Payroll Audit
A practical starting point for assessing whether employees paid are valid, authorised and accurately paid, and payroll changes, deductions and exits are properly controlled.
What are we trying to establish?
Determine whether employees paid are valid, authorised and accurately paid, and payroll changes, deductions and exits are properly controlled.
Risks worth paying attention to
What should you request?
- Approved employee master list and payroll register
- Employment, promotion, transfer and exit records
- Salary structure and approved allowances
- Payroll change reports and approval evidence
- Attendance, overtime and leave records
- Bank payment schedules and payroll reconciliation
- Statutory deduction schedules and remittance evidence
- Payroll system access and change logs
Understand the process before testing.
- Who initiates, reviews and approves transactions?
- Which duties should be separated?
- What system controls and approval limits apply?
- How are exceptions identified, approved and monitored?
- How does management know key controls actually operated?
Practical tests you can perform
Reconcile employee master data to payroll
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Test joiners, leavers and salary changes to approvals
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Analyse duplicate bank accounts and unusual employee data
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Recalculate selected salaries, deductions and overtime
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Review payroll-to-bank and payroll-to-ledger reconciliations
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Check timely removal of exited staff
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Review privileged payroll system access
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Confirm statutory deductions are accurately remitted
Obtain appropriate evidence, investigate exceptions and document your conclusion.
Things that should make you look deeper
- Transactions or activities outside normal patterns
- Missing or retrospective approvals
- Repeated exceptions without root-cause action
- Manual adjustments with weak supporting evidence
- Key controls dependent on one person
- Management reports that cannot be reconciled to source records
Questions that can open up the process
- What can go wrong in this process?
- Which controls are most important, and who performs them?
- Where does the process depend heavily on manual intervention?
- Which exceptions occur most often, and why?
- What information does management use to know the process is working?
Need a more detailed checklist?
Steal My Checklist contains ready-to-use audit procedures designed to help you structure fieldwork across key business areas.
Get Steal My Checklist