How to Conduct a Payroll Audit: Process, Fixes, and Recordkeeping

To conduct a payroll audit, pull your payroll and tax records for the period under review, then work methodically through four checks: whether each worker is classified correctly, whether the wage and tax math is right from hours worked all the way to money leaving your bank, whether deductions and garnishments follow the legal caps, and whether your internal controls would catch fraud. Correct each error you find, file amended returns where needed, and archive the results. Most businesses should run this review at least once a year; companies with high turnover or frequent pay changes benefit from quarterly reviews.

The urgency is not theoretical. The IRS charges escalating penalties on late payroll tax deposits, starting at 2% for deposits one to five days late and climbing to 15% once the tax remains unpaid ten days after the first IRS notice.¹ Officers and anyone with authority over company finances can be held personally liable for 100% of unpaid withheld income tax, Social Security, and Medicare under the Trust Fund Recovery Penalty, and the corporate veil does not block it.² W-2 filing errors run from $60 per form up to $680 per form for intentional disregard.³ That is the exposure the audit is designed to prevent.

Pull the Records First

Before checking a single number, assemble every document that feeds payroll. Gaps here become blind spots in the audit itself. You need:

A current Form W-4 for each employee, showing withholding elections that drive federal income tax deductions.⁴
Year-end W-2 records to compare against your payroll registers.⁵
Payroll registers broken out by gross pay, net pay, and each deduction category.
Timecards and time-tracking records for hourly employees.
Bank statements covering every payroll date in the audit period.
Form 940 (annual FUTA return), which reports the first $7,000 of wages per employee subject to the 6.0% FUTA tax; most employers get a 5.4% credit for paying state unemployment, dropping the effective rate to 0.6%.⁶
Form 941 quarterly returns showing wages, tips, and federal income, Social Security, and Medicare taxes withheld.
Garnishment orders with records of amounts withheld and remitted.
Benefit enrollment records for health insurance, retirement, and flexible spending accounts.
Fringe benefit records for taxable non-cash benefits, such as personal use of a company vehicle or group-term life insurance above $50,000.⁷

One boundary worth naming: this audit covers W-2 employees. Independent contractors paid on a 1099 fall outside standard payroll tax reporting because you generally do not withhold or deposit income taxes, Social Security, or Medicare on their behalf.⁸ Whether a given contractor should actually be a contractor is a separate question the classification step handles.

Check Who Is on Payroll and How They Are Classified

Classification errors compound quietly. Misclassifying an employee as an independent contractor means that if the IRS determines you had no reasonable basis for the classification, you become liable for the employment taxes you should have been withholding and depositing all along.⁸ Review every 1099 relationship and ask whether the business controls how, when, and where the work gets done. The more control you exercise, the more likely the worker is legally an employee.

Exempt Versus Non-Exempt

The other classification trap is internal. An employee labeled “exempt” from overtime must clear both a salary test and a duties test. The current federal minimum salary for the executive, administrative, and professional exemption is $684 per week ($35,568 annually), and highly compensated employees must earn at least $107,432 per year.⁹ Salary alone is not enough:

The executive exemption requires that the employee’s primary duty is managing the enterprise or a recognized department, that they customarily direct the work of at least two full-time employees, and that they have authority to hire or fire (or their recommendations carry real weight).
The administrative exemption requires office or non-manual work related to management or general business operations, with the employee exercising discretion and independent judgment on significant matters.
The professional exemption requires advanced knowledge in a field of science or learning, typically acquired through prolonged specialized education.¹⁰

Pull the job description and the actual duties for every exempt employee, then compare against these tests. A job title alone means nothing. Someone called “Assistant Manager” who spends 90% of their time stocking shelves is probably not exempt, regardless of what the offer letter says. If the audit turns up back overtime, you owe it.

Reconcile the Numbers

This is the mathematical core: verify that numbers match reality at every step from hours worked to dollars deposited.

Hours and Gross Pay

Compare timecards against the gross pay in your payroll register for each hourly employee. Verify that every hour was paid, including overtime at one and a half times the regular rate. Look for consistent rounding in one direction, unrecorded break deductions, or hours logged on days the employee was not scheduled. For salaried employees, confirm that the per-period amount matches the annual salary divided by the number of pay periods.

