position a call for legislators to terminate the project.