How to Audit Payroll: Controls, Recalculation, and Compliance

To audit payroll, you draw a boundary around a specific time period, pull the complete set of pay and tax records inside it, test whether the controls between a timecard and a bank transfer actually work, recalculate a sample of paychecks line by line, verify that your tax filings and wage-law practices hold up, correct anything broken, and document the whole exercise in workpapers a reviewer could follow cold. Done well, this process catches calculation mistakes and control gaps before they turn into IRS penalties, Department of Labor back-wage orders, or lawsuits. The federal failure-to-deposit penalty alone starts at 2% of a late payroll tax deposit and climbs to 15% once you ignore an IRS notice, so the work pays for itself quickly.¹

Set the Scope and Pull the Records

Pick the window first. One fiscal quarter or a full fiscal year is typical, chosen based on where the risk sits. A recent payroll system change or turnover in the payroll department makes that transition period the obvious candidate.

Inside the window, bring in every component of pay: base wages and salaries, commissions, bonuses, shift differentials, and accrued paid time off. Deductions get the same scrutiny. That means both mandatory withholdings (federal and state income tax, FICA) and voluntary deductions like 401(k) contributions and health insurance premiums. The 2026 401(k) elective deferral limit is $24,500, so any employee contribution approaching that ceiling needs a second look.²

The documents you need include the employee master file (pay rates, classification status, tax elections), timekeeping records, the payroll register, and the general ledger entries for total payroll expense. Pull signed Forms W-4 for withholding elections and completed Forms I-9 verifying employment eligibility.³⁴ Add authorization forms for every voluntary deduction, and an organizational chart if you have one showing how data moves from time entry to final disbursement.

Test the Controls Between a Timecard and a Paycheck

Start with a walkthrough. Follow a single pay cycle from the moment an employee clocks in through the bank transfer, confirming every handoff and approval. You are looking for the places where the process would catch an error or a deliberate manipulation, and the places where it wouldn’t.

Segregation of duties is the single most important control. The person who enters time or edits the master file cannot also be the person who authorizes the disbursement or reconciles the bank account. If one individual can create an employee record, submit hours for that person, and release the payment, that is a textbook ghost-employee setup. Pull user access logs from the payroll system and map each user’s permissions against the approval hierarchy. Any overlap is a finding.

Changes to key data need authorization on paper. Every new hire’s pay rate should carry a manager sign-off before the first check runs. Every termination needs documentation and prompt processing; a terminated employee lingering on the payroll is one of the most common fraud patterns. Changes to the master file (addresses, pay rates, bank account numbers) should generate a change log showing the old value, the new value, and who approved it.

Timecard approvals get tested the same way. Sample a set of time records and verify that a supervisor reviewed and signed off before payroll ran. The FLSA does not dictate a specific timekeeping format, but whatever system you use has to produce complete and accurate records.⁵ If policy calls for daily supervisor approval and your records show batch sign-offs days after the pay period closes, flag the gap.

Run the Queries That Surface Fraud

Control walkthroughs tell you what should happen. Data queries tell you what did. Run these across the full payroll population for your audit window:

Two or more employees depositing into the same bank account. A duplicate-match report across direct deposit records surfaces one of the strongest ghost-employee indicators.
Employees sharing an address or phone number with each other or with an accounts payable vendor.
Blank or duplicate Social Security numbers in the payroll file. Sometimes a data entry error, sometimes a fabricated record.
Any employee appearing on the payroll register after their documented termination date. Compare HR termination dates against the last disbursement for every separated employee in the window.
Payments appearing before an employee’s official start date, which can indicate backdating.

None of these prove fraud on their own. Each is a thread worth pulling, and several hits in the same department or under the same supervisor’s authority should push you to expand your substantive sample in that area.

Recalculate a Sample of Paychecks

Substantive testing is where you redo the math. Pull a representative sample across departments, pay frequencies, and employee types. Weight the sample toward areas where control testing came back weak.

Gross Pay

For hourly employees, take the verified hours from timekeeping and multiply by the authorized rate from the master file. Compare the result to the gross pay figure in the payroll register. For salaried staff, divide annual compensation by the number of pay periods and confirm the per-period figure. Trace any bonuses or commissions back to their documented approval and calculation method. A $0.50 rounding error on an hourly rate, spread across 2,000 hours and dozens of employees, builds fast.

