Fixed assets are the audit that gets deferred because nothing seems to move: the register is long, the balances change slowly, and the external auditor tests depreciation every year. That stillness is the risk. The register is where an organization records what it owns, where it is, what it cost and how fast it is wearing out, and every one of those facts decays quietly. Assets are scrapped without a disposal, moved without a transfer, expensed when they should be capitalized and capitalized when they should be expensed, depreciated over lives nobody chose, and carried at values nobody has tested since the line was idled. The largest accounting fraud of its era, WorldCom’s 2002 restatement, ran on a single fixed-asset mechanism: about 3.8 billion dollars of ordinary line costs capitalized as assets, which turned expenses into balance sheet and losses into profit until an internal auditor found it.
This guide is the internal auditor’s version of the fixed asset audit, written for the practitioner who has to test existence on a plant floor, capitalization in a project ledger and disposal in a system that never asked for approval. It covers the asset lifecycle and where the risk sits, a risk map, a ten-control starter matrix, how to size and sequence the engagement, a 14-test program, the analytics that profile a register, Brightwater Foods’ fixed asset audit with every test’s result, the findings that recur with wording that lands, and scoping variants for capital-intensive industries, leased estates, IT and intangible assets, and the public sector. It sits beside the procurement guide, which covers how capital projects are awarded, and the integrated procure-to-pay guide, which covers how they are paid for.
In this guide
- Know the terrain: the asset lifecycle and where the risk sits
- The fixed asset risk map
- The starter RCM: ten controls that carry the process
- Sizing and sequencing the engagement
- The 14-test program
- The analytics that profile a register
- Worked example: Brightwater Foods’ fixed asset audit
- The findings that recur, and wording that lands
- Scoping variants: capital-intensive, leased, IT and intangible, public sector
- Where to go next
Know the terrain: the asset lifecycle and where the risk sits
A fixed asset passes through five states, and each state has its own control and its own failure. Acquisition is a capital request approved against a budget and bought through procurement; the failure is a purchase that never had a business case, or one that was split to avoid the capital approval threshold. Capitalization is the decision that the spend is an asset rather than an expense, the accumulation of the cost in construction in progress, and the transfer to the register when the asset is placed in service; the failure runs both ways, repairs capitalized to flatter the year and assets expensed to spend a budget, plus projects that sit in construction in progress long after they started working because nobody transferred them. Use is the depreciation the accounting policy prescribes and the physical custody the organization assumes; the failure is a useful life chosen by default, an asset that walked out of the building, and a tag that means nothing because the register was never reconciled to the floor. Impairment is the test that a carrying value is still recoverable when a line is idled, a site closed or a technology superseded; the failure is that nobody runs it until the external auditor asks. Disposal is the approved, recorded, priced exit; the failure is the scrap that never reached the register, the sale to an employee at a friendly price, and the asset still depreciating years after it left.
Two structural facts shape the audit. First, the register is the population, and it is wrong in ways the audit has to measure before it can test anything else: existence runs from register to floor, completeness runs from floor to register, and both directions are needed because they find different things. Second, most fixed asset risk is judgment rather than transaction: whether a cost is capital, how long a machine will last, whether a value is recoverable. Judgment is tested against criteria, which means the audit’s first job is to pin the criteria down, the capitalization policy, the useful life table, the impairment triggers, and its second job is to test whether the judgments actually made were the ones the criteria require. The SOX scoping guide covers why the register’s controls are usually key controls in a public company; the financial statement fraud guide covers what happens when the judgments are steered.
