CRA knew of major gaps in fraud detection as agency paid out bogus refunds, records show