Deductions

Check federal income tax withholdings against the current IRS tables in Publication 15-T and the employee’s Form W-4.⁶ Confirm that Social Security withholding stops once an employee’s earnings reach $184,500 for 2026; Medicare has no wage cap.⁷ Voluntary deductions like 401(k) contributions cannot exceed either the signed authorization or the applicable IRS annual limit.⁸

Garnishments

For sampled employees with active garnishment orders, verify the calculation. Federal law caps ordinary garnishments (not child support or tax levies) at the lesser of 25% of disposable earnings or the amount by which weekly disposable earnings exceed 30 times the federal minimum wage.⁹ Disposable earnings here means what remains after legally required deductions like taxes and the employee’s share of Social Security and Medicare. Voluntary deductions do not reduce the garnishment base. Getting this wrong exposes you to liability from both the creditor and the employee.

Net Pay and Where It Landed

Confirm the calculated net pay actually reached the right person. Trace net pay from the register to the EFT file or cancelled check image. Match employee names and bank account numbers on the disbursement against the master file. Payment diversion schemes often start with a small, unquestioned bank account change.

Finish the substantive block with period-end accruals. Verify that accrued vacation and sick leave liabilities match company policy and that total payroll expense in the general ledger reconciles to your quarterly and annual payroll tax filings.

Check Tax and Wage-Law Compliance

This is the highest-stakes portion of the audit. Errors here carry direct penalties and, in some cases, personal liability for whoever signs the returns.

Federal Tax Filings and Deposits

Sample the quarterly Form 941 filings and reconcile reported wages and withholdings to the general ledger. Verify deposits were made on time under the correct schedule. If your total tax liability during the lookback period was $50,000 or less, you deposit monthly; above that, semiweekly.¹⁰ The failure-to-deposit penalty starts at 2% for one to five days late and escalates to 10% after fifteen days, then to 15% if payment doesn’t arrive within ten days of an IRS notice.¹

Annual wage reporting through Form W-2 is the other critical checkpoint. The statutory deadline to furnish W-2s to employees is January 31; when that falls on a weekend or holiday, it moves to the next business day.¹¹ Late filing triggers per-form penalties that climb from $60 to $340 depending on how late, and reach $680 per form with no cap for intentional disregard.¹² For a company with hundreds of employees, those numbers compound quickly.

The Trust Fund Recovery Penalty

Income tax and FICA withheld from paychecks is held in trust for the federal government. If those funds are not turned over, the IRS can assess a penalty equal to 100% of the unpaid trust fund taxes against any “responsible person” who willfully failed to pay. Officers, directors, or anyone with authority over the company’s financial decisions can be held personally liable, even if the business itself goes bankrupt.¹³ Late or missing trust fund deposits warrant immediate escalation, not a line item in the final report.

FLSA Classification and Overtime

Verify that every employee classified as exempt actually qualifies. To meet the federal exemption for executive, administrative, and professional roles, the employee has to pass a duties test and earn at least $684 per week on a salary basis.¹⁴ Misclassifying someone as exempt to avoid overtime is one of the most expensive FLSA violations. A court finding willful misclassification can order back pay covering three years of unpaid overtime for every affected worker.

For non-exempt employees, recalculate overtime on sampled records. The rate has to be at least one and one-half times the regular rate for all hours over 40 in a workweek.¹⁵ Watch how the regular rate is computed when the employee earns bonuses or shift premiums; those amounts often have to be folded in before applying the overtime multiplier. State labor codes often impose stricter meal and rest break rules than federal law, so include those in your check.

1099 Workers

Review the working relationship of anyone receiving a Form 1099. The IRS evaluates three categories of evidence: behavioral control (do you direct how the work is done?), financial control (do you control the business aspects of the worker’s job?), and the type of relationship (are there benefits, written contracts, or an expectation of permanence?).¹⁶ If a 1099 worker looks like an employee under those factors, the employer faces retroactive liability for the worker’s share of FICA, income tax withholding, and FUTA taxes. A limited safe harbor under Section 530 of the Revenue Act of 1978 can shield employers from reclassification liability if the worker was consistently treated as a contractor, all required 1099s were filed, and the classification rested on a reasonable basis.¹⁷ Document that analysis now if any classifications look questionable.

