Even when the financial regulator has the power to act, years can go by before it takes enforcement action, the U.K.’s National Audit Office said.