Payroll audit procedure: a complete checklist

A payroll audit procedure runs in four stages: test the employee master for unauthorized or stale records, recompute gross-to-net for a sample of employees across a sample of months, test statutory deductions (PF, ESI, professional tax, TDS) against the applicable rules, and verify that every payroll run carries evidence it was reviewed and approved before disbursement. Each stage depends on the one before it — a master data defect invalidates everything computed on top of it.

Why payroll audit is treated as a separate section

Payroll is usually one of the largest expense lines in a services or manufacturing business, and it is also one of the few expense lines where a single data error — a wrong rate, a duplicate employee code, an unauthorized master change — repeats itself every month until someone catches it. Testing a transaction sample without first testing the master that generates those transactions misses exactly this kind of error.

Stage 1: employee master data testing

The employee master is the table that drives every payroll run: employee code, name, bank account, PF/ESI applicability, salary structure, date of joining, date of exit. Changes to it should be rare, approved, and visible.

1. 01Obtain the full employee master and the change log for the periodMost payroll systems log master changes with a timestamp and user ID. If the client's system cannot produce this log, note it as a control gap rather than skipping the step.
2. 02Reconcile headcount to HR records independently of payrollCompare the payroll master count to the HR attendance system or the organization chart maintained outside payroll. A name on the payroll master that does not appear anywhere else is the definition of a ghost employee risk.
3. 03Test for duplicate bank accounts and duplicate PAN/Aadhaar across employee recordsOne bank account number linked to two employee codes is the single highest-yield check in this stage. It surfaces both ghost employees and genuine but undisclosed dual employment.
4. 04Trace a sample of new joiners to appointment letters and a sample of exits to the full-and-final settlementConfirms the master reflects real employment events and that exits actually stopped future payroll runs rather than being flagged and forgotten.
5. 05Review master changes made just before a payroll run for approval evidenceA salary revision, bank account change, or new-joiner entry added in the window between attendance lock and payroll processing, with no corresponding approval, is exactly the pattern used to divert a payment.

Stage 2: gross-to-net recomputation

This is the arithmetic core of the audit: for a sample of employees in a sample of months, recompute gross pay from the salary structure and attendance data, then recompute every deduction down to net pay, and compare to what was actually paid.

Pick the sample across both employees and months, not just employees. A control that holds for March can fail in a month with a mid-cycle salary revision or an attendance correction, and a monthly sample that always lands on the same quiet month will never find that.

Stage 3: statutory deduction testing overview

Gross-to-net recomputation checks that deductions were calculated correctly against the employee master. Statutory deduction testing checks the other direction: that what was deducted and the matching employer contribution were actually deposited with the right authority, on time, for the right amount. This overlaps with, but is distinct from, PF/ESI compliance testing and TDS testing, which are detailed enough to warrant their own procedures.

• Agree total PF and ESI deducted per the payroll register to the challans filed for the corresponding month.
• Agree total TDS deducted to the amount deposited and, at a summary level, to the quarterly TDS return.
• Test professional tax deduction against the applicable state slab for a sample of employees — slabs vary by state and change periodically.
• Check due-date compliance for each statutory payment and flag any late deposit for the interest-on-delay implication.

Stage 4: the approval trail for payroll runs

A payroll run that is arithmetically correct but never reviewed by anyone before disbursement is still a control failure. The approval trail should show, for each run tested, who prepared it, who reviewed it, and what the reviewer actually looked at.

1. 01Identify who has system access to initiate a payroll run and who has access to approve disbursementThe same person should not hold both unless the entity is small enough that segregation is genuinely impractical, in which case a compensating review is needed and should be evidenced.
2. 02Obtain the sign-off evidence for the runs in your sampleAn email approving a lump-sum total is weaker evidence than a reviewer sign-off on the actual register, because the former cannot show that anything was actually checked.
3. 03Trace the approved register to the bank file or salary disbursement instructionConfirms the amount approved is the amount actually paid, and that no change was made to the file between approval and transmission to the bank.
4. 04Check that month-on-month variance in the total payroll cost was reviewed by someone, and that large variances have a stated reasonThis is the cheapest control an entity can run and the one most often skipped in practice.