A ghost employee almost never requires hacking a system — it requires one person having enough control over both hiring and payroll approval to create an employee record and keep approving payments to it with nobody else ever checking. The mechanism is administrative, not technical: an employee ID gets created, salary gets configured, and a bank account (often the creator's own, or a shared household account) receives the payment every month, indistinguishable in the payroll run from any other legitimate employee.
The steps, in order
- 01Create the employee recordUsually by someone with HR system access and no second approver required for a new hire below a certain level.
- 02Set the bank account for salary paymentThis is the step that actually leaves evidence — the account number on this record can be cross-checked against every other employee's account.
- 03Let the payroll run include it automaticallyA monthly payroll process that runs on whatever's in the system doesn't re-verify that every employee actually exists; it processes whatever's there.
- 04Keep it invisible by avoiding attentionNo unusual expense claims, no visible conflict, nothing that would prompt someone to ask who this person actually is.
The two checks that actually surface this — matching bank accounts across the whole employee population, and matching payroll against attendance records — are both full-population analytics, not something a sample-based review of a handful of employee files would typically stumble onto.
Why it survives for months, sometimes years
It survives because nobody is specifically looking for it. A payroll audit that checks calculation accuracy, statutory deductions, and approval sign-offs can pass every one of those checks for a ghost employee — the arithmetic is fine, the approval exists, the deductions are correctly computed. The scheme isn't an error in any individual calculation; it's an employee who shouldn't exist in the first place, which none of those checks are designed to ask about.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Payroll & employee costThe ghost employee payroll testing caughtOne employee ID had drawn a full salary for eleven months with no biometric attendance record at all. The HR file for that ID was thin in a specific way.
- Payroll & employee costPayroll fraud: red flags an auditor should test forGhost employees, duplicate bank accounts, unauthorized master changes before a payroll run, and the analytical procedures that surface them.
- Internal audit & IFCTesting segregation of duties: a practical approachThe classic SoD conflicts, how to test for them in a small finance team where perfect separation is not realistic, and how to document the compensating controls that stand in.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.