The fixed asset risk map
| # | Risk | What it looks like in the file | Where it hurts |
|---|---|---|---|
| R1 | Ghost assets: items on the register that no longer exist, were scrapped, moved or stolen without a disposal | Register-to-floor exceptions; assets with no location; assets never counted; disposals falling while scrap sales continue | Overstated assets, overstated insurance premiums, understated losses; theft concealed indefinitely |
| R2 | Unrecorded assets: items in use that were expensed, gifted, self-built or acquired through a project that never transferred | Floor-to-register exceptions; repairs accounts with large single invoices; construction in progress with no movement | Understated assets and depreciation; assets outside the control system entirely |
| R3 | Capitalization steering: expenses capitalized to protect earnings, or assets expensed to consume a budget or avoid approval | Capitalized items with maintenance descriptions; capitalization rate moving against capex; year-end reclassifications | Misstated profit; the WorldCom mechanism; budget control defeated |
| R4 | Construction in progress as a parking lot: completed projects not placed in service, abandoned projects not written off | Projects older than twelve months; projects with no spend in six months; projects whose assets are visibly running | Depreciation delayed; abandoned costs carried as assets |
| R5 | Depreciation parameters by default: useful lives, methods and residuals set by category codes nobody reviews | Lives inconsistent with policy; fully depreciated assets in heavy use; assets depreciating after disposal | Misstated expense; a register that cannot support replacement planning |
| R6 | Impairment blindness: indicators present, assessment absent | Idle lines, closed sites, superseded technology carried at cost less depreciation | Overstated assets; a surprise write-down when the external auditor insists |
| R7 | Disposal without discipline: scrap, sale and transfer outside approval, at non-market prices, to related parties | Disposals with no approval; proceeds below book with no explanation; buyers who are employees | Loss of value; conflicts of interest; the register drifting from reality |
| R8 | Custody and access: register maintained by the same people who buy, dispose or pay; tags missing; high-value portable assets uncontrolled | Create-and-dispose rights combined; untagged assets by site; laptops and tools with no custodian | Every other risk becomes easier |
The starter RCM: ten controls that carry the process
Ten controls carry the fixed asset process in most organizations. Build them in the risk and control matrix template, mark which exist, and treat the missing ones as design findings before a single asset is counted; a register with no periodic physical verification is a finding whether or not the count you then perform finds anything.
| Control | Type | Risk | How to test it |
|---|---|---|---|
| Capital expenditure approved against a business case and budget at a level set by amount, before commitment, with post-implementation review above a threshold | Preventive, entity-level | R3, R4 | Sample capital requests to approval and business case; test every project above the review threshold for a completed review |
| A written capitalization policy with a threshold, component rules and a repairs-versus-improvement test, applied at invoice coding by someone trained in it | Preventive | R2, R3 | Sample capitalized items and expensed repairs above the threshold in both directions against the policy |
| Construction in progress reviewed monthly for projects ready for service, stalled or abandoned, with transfers and write-offs actioned | Detective | R4 | Aging of the CIP ledger; every project older than twelve months traced to a decision |
| Assets tagged at capitalization with a custodian and location recorded, and changes of location or custodian processed through a transfer record | Preventive | R1, R8 | Tag completeness by site; a sample of transfers traced to records |
| Periodic physical verification on a cycle, register-to-floor and floor-to-register, with differences investigated and the register corrected | Detective | R1, R2 | Inspect the last cycle’s counts and reconciliations; re-perform a sample in both directions |
| Depreciation parameters set from a policy table by category, reviewed annually against actual lives and disposals | Preventive | R5 | Recalculate depreciation for the full register; compare lives to the table and to disposal history |
| Impairment indicators reviewed at each reporting date, with an assessment documented when an indicator exists | Detective | R6 | Inspect the indicator review; identify idle or superseded assets independently and trace them to an assessment |
| Disposals approved before the event at a level set by book value, with proceeds tested to market and sales to employees or related parties prohibited or independently priced | Preventive | R7 | Full population of disposals against approvals; buyer identity against the employee master; proceeds against book and market |
| Register maintained by a function independent of purchasing, custody and payment, with create, transfer and dispose rights restricted and logged | Preventive | R8 | Access extract for the register; users with combined rights listed and explained |
| Register reconciled to the general ledger monthly, by category, with insurance schedules updated from it annually | Detective | R1, R2, R5 | Inspect twelve reconciliations; compare the insured schedule to the register |
Sizing and sequencing the engagement
Fixed asset audits are sized by sites and by register quality. A single-site organization with a clean register is a 150-hour engagement; a multi-plant manufacturer whose register has not been verified in years is 250 to 320, and most of the difference is the physical work and the reconciliation of what it finds. The ranges below assume three sites, a register of a few thousand lines, a project ledger in the ERP and an auditor who can recalculate depreciation in a spreadsheet. Record the count sample and its stratification in the sampling memo, because the existence sample is value-weighted and the completeness sample is not, and a reviewer will ask why.
