The Deferred Maintenance Ledger
You are the lead auditor for a mid-sized municipal water utility. During planning for the FY2025 operational audit, you review the prior year's capital asset register and notice that 38% of pump station assets have a 'last serviced' date older than 24 months, despite a maintenance policy requiring service every 12 months. The maintenance director explains that budget cuts in FY2023 and FY2024 deferred non-critical servicing, and that a backlog clearance plan exists but has not been formally approved. The asset register is maintained in a spreadsheet by a single clerk who also approves work orders. Your engagement letter scopes the audit to 'efficiency and effectiveness of maintenance operations.' The audit committee has asked specifically whether deferred maintenance poses a risk to service continuity. You have 400 hours of budget and a team of two junior auditors.
1. Identify the key risks revealed by the planning evidence and explain how each should shape the audit's scope and approach.
Read the worked answer
The evidence points to three linked risks:
- Service continuity risk - 38% of assets beyond service interval is a direct threat to the objective the audit committee named. This must be the audit's central focus, not a side note.
- Control failure / segregation of duties - one clerk both maintains the register and approves work orders. This is a fraud and error risk that undermines the reliability of the very data you are relying on. You cannot treat the register as trustworthy evidence until you test its integrity.
- Governance gap - an unapproved backlog plan means no accountable owner or funding commitment. This connects to the audit committee's question about risk exposure.
Scope implication: the engagement letter says 'efficiency and effectiveness,' but the committee's question pulls in risk and control. You should confirm with the committee (in writing) that control testing and risk assessment are within scope, or note the scope limitation. With 400 hours and two juniors, you cannot do everything - prioritize (a) validating register accuracy via a sample of physical inspections, (b) testing the work-order approval control, and (c) quantifying backlog risk. Defer deep efficiency benchmarking to a follow-on phase.
2. Design a sampling and evidence strategy to determine whether the register's 'last serviced' data is reliable, given your resource constraints.
Read the worked answer
Because the register is the source of your population, you must first test its completeness and accuracy before relying on it.
Approach:
- Obtain the full register and reconcile asset count against the fixed-asset ledger and physical site list to test completeness.
- Draw a stratified sample: all assets flagged as >24 months (the high-risk stratum) plus a random sample of assets flagged as recently serviced. The second stratum is essential - if the clerk is back-dating service records, only testing the overdue ones would miss it.
- For each sampled asset, seek independent corroboration: work order tickets, vendor invoices, or physical inspection of service tags. Do not accept the register itself as evidence of service.
- With two juniors and limited hours, a sample of roughly 25–30 assets across both strata is defensible for an operational audit (not a financial statement opinion), provided you document the rationale and any projection limits.
Documentation: record the sampling method, population, and any exceptions in the working papers so a reviewer can reperform the logic. If exceptions exceed a threshold you set in advance (e.g., >10% misstatement), expand the sample before concluding.
3. The maintenance director offers to 'walk you through' the backlog plan verbally and says formal approval is 'just a formality.' How should you handle this, and what does it mean for your conclusion?
Read the worked answer
Verbal assurance is not audit evidence of approval. Handle it as follows:
- Request the document - ask for the backlog plan in writing and any evidence of approval (minutes, signed memo, committee resolution).
- If no approval evidence exists, treat the plan as unapproved. That is itself a finding: a risk-mitigation plan without governance sign-off has no accountability or funding guarantee.
- Do not let the director's framing soften the finding. 'Just a formality' is exactly the kind of management assertion an auditor must test rather than accept. Record the assertion and your independent conclusion separately.
- In the report, state the facts: a plan exists but lacks formal approval; the backlog is X assets; the risk to continuity is Y. Avoid editorializing about intent.
This matters for the conclusion because the audit committee asked whether deferred maintenance poses a risk. An unapproved plan means the risk is currently unmanaged, regardless of good intentions. Your conclusion should distinguish 'a plan exists' from 'the risk is controlled' - they are not the same.