The firm run by Joe Anderson’s son was not on an approved contractors list, a critical report found.