Tax Withholdings

Recalculate federal income tax withholding for a sample of employees by applying their W-4 elections to their gross wages. Then verify FICA. For 2026, Social Security tax is 6.2% on wages up to $184,500, and Medicare tax is 1.45% on all wages with no cap.¹¹¹² The employer pays a matching amount for both. Once an employee’s wages pass $200,000 in a calendar year, you must withhold an Additional Medicare Tax of 0.9% on the excess, with no employer match on that portion.¹³

Confirm that Social Security withholding stopped once an employee’s wages hit the $184,500 cap. Over-withholding past the wage base is a common error at companies where employees hold multiple positions or receive large bonuses late in the year.

Supplemental Wages

Bonuses, commissions, and back pay need separate attention. Employers may withhold federal income tax on supplemental payments at an optional flat rate of 22%, which must be applied consistently. If an employee’s supplemental wages exceed $1,000,000 in a calendar year, the mandatory withholding rate on the excess jumps to 37%.¹⁴ Verify the correct method and rate were applied to every supplemental payment.

Bank Reconciliation

Match every net pay figure in the register to a withdrawal on the bank statement. The totals should align exactly. Any discrepancy means either the system recorded a payment that was never sent or a payment went out that the system did not record. Both need immediate investigation.

Verify Deductions and Garnishments

Voluntary deductions for health insurance, retirement, and similar benefits should be checked against enrollment records. Confirm that deduction amounts match employee authorizations and that enrollment changes hit the correct pay date.

Court-ordered garnishments carry stricter rules. Federal law caps garnishment for ordinary consumer debt at the lesser of 25% of disposable earnings or the amount by which weekly disposable earnings exceed 30 times the federal minimum wage.¹⁵ Child support and alimony allow higher percentages:

50% of disposable earnings if the employee supports another spouse or child
60% if the employee does not support another spouse or child
An extra 5% if the support payments are more than 12 weeks overdue¹⁶

Tax levies from the IRS or state tax agencies are not subject to these percentage caps.¹⁶ When calculating disposable earnings for garnishment purposes, only legally required deductions reduce the base: federal and state taxes, Social Security, Medicare, and mandatory state unemployment contributions. Voluntary deductions like union dues or extra retirement contributions do not count.

Look for Fraud and Weak Controls

A payroll audit is not only about math. Ghost employees, where paychecks go to people who do not actually work for the company, are more common than most business owners want to believe. The red flags: employees with no personnel file, multiple direct deposits routing to the same bank account under different names, and payroll records showing no tax withholdings for certain individuals.¹⁷

Compare your payroll roster against the current employee list from HR. Verify that every person receiving a paycheck has a personnel file, a valid Form W-4, and a supervisor who can confirm they actually show up. Cross-reference timesheet signatures with known employees and look for irregular patterns in the handwriting or approval chain.

Segregation of Duties

The single most effective fraud prevention measure is making sure no one person controls the entire payroll process from start to finish. At a minimum, split these functions:

Employees record their own hours.
Supervisors review and approve timesheets.
A payroll specialist enters approved time into the system.
Someone who does not process payroll reconciles the bank statements.¹⁸

When the same person who adds employees to the system also cuts the checks and reconciles the bank account, you have created the exact conditions under which ghost employee schemes thrive. Document who performs each function and flag any overlaps.

Fix What the Audit Finds

When the audit reveals that federal employment taxes were underreported or overreported, correct the discrepancy by filing Form 941-X for the affected quarter. If you underpaid, submit the additional tax with the form. If you overpaid, you can apply the credit to a future quarter or file a refund claim.¹⁹

Fix the underlying error in your payroll system at the same time so it does not repeat. If individual employees were shorted on pay, issue corrective payments promptly. If withholdings were wrong, adjust the employee’s record and, where applicable, issue a corrected W-2 on Form W-2c. The longer these corrections sit, the more interest and penalty exposure accumulates. Unpaid overtime or minimum wage shortfalls carry their