The findings on Monday said that new CEO, former PayPal executive David Sacks, had no knowledge of a computer system used to fraudulently skip require study time for insurance licensing in California that led to the departure of co-founder Parker Conrad. The software let sales staff avoid spending the 52 hours of required preparation for their licensing test, in violation of state requirements.

The report, written by an outside law firm hired by Zenefits, also left a number of unanswered questions as to how it managed to skirt licensing regulations for so long.

The report paint a picture of a fast-and-loose startup whose regulatory corner-cutting has cost the company a lot. The company, whose last funding round gave it a valuation of $4.5 billion, also had to cut 250 jobs in February as part of its process of getting back on track.

Sacks, who joined the company in late 2014 as its chief operating officer, didn’t find out about the software until last fall after an unnamed employee blew the whistle on it, the report asserted. The report claims that Sacks, who was ostensibly in charge of day-to-day operations, was totally out of the loop about a key part of the company’s operations.

Sacks and Joshua Stein, then the company’s vice president of litigation and regulations, first raised concerns to Conrad about the software in November, the report said. But Conrad didn’t admit he had created it until January—and then only after Stein and Zenefits’ general counsel, Hillary Smith, told him they were hiring an outside law firm to look into the matter, according to the report.

Get Data Sheet, Fortune’s technology newsletter.

More than anything, the report paints of a picture of how Zenefits’ organizational structure and Conrad’s tight grip on control managed to keep Sacks completely in the dark. Because Zenefits’ sales team reported entirely to Conrad, Sacks had no idea about the software—or even what employees have to do to obtain their insurance brokering license, according to the report.

“Because Mr. Sacks never sought to obtain an insurance license himself, this was also the first time that he saw the licensing application and learned of the 52 hour pre-licensing education requirement,” the report said.

The company says that Sacks’ responsibilities only covered product management, finance, partnerships, and operations such as customer support. “Since the time David joined the company as COO, sales and legal/regulatory issues reported directly to founder and then-CEO Parker Conrad, who had maintained that Zenefits’ licensing was in compliance and that any examples to the contrary were isolated cases that had been quickly corrected,” Zenefits spokeswoman Jessica Hoffman told Fortune.

Over the last few months, Zenefits said it has overhauled its executive team, created a new board of directors, and fired sales managers who circulated the illegal software. It also created its first team to oversee regulatory compliance by promoting Stein to that role.

The report didn’t address why it took Zenefits, which operates in a highly regulated industry, this long to appoint a head of compliance.

“The absence of a compliance team was a decision made by the previous CEO, Hoffman told Fortune. “Its absence was something that was immediately rectified once David Sacks became CEO when he made former federal prosecutor Josh Stein as Chief Compliance Officer. His team now has 9 professionals on it with plans to add three more.”

Also on Monday, a report from BuzzFeed, citing anonymous sources said that Conrad sold $10 million in Zenefits stock last year, months before his resignation. Conrad also negotiated with the company’s board for $130,000 in severance when he resigned, according to the report.

A person close to Conrad told Bloomberg Businessweek that “he regrets resigning and is already working on a new company.” Founded in 2013 by Conrad and Laks Srini, Zenefits has raised $584 million to date.