Payroll fraud is one of the most common, most costly, and most preventable forms of internal fraud — and it almost always goes undetected until someone stumbles across it by accident. Ghost employees collecting salaries for years. Terminated staff whose pay quietly redirects to a fraudster’s account. Overtime claims that no one questions because no one is looking closely enough. This Payroll Audit Program changes that. With 79 audit procedures across 10 specialist sections, it gives internal auditors, forensic investigators, and finance teams a rigorous, data-driven framework to audit every layer of payroll — from proving the gross-to-net reconciliation to detecting ghost employees, bank account diversions, tax code manipulation, and segregation of duties failures. Every procedure comes with detailed audit steps and the exact data source or file required, so you can move from planning to fieldwork immediately. Designed for use on a monthly or periodic basis, this program turns payroll from your organisation’s biggest blind spot into one of its best-controlled processes.
Section 1 — Payroll Proof and Reconciliation (7 procedures)
Before testing anything else, prove the numbers stack up. This section reconciles gross pay to net pay, agrees total payroll cost to the general ledger, proves PAYE and pension remittances, reconciles headcount to the HR system, and verifies that the payment run control total matches the bank output file exactly. If something has been added or removed after sign-off, this section will find it.
Section 2 — Payroll Master File Integrity (7 procedures)
The master file drives every payroll run. This section tests the completeness of all mandatory employee fields, validates grade and allowance codes against approved schedules, identifies employment status mismatches between payroll and HR, reviews all master file changes made in the period, and flags changes with no corresponding HR trigger — a classic indicator of unauthorised manipulation.
Section 3 — Ghost Employee Detection (9 procedures)
The most comprehensive ghost employee testing section available. Uses nine distinct detection methods — duplicate NI/SSN/tax numbers, payroll-to-personnel file matching, employees with no leave record, no performance review, no IT account, no building access, no place on the organisational chart, shared home addresses, and recently added high-salaried employees without verified contracts. No ghost survives all nine tests.
Section 4 — Starters and Leavers Testing (8 procedures)
Unremoved leavers are the easiest payroll fraud to commit and the easiest to miss. This section identifies terminated employees still being paid, overpayments beyond the termination date, bank account changes made just before termination, employees paid before their official start date, starters without signed contracts, and employees who have passed mandatory retirement age but remain on the active payroll.
Section 5 — Salary and Grade Validation (8 procedures)
Every salary should sit within the approved pay band for its grade. This section identifies employees paid below the minimum or above the maximum for their grade, flags salary increases without authorisation or exceeding policy limits, detects the high-risk combination of a salary increase and a bank account change on the same day, analyses pay compression between managers and subordinates, and reviews part-time pay pro-rating and pay equity across demographic groups.
Section 6 — Overtime and Allowances Testing (8 procedures)
Excessive overtime and inflated allowances are among the most exploited payroll fraud vectors. This section ranks the top overtime earners, identifies overtime exceeding policy limits or claimed on non-working days, tests allowance reasonableness by grade, analyses travel and subsistence claims, flags allowances paid to employees on unpaid leave or suspension, and detects the critical segregation failure where an employee approves their own overtime.
Section 7 — Tax Codes and Deductions Testing (8 procedures)
An incorrectly set tax code can mean years of under-deducted PAYE — and deliberate manipulation is a known payroll fraud. This section assesses tax code reasonableness by salary band, extracts and investigates all tax code changes, identifies employees on zero or emergency codes, recalculates expected PAYE for a sample and compares to actual deductions, and verifies the completeness and timeliness of pension, loan, and garnishee order deductions.
Section 8 — Leave and Absenteeism Analysis (8 procedures)
Leave records reveal both compliance gaps and people risks. This section identifies employees who have exceeded their annual leave or sick leave entitlement, analyses sick leave by day of the week to detect Monday/Friday abuse patterns, produces a departmental absenteeism heatmap, tests leave without pay salary suspension, reviews uncertified sick leave frequency, and validates leave encashment calculations and authorisations.
Section 9 — Bank Account and Payment Tests (8 procedures)
Bank account fraud is the most direct route to stealing from a payroll. This section identifies duplicate bank accounts across the payroll, matches employee accounts against the accounts payable vendor master file, extracts all bank account changes and verifies authorisation, flags multiple changes by the same employee, detects changes made within three days of the payment run, identifies payments to non-standard account types, and runs the critical test of matching payroll administrator bank details against the payment file they control.
Section 10 — Segregation of Duties and System Controls (10 procedures)
Payroll fraud is most often enabled by one person having too much access. This section builds a full segregation of duties matrix, tests for self-payment by payroll administrators, verifies formal approval of each payroll run, confirms terminated user access was revoked, reviews privileged and super-user access, assesses the completeness of the system audit trail, tests for independent monthly verification, reviews physical payslip distribution controls, confirms multi-factor authentication is enforced, and assesses payroll business continuity and backup arrangements.
Reviews
There are no reviews yet.