The National Audit Office has criticised the system for assessing rights to disability benefits, saying little progress has been made since it was "effectively privatised" three years ago.