Payroll Audit: From Employee Master to Cash Outflow

A payroll total can agree to the ledger while individual payments are still wrong. The useful question is whether each payment can be traced through a legitimate employee record, approved inputs, an accurate calculation and a controlled release.

The following five-checkpoint map is an Inside Assurance practical approach. Adapt the procedures and extent of testing to the process, assessed risk and engagement objective.

1. Establish who should be paid
Start with the employee master used for the payroll run. Reconcile the population to authorized HR records, including joiners, leavers and relevant effective dates. For selected entries, connect the employee identifier to employment documentation and the period being paid.

Look for unexplained payments after a termination date, duplicate identifiers or unsupported changes. A match on a bank account is a lead to understand; a legitimate explanation may exist.

2. Connect pay inputs to authority
Trace rates, allowances, hours and one-off adjustments to the responsible approver and supporting records. For changes to pay or bank details, identify who requested, entered and approved the change, and when it took effect.

Evidence should identify the approved version. A screenshot of an approval is less useful if the payment file was changed afterward.

3. Recalculate selected amounts
Independently recompute selected gross-to-net calculations using applicable terms and rules for the period. Consider overtime, deductions, leave and unusual manual adjustments where relevant.

Record the inputs used, the calculation performed and the differences investigated. This article does not prescribe tax rates, employee entitlements or a universal sample size.

4. Follow the release into the bank
Compare the approved payroll register with the payment file actually released. Inspect payment-release authority and investigate changes between approval and submission.

A proposed control is to separate master-data maintenance, payroll preparation and payment release where practicable. Where staffing is limited, an independently evidenced review should address the incompatible responsibilities; a second signature alone does not demonstrate an effective review.

5. Close the loop
Reconcile released payments to bank results and the payroll ledger. Track rejected transfers, reversals, corrections and outstanding balances to their resolution. Matching totals does not validate individual beneficiaries. Agreement of totals is a starting point; investigate offsetting items and timing differences rather than clearing them without support.

Turn a signal into a documented conclusion
For a hypothetical payment made after an employee's recorded leaving date, first establish whether it represents final salary, an authorized settlement, a timing issue or an unsupported payment. The date mismatch itself establishes none of those explanations.

Document the exception, evidence obtained, remaining uncertainty and the action owner. A walkthrough explains a process; it does not establish that controls operated consistently throughout a period.

GAO's time-and-attendance guidance informs the approval principle, while its Green Book informs segregation and alternative-control considerations. Both have a US federal context and are used here as conceptual references, not local payroll requirements or endorsements.

The objective is a connected evidence trail: the right employee, authorized inputs, accurate pay and an explained cash outcome.