| Phase | What happens | Hours |
|---|---|---|
| Planning and criteria | Capitalization policy, useful life table, impairment triggers, approval matrices and the insurance schedule obtained; the register extracted with the ledger reconciliation; the RCM drafted | 25 |
| Walkthrough | One capital project from request to in-service, one repair, one disposal and one transfer walked through the system and the floor | 15 |
| Register analytics | The profile below run on the full register: aging, lives, locations, duplicates, CIP, disposals, depreciation recalculation | 30 to 40 |
| Physical verification | Register-to-floor and floor-to-register samples at each site, with plant staff; differences investigated on the day | 60 to 90 |
| Capitalization and CIP | Both-direction capitalization sample; every CIP project older than twelve months; component and improvement judgments tested against policy | 40 to 50 |
| Depreciation, impairment, disposals | Recalculation exceptions investigated; independent impairment indicator search; full disposal population tested | 40 to 50 |
| Reporting | Findings with denominators (count and value); register corrections agreed with the controller | 30 |
| Total | 240 to 300 |
Sequence the analytics before the floor, because the register profile chooses where to count: the site with the most assets marked location unknown, the category with the oldest lives, the projects that have sat in CIP for two years. Do the physical work in the middle of the engagement, not at the end, because what the floor finds changes how much reliance the recalculation and the impairment work can take. And agree the register corrections with the controller before the report is drafted; a fixed asset report whose numbers management has already corrected in the ledger is a report with no argument left in it.
The 14-test program
| # | Test | Population and method | Risk |
|---|---|---|---|
| 1 | Walk the lifecycle; reconcile the process as performed to the policy and approval matrices; redraw the RCM | One item per event type | All |
| 2 | Register integrity: reconcile the register to the ledger by category at the period end; profile the register for locations, custodians, duplicates and negative or zero costs | Full register | R1, R2, R8 |
| 3 | Existence, register to floor: value-weighted sample at each site, physically located and inspected for condition and use | Sample 60 per site, stratified by value | R1 |
| 4 | Completeness, floor to register: items selected on the floor traced to the register; items not found traced to the expense ledger | Sample 40 per site, haphazard on the floor | R2 |
| 5 | Capital request approval: sample of the year’s capital spend traced to approval, budget and business case; capital requests histogrammed against the approval thresholds | Sample 25; full population histogram | R3 |
| 6 | Capitalization decisions, both directions: capitalized items with repair-like descriptions and expensed repairs above the threshold tested against the policy | Sample 40 each way, from analytics | R2, R3 |
| 7 | Construction in progress: every project older than twelve months or with no spend in six months traced to a status decision; a sample of completed projects tested for timely transfer | Full aged population; sample 15 transfers | R4 |
| 8 | Depreciation recalculation: the full register recalculated from cost, date in service, life and method; exceptions investigated; lives compared to the policy table and to disposal history | Full register | R5 |
| 9 | Impairment: the indicator review inspected; idle, closed or superseded assets identified independently from operations and traced to an assessment | Indicator review; operations interviews at each site | R6 |
| 10 | Disposals: full population against approvals; proceeds against book value and market evidence; buyer identity against the employee master; scrap sales reconciled to disposals | Full population | R7 |
| 11 | Transfers and custody: a sample of location or custodian changes traced to transfer records; high-value portable assets tested for custodian assignment | Sample 25; portable asset population | R1, R8 |
| 12 | Leases and off-register assets: the lease population reconciled to the balance sheet under the applicable standard; assets held for others and others’ assets held identified | Full lease population | R2 |
| 13 | Access and segregation: register create, transfer and dispose rights by user, joined to purchasing and payment rights | Access extract | R8 |
| 14 | Governance: post-implementation reviews for projects above the threshold; the insurance schedule against the register; the annual review of lives and the capitalization policy evidenced | Project population; schedules | R3, R5 |
The analytics that profile a register
A fixed asset register is one table with a few thousand rows, which makes it the easiest population on the audit plan to analyze in full and the one most audit functions still sample. The eight profiles below run in a spreadsheet in an afternoon and choose where the physical work goes.