Unemployment Insurance

FUTA applies at 6.0% on the first $7,000 of wages per employee each year. Employers who pay state unemployment taxes on time and in full receive a credit of up to 5.4%, dropping the effective FUTA rate to 0.6%.¹⁸ Confirm that wages reported to state unemployment agencies match the wages on your federal filings. State unemployment wage bases vary, so verify you are applying the right cap in each state where you have employees.

Fix What You Find

If the audit shows underreported payroll taxes on a previously filed Form 941, correct the error by filing Form 941-X for the specific quarter affected. File a separate 941-X for each quarter. When you underpaid, use the adjusted employment tax return process and pay the difference. When you overpaid, choose between applying the credit to a future return or filing a formal claim for refund.¹⁹ Either way, certify whether corrected W-2c forms have already been issued to affected employees.

For FLSA violations like unpaid overtime, calculate the back wages and pay them. Document everything. Self-correcting before a Department of Labor investigation begins generally helps on penalties. For retirement plan errors like late 401(k) deposits, the DOL’s Voluntary Fiduciary Correction Program lets employers self-correct certain ERISA violations and receive conditional relief from excise taxes.²⁰

Keep the Records Long Enough to Defend the Work

Federal law imposes overlapping retention periods. The longest applicable period is the one you follow.

Employment tax records (Forms 941, 940, W-2, W-4) must be kept at least four years after the later of the tax due date or the date the tax was paid.²¹
FLSA payroll records (pay rates, deductions, total wages) must be kept at least three years, with supporting documents like time cards and work schedules kept two years.⁵
Retirement plan records under ERISA Section 107 must be kept at least six years after the filing date of the documents based on them.

Because the IRS four-year clock does not start until the tax is paid or due, and the ERISA period runs six years, most employers adopt a blanket six-year retention policy for all payroll records. One rule covers every federal requirement with margin to spare.

Write Up the Findings

Every test needs workpapers a reviewer could pick up cold and follow. Document the sampling methodology, the population you drew from, each control tested, and every calculation discrepancy. If you tested 40 overtime calculations and two were wrong, the workpapers show exactly which two, what the correct amount should have been, and the dollar impact.

The final report pulls the workpapers into a structured document for management. Organize findings by severity. A material weakness like one person being able to create employees and authorize their payments ranks above a minor process gap like inconsistent timecard signatures. Each finding carries four elements: the condition (what you found), the criteria (what the rule or policy requires), the effect (the financial or compliance risk), and a specific recommendation. “Improve controls” wastes everyone’s time; “restrict master file edit access to the HR director and require a second approval from the controller for all pay rate changes” gives management something to act on.

Schedule an exit conference to walk management through the results. The cycle closes when management provides a written response and a timeline for implementing each recommendation. That response joins the permanent file and becomes the starting point for the next audit.

1
Internal Revenue Service. Failure to Deposit Penalty
2
Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500
3
Internal Revenue Service. About Form W-4, Employee’s Withholding Certificate
4
U.S. Citizenship and Immigration Services. I-9, Employment Eligibility Verification
5
U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
6
Internal Revenue Service. Publication 15-T Federal Income Tax Withholding Methods
7
Social Security Administration. Contribution and Benefit Base
8
Internal Revenue Service. Retirement Topics – 401(k) and Profit-Sharing Plan Contribution Limits
9
U.S. Department of Labor. Fact Sheet 30 – Wage Garnishment Protections of the Consumer Credit Protection Act (CCPA)
10
Internal Revenue Service. Instructions for Form 941 (03/2026)
11
Social Security Administration. Deadline Dates to File W-2s
12
Internal Revenue Service. Information Return Penalties
13
Office of the Law Revision Counsel. 26 U.S. Code 6672 – Failure to Collect and Pay Over Tax, or Attempt to Evade or Defeat Tax
14
U.S. Department of Labor. Fact Sheet 17A – Exemption for Executive, Administrative, Professional, Computer and Outside Sales Employees Under the Fair Labor Standards Act
15
U.S. Department of Labor. Fact Sheet 23 – Overtime Pay Requirements of the FLSA
16
Internal Revenue Service. Independent Contractor or Employee
17
Internal Revenue Service. Worker Reclassification – Section 530 Relief
18
Internal Revenue Service. Topic No. 759, Form 940 – Employers Annual Federal Unemployment (FUTA) Tax Return
19
Internal Revenue Service. Instructions for Form 941-X
20
U.S. Department of Labor. Voluntary Fiduciary Correction Program
21
eCFR. 26 CFR 31.6001-1 – Records in General