A payroll audit should specifically test for ghost employees on the payroll master, duplicate bank account numbers shared across different employee records, unauthorized or unapproved changes made to employee master data in the window just before a payroll run is processed, and anomalies surfaced by comparing headcount trends to payroll cost trends month over month. These four tests are cheap to run across the full population and catch most of the schemes that actually occur in mid-market payroll.
Why payroll fraud is structured the way it is
Payroll fraud almost always exploits one of two things: the master data that generates recurring payments, or the approval gap between when a payroll run is prepared and when it is actually disbursed. Both are weaknesses in control design rather than in any single transaction, which is why testing a sample of payslips rarely finds anything — the fraud is in the data that generates the payslips, not in the arithmetic of any one of them.
Ghost employees
A ghost employee is a name on the payroll master that does not correspond to a real, currently employed person — either entirely fictitious, or a genuine former employee whose record was never deactivated after exit, with payments continuing to flow to an account someone still controls.
- 01Reconcile the payroll headcount to an independent sourceHR's own attendance or access-card system, not a report generated by the same payroll function. Independence of the comparison source is the whole point — reconciling payroll to payroll proves nothing.
- 02Obtain the exit list from HR and confirm each exited employee's master record was deactivated in the same month, not a later oneA gap between the exit date and the deactivation date is exactly the window in which a ghost payment can be made to look routine.
- 03Request physical sighting or video-call confirmation for a sample of employees, weighted toward unusual-looking recordsThis is a more intrusive test and is usually reserved for situations where other indicators already point toward elevated risk, but it is the most direct way to confirm a name corresponds to a real person.
- 04Check for employees with no statutory deductions at all despite an active recordAn employee with no PF, no ESI, and no TDS activity across an entire year, with no documented exemption basis, is worth a specific follow-up.
Duplicate bank accounts across employee records
This is a full-population test that runs in minutes once the employee master is in a workable file, and it is one of the highest-yield checks in the entire payroll audit.
| Pattern found | Possible explanation | Follow-up |
|---|---|---|
| Same account number against two active employee codes | A single individual holds two employee records, drawing two salaries | Identify both employees, confirm whether both are genuine and distinct people, and check who created the second record and when |
| Same account number against an active employee and an exited employee | A ghost continuation — payments to an exited employee's account routed through a newly created or reactivated record | Trace the payment history on the newer record back to its creation date and compare against the exit date on the older one |
| Same account number against employees in different departments or locations with no apparent connection | Could be a genuine family banking arrangement, or could be collusive — two different people funneling pay to one account | Request an explanation and corroborate against HR records before accepting it at face value |
Common practice, not a requirement
Running this match is not a requirement of any standard, but it has become close to standard practice in payroll audits precisely because it is inexpensive relative to what it finds. Treat an absence of any hits as mildly reassuring, not as proof the master is clean — it only rules out this one specific pattern.
Unauthorized master changes before a payroll run
The riskiest window in the payroll cycle is the gap between when attendance and inputs are locked and when the payroll run is actually processed and sent for disbursement. A change made in that window — a new bank account, a salary revision, a new joiner added — has the least time for anyone to notice before money moves.
- 01Obtain the system-generated change log for the employee master, with timestamps and user IDsIf the system cannot produce this, that absence is itself a control deficiency worth reporting, independent of whether any specific fraud is found.
- 02Isolate changes made in the window between the attendance cut-off and the payroll run date for each month testedThis narrows a potentially large change log down to the changes with the least opportunity for independent review before payment.
- 03For each change in that window, check for a corresponding approval — not just a system log entry showing who made the change, but evidence someone else authorized itA single person with the ability to both change the master and process the run, with no second approver, is a segregation-of-duties gap that makes every change in this window inherently higher risk.
- 04Pay specific attention to bank account changes in this windowA bank account change made days before disbursement, for an existing employee with an otherwise unremarkable record, is one of the clearest single indicators of an attempted diversion.
A bank account change followed within days by a payroll run, with no employee-initiated request on file to explain the change, should be treated as a specific risk item and followed up directly with the employee where practicable — not simply noted and moved past because the amount involved is small.
Analytical procedures: headcount versus cost trend
A simple month-on-month comparison of headcount against total payroll cost, run across the full year, surfaces anomalies that no sample-based testing is designed to find, because the anomaly is in the relationship between two totals rather than in any individual transaction.
- Payroll cost rising while headcount stays flat or falls, with no corresponding salary revision or bonus event, warrants investigation before anything else in the file is tested.
- Headcount rising while per-employee average cost stays suspiciously constant across new joiners with different roles and seniority can indicate records added with copy-pasted salary structures rather than genuine individual appointments.
- A department or location with cost movement that diverges from the rest of the entity, with no business explanation volunteered by management, should be flagged for a closer look at that unit's master data specifically.
- Comparing the ratio of statutory deductions to gross pay month over month — it should move only within a narrow, explainable band, and a sudden shift can indicate wholesale changes to PF/ESI applicability flags on the master that were never individually reviewed.
How we think about this
Every test described here — matching an account number across records, isolating a change inside a date window, comparing two trend lines — is a full-population scan, not a sample, and that is precisely the kind of work software should be doing before a person ever opens the file. What a system cannot do is decide, once a pattern surfaces, whether it reflects fraud, an honest administrative error, or a legitimate but undocumented family arrangement. That conversation with the client, and the judgement that follows it, stays with the auditor.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Payroll & employee costPayroll audit procedure: a complete checklistMaster data testing, gross-to-net recomputation, statutory deduction checks, and the approval trail — the full payroll audit procedure in order.
- Payroll & employee costContractor vs employee classification: the audit riskWhy misclassification creates PF, ESI, and TDS exposure, the indicators to look for, and how GST on contractor invoices differs from salary.
- Payroll & employee costPF and ESI compliance testing in a statutory auditApplicability, challan matching, due-date testing, and the employer-versus-employee contribution reconciliation — the PF and ESI compliance checks a payroll audit needs.
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.