| Analytic | Logic | A hit usually means |
|---|---|---|
| Depreciation recalculation | Expected accumulated depreciation from cost, in-service date, life and method, against the register’s figure, by asset | A parameter changed, a life set by default, an asset depreciating after disposal, or a system rounding rule nobody documented |
| Life-versus-policy | Each asset’s life against the policy table for its category | Category miscoding, or lives chosen to manage expense |
| Fully depreciated in use | Assets at zero net book value still assigned to an active location or cost center, by category and age | Lives too short for the category, or assets that left long ago; either way a register that cannot support replacement planning |
| Location and custodian quality | Assets with blank, unknown or generic locations and no custodian, by site | Where the ghost assets are; where to count first |
| Repair-like capitalization | Capitalized items whose descriptions contain repair, replace, service, maintenance or overhaul terms; expensed repairs above the capitalization threshold | Capitalization judgments to test in both directions |
| CIP aging and velocity | Projects by months since first cost and months since last cost | Completed projects never transferred; abandoned projects never written off |
| Disposal economics | Proceeds against net book value and against category norms, with buyer names matched to the employee master | Friendly sales, unrecorded scrap, or a category consistently written off early |
| Additions near thresholds | Capital requests and additions histogrammed just under the approval and capitalization thresholds | Splitting to avoid approval, or expensing to avoid the register |
Worked example: Brightwater Foods’ fixed asset audit
Brightwater Foods, the 180-million-dollar food manufacturer with three plants and about 600 staff used across this site, carried 4,300 assets on its register at a net book value of 61 million dollars, spent about 9 million dollars a year on capital and charged about 7 million dollars of depreciation. Its capitalization threshold was 5,000 dollars; its useful life table ran from thirty years for buildings to three for computer equipment. The register had last been physically verified in part, at one plant, four years earlier. The fixed asset audit followed the procurement audit that had found a refrigeration upgrade grown from 640,000 to 912,000 dollars through unapproved change orders, and the chief audit executive wanted to know what had happened to that project and its cousins once the invoices were paid. The engagement took 260 hours, ninety of them on plant floors.
| Test | What it found | Disposition |
|---|---|---|
| 1. Walkthrough | Capital requests approved and bought through procurement; capitalization coded by accounts payable clerks from the invoice description; transfers from construction in progress made when the plant engineer remembered to say a project was done; disposals recorded when the register team noticed an asset had gone. | RCM redrawn; two controls marked as absent by design |
| 2. Register integrity | Register reconciled to the ledger within 4,000 dollars; 214 assets with location unknown, 190 of them at one plant; nine duplicate entries, 61,000 dollars. | Corrections agreed; counting aimed at the plant |
| 3. Existence, register to floor | 180 assets sampled across three plants, value-weighted: 171 found; nine not found, 84,000 dollars net book value, seven of them scrapped without a disposal and two moved between plants without a transfer. | Finding, Medium: physical verification and disposal discipline |
| 4. Completeness, floor to register | 120 items selected on the floors: 111 on the register; nine not, including a 14,000-dollar conveyor drive and a 22,000-dollar packaging line upgrade coded to repairs. | Combined with test 6 |
| 5. Capital approval | 25 of 25 sampled requests approved at the right level; requests clustered under the 25,000-dollar plant-level capital limit at one plant, eleven requests between 22,000 and 24,900 dollars. | Finding, Low: threshold splitting at one plant |
| 6. Capitalization decisions | Of 40 expensed repairs above 5,000 dollars, nine met the policy’s improvement test, 96,000 dollars; of 40 capitalized items with repair-like descriptions, four were repairs, 31,000 dollars. Net effect: assets understated by 65,000 dollars in the year, the opposite direction from the one the audit had expected. | Finding, Medium: capitalization coding at invoice entry |
| 7. Construction in progress | Twenty-two open projects; the refrigeration upgrade transferred at 912,000 dollars including 41,000 dollars of training and relocation cost that should have been expensed; two projects with no spend in fourteen and nineteen months, 310,000 dollars, one of them visibly running since the previous winter and never depreciated. | Finding, Medium: CIP review; depreciation of 52,000 dollars caught up |
