Environmental groups have raised concerns about a $500m (£380m) forest protection deal signed by Boris Johnson at Cop26, after a damning report into the Democratic Republic of the Congo’s “lawless” logging sector.

Johnson signed the letter of intent on behalf of the Central African Forest Initiative (Cafi) for a 10-year agreement which includes objectives to protect high-value forests and peatlands. Of the £200m committed to protecting the Congo basin by the UK at Cop26, £32m was given to Cafi from the aid budget.

At the beginning of April, the DRC government released a long-awaited audit of the country’s logging industry. It found that six successive ministers had illegally allocated at least 18 logging concessions, breaking a near 20-year moratorium on new industrial felling in the world’s second largest rainforest.

More than $3m in royalties has not been paid to the government by operators due to a “chaotic situation”, according to the audit, which marks the first step of the deal between the DRC and 12 donors signed on the first day of Cop26 in Glasgow to unlock $500m to protect the vast ecosystem.

Environmental groups have said taxpayer money from the UK, Norway, France and Germany could go to waste if no action is taken on the illegal concessions, with the moratorium on industrial logging due to be lifted at the end of this year.

The DRC environment ministry issued a review of all forest concession contracts after the audit but environmental groups are demanding suspensions and prosecutions of violations.

Known as the lungs of Africa, the Congo basin rainforest is home to endangered forest elephants and gorillas and is an enormous carbon store that sustains rainfall as far away as Egypt and is home to about 80 million people. It absorbs about 4% of the world’s annual carbon emissions.

Irene Wabiwa Betoko, Congo basin forest lead for Greenpeace, said: “The audit reveals a circus of illegalities, corruption and crimes against the environment. Greenpeace Africa demands a legal investigation of all officials responsible for plundering the rainforest, and, where necessary, the lifting of their parliamentary immunity.”

Despite the ban on new industrial logging, the DRC has one of the highest rates of deforestation in the world, losing 490,000 hectares (1.2m acres) of primary rainforest in 2020, according to Global Forest Watch.

Lord Goldsmith, minister for the international environment, visited the region last month after the DRC failed to meet the first step of the Cop26 agreement and publish the audit at the start of January.

In a statement, he said his trip was a great opportunity to speak to leaders in one of the most important and biodiversity rich areas of Earth. “The leadership of Congo basin countries at Cop26 was hugely impactful, where big promises were made both by donor countries and Congo basin countries. I am determined that those promises are kept,” he said.

Cafi, the coalition of donor countries that made the $500m deal with the DRC, welcomed the release of the audit but said no money had been released yet. In a statement to the Guardian, it commended the publication of the report by the DRC Inspection générale des finances on logging concessions and said it would continue to work in collaboration with the DRC government on strengthening forest governance.

“Cafi remains committed to supporting the DRC to help ensure that the objectives and commitments outlined in the 2021-2031 letter of intent are met,” it said.