Waiting lists at risk of doctoring, auditor says