| 8. Depreciation recalculation | Full register recalculated: 41 vehicles on ten-year lives against the table’s five, 38,000 dollars of understated expense; 27 assets depreciating after their disposal date, 11,000 dollars; otherwise within rounding. | Finding, Low: parameter maintenance |
| 9. Impairment | The indicator review consisted of a sentence in the year-end memo. Operations interviews identified a bottling line at the second plant idle for eleven months, net book value 1.4 million dollars, with no plan to restart it and no assessment. | Finding, Medium: impairment indicators; assessment performed before year end |
| 10. Disposals | 84 disposals in the year; nineteen with no prior approval; six sales to employees, one a forklift sold to a plant supervisor for 1,200 dollars against 6,500 dollars of comparable market value; scrap sales receipts exceeded recorded scrap disposals by 23,000 dollars. | Inside finding from test 3; the forklift sale to the conflicts committee |
| 11. Transfers and custody | Twelve percent of assets untagged at the plant with the location gaps; no custodian recorded for 140 portable assets (laptops, tools, test equipment), 210,000 dollars. | Inside finding from test 3 |
| 12. Leases | Eleven equipment leases; two, 140,000 dollars, not recognized on the balance sheet under the applicable lease standard. | Finding, Low |
| 13. Access and segregation | Four users with register create and dispose rights also held payment release rights; the register team sat inside accounts payable. | Finding, Low: segregation, with an interim compensating review |
| 14. Governance | Post-implementation reviews performed for none of six projects above 250,000 dollars; insurance schedule last updated from the register three years earlier, 6 million dollars below the current register value. | Finding, Low: capital governance; insurance schedule corrected |
The report carried seven findings, four Medium and three Low, an overall rating of Needs Improvement and no referrals, with the forklift sale routed to the conflicts committee rather than into the report. The register was corrected during fieldwork by 65,000 dollars of capitalization, 52,000 dollars of catch-up depreciation, 84,000 dollars of ghost assets written off and a 1.4 million-dollar impairment assessment that management completed before the year-end close, which is the pattern a fixed asset audit should aim for: the numbers fixed before the report, and the report about why they were wrong. Three things generalize. The capitalization finding ran the opposite way from the fraud literature: Brightwater was expensing assets, not capitalizing expenses, because plant managers spent repair budgets to avoid capital approval, and the audit that had gone looking for WorldCom found a budgeting habit. The idle bottling line was found by asking operations what was not running, not by reading the register, which is how impairment indicators are always found. And the physical work was worth ninety hours because it produced the only numbers in the report that nobody could argue with: nine assets in 180 that were not there, and nine items in 120 that were.
The findings that recur, and wording that lands
Fixed asset findings are unusual in that most of them can be quantified in two currencies, count and value, and the report should give both, because a ghost-asset rate of 5 percent by count and 0.1 percent by value is a different finding from the reverse. The two below recur in most engagements, in the five-Cs form.
Physical verification and disposal discipline. Condition: of 180 register items sampled at three plants, nine (5 percent by count, 84,000 dollars or 0.1 percent of net book value) could not be located; seven had been scrapped and two moved between plants without a disposal or transfer record. Nineteen of the year’s 84 disposals were recorded after the event with no prior approval, and scrap sale receipts exceeded recorded scrap disposals by 23,000 dollars. Criteria: the fixed asset policy requires physical verification on a three-year cycle, prior approval of disposals at a level set by book value, and a transfer record for every change of location. Cause: the verification cycle lapsed four years ago when the register moved into accounts payable, and the disposal workflow is triggered by the register team noticing an asset has gone rather than by the plant releasing it. Consequence: a register whose existence cannot be relied on at the plant level, insurance premiums calculated on assets that do not exist, and scrap proceeds that cannot be reconciled to the assets scrapped. Corrective action: management will restart the verification cycle with the first count at the plant with the location gaps by quarter end, move disposal initiation to the plant engineers with approval before release, and reconcile scrap receipts to disposals monthly; internal audit will re-perform a sample at the first count.
