A Valley Metro audit revealed a $6,300 cookie purchase that violated spending policies. The audit also found a $1.9 million underspending in safety and security, attributed to staffing shortages.