This is a composite, illustrative scenario built from how a ghost-employee red flag typically surfaces and gets confirmed, not an account of a named client. A payroll analytics check — matching every employee ID against its biometric attendance record — found one ID that had drawn a full monthly salary for eleven consecutive months with zero attendance punches recorded. A second check, matching bank account numbers across the payroll file, showed that ID's salary account number was identical to a department manager's own account. The combination meant someone was being paid who did not appear to actually be coming to work, and the money was landing in an account controlled by the person who had hired them onto the payroll.
Why this needed two separate checks to confirm
Zero attendance alone has innocent explanations — a remote role, a long leave of absence, a biometric device fault for one location. A shared bank account alone also has innocent explanations — a family member genuinely employed, paid into a joint household account. Neither fact alone is conclusive. Both facts together, on the same ID, is a pattern worth investigating directly rather than accepting either explanation separately.
What was checked before raising it
- 01Pulled the HR personnel file for that employee IDThe file existed but was unusually thin — an offer letter and a PAN card copy, no appraisal record, no leave application history, nothing a genuine eleven-month tenure would typically generate.
- 02Checked who had approved the original hiring and the monthly payroll runThe same department manager whose bank account matched the ID's salary account had both hired this employee and was the approving manager on the monthly payroll run — one person controlling both ends.
- 03Asked HR directly whether the person existedHR had no record of ever meeting the individual in person and could not confirm their physical presence at any point.
- 04Escalated to the engagement partner before approaching the managerA suspected fraud involving payroll diversion is a reportable matter under the firm's fraud-response policy, and the approach to the client had to go through the partner and, per the client's own whistleblower policy, potentially the audit committee — not be raised informally with the implicated manager first.
What the investigation found
The audit's role stopped at identifying and quantifying the pattern and referring it — confirming or disproving fraud and identifying the responsible individual is an investigation, not an audit procedure, and the client engaged a forensic specialist to take it further. What the audit quantified was the amount: eleven months of salary, at that ID's pay grade, representing the maximum exposure if the pattern was confirmed as fraudulent.
| Scope | |
|---|---|
| Identified the red-flag pattern and quantified the amount | Within audit scope — this is what the analytics procedure is for |
| Confirmed whether fraud actually occurred, and by whom | Outside audit scope — referred to the client's own investigation/forensic process |
| Assessed the control gap that allowed it (one person hiring and approving payroll for the same ID) | Within audit scope — this is an internal control finding regardless of the investigation's outcome |
| Widened the same two-check analysis across the full payroll population | Within audit scope — to see whether this was isolated or a pattern |
What went into the file
- The two red flags — zero attendance and the matching bank account — documented with the underlying data extracts, not just a narrative description.
- The amount quantified: eleven months at that pay grade.
- The widened check across the full payroll population, confirming no second instance of the same pattern.
- The referral to the client's management and, per policy, the audit committee, with the date and who it was escalated to.
- A control finding on segregation of duties between hiring approval and payroll approval, independent of the investigation's eventual outcome.
How we think about this
Neither red flag was visible from a sample-based vouching approach — both only exist as a pattern across the full employee population, matched against itself (attendance to payroll, bank account to bank account). This is specifically the kind of exception full-population analytics surfaces that transaction-level sampling structurally cannot.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Payroll & employee costPayroll fraud: red flags an auditor should test forGhost employees, duplicate bank accounts, unauthorized master changes before a payroll run, and the analytical procedures that surface them.
- Payroll & employee costPayroll audit procedure: a complete checklistMaster data testing, gross-to-net recomputation, statutory deduction checks, and the approval trail — the full payroll audit procedure in order.
- Internal audit & IFCTesting segregation of duties: a practical approachThe classic SoD conflicts, how to test for them in a small finance team where perfect separation is not realistic, and how to document the compensating controls that stand in.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.