Impairment indicators. Condition: a bottling line at the second plant with a net book value of 1.4 million dollars has been idle for eleven months with no restart plan; no impairment assessment was performed, and the year-end indicator review consists of a single sentence stating that no indicators were noted. Criteria: the accounting policy and the applicable standard require an assessment of recoverability when indicators of impairment exist, including an asset idled with no plan for use. Cause: the indicator review is performed by finance from the register, which shows the line as an active asset at its plant location, and operations is not asked. Consequence: an asset carried at 1.4 million dollars whose recoverable amount was, on the assessment management completed during the audit, materially lower, and a risk of the same pattern for other idled equipment. Corrective action: the controller will add an operations attestation of idle, superseded and closed assets to each quarter-end close and document the assessment for every indicator; internal audit will inspect the first two quarters’ attestations.
Scoping variants: capital-intensive, leased, IT and intangible, public sector
Capital-intensive industries, utilities, process manufacturing, transport and extraction, move the weight of the audit to construction in progress and componentization: the risk is less that an asset is missing than that a billion-dollar plant is one line on the register with one useful life, that overhaul costs are capitalized without derecognizing what they replaced, and that decommissioning obligations are estimated once and never revisited. Leased estates shift the population from owned assets to lease contracts, and the audit becomes a completeness test of the lease population against the balance sheet under the applicable standard, with the embedded leases in service contracts as the usual gap. IT and intangible assets, software licenses, capitalized development, cloud arrangements, carry the capitalization judgment to its hardest form: the criteria for capitalizing internally developed software are precise and the timesheets that support them are not, and the IT audit plan guide covers where these assets sit in the technology universe. Public sector and heritage assets add valuation and custodianship questions that commercial registers never face, infrastructure carried at depreciated replacement cost, collections that are not depreciated at all, and assets held in trust, and the audit’s criteria come from the public sector standards rather than the commercial ones. In every variant the two-direction count, the both-way capitalization test and the independent search for impairment indicators remain the core, because they are the tests that find what the register cannot tell you.
Where to go next
Audit the register as a population and the plant floor as the evidence. Pin down the criteria before testing a judgment, profile the register before choosing where to count, count in both directions, test capitalization in both directions, ask operations what is not running, and treat every disposal as a transaction that needed approval before it happened. Then fix the numbers with the controller before the report and write the report about why they were wrong. The buying side of the same assets is covered in the procurement guide and the integrated procure-to-pay guide; the stock that moves through the assets is covered in how to audit inventory; and when a capitalization pattern looks steered rather than sloppy, the financial statement fraud guide explains the mechanism and the first 48 hours protocol explains what to do next.
Related guides
- How to audit procurement — capital projects from tender to change order, with Brightwater’s engagement
- How to audit procure-to-pay end to end — the chain that pays for the assets
- How to audit inventory — the other physical population, with MidState’s twelve-depot count
- How to audit accounts payable — where capitalization is coded at invoice entry
- Financial statement fraud — improper capitalization as a mechanism, WorldCom included
- The ACFE fraud tree explained — non-cash misappropriation in context
- When internal audit finds fraud: the first 48 hours — what to do with a steered pattern
- The fraud red flags library — the fixed asset and disposal indicators
- SOX scoping and risk assessment — why the register’s controls are usually key
- Building the IT audit plan — where software and cloud assets sit
- The risk and control matrix template — where the ten-control matrix lives
- Writing the audit work program — the five-element procedure standard
- The sampling memo template — the value-weighted existence sample and the haphazard completeness sample, documented
- Audit sample sizes demystified — why the counts are 60 and 40
- Annotated workpaper examples — the count sheet and the disposition grid
- Segregation of duties beyond the ERP — register, custody, purchasing and payment kept apart
- The 5 C’s of audit findings — the form the two findings above are written in
- The finding and issue log template — tracking seven findings and the register corrections
- Fieldwork and testing guides and internal controls guides — the full collections
- How to Audit Capital Projects and Construction Contracts — contracts, change orders, pay applications and cost recovery.
- Internal Audit in Manufacturing: The Complete Guide — plants, inventory, supply chain and safety.
- Internal Audit in Energy and Utilities: The Complete Guide — rate cases, NERC CIP, pipeline safety and OT security.
Leave a Reply