Audit: University president spent $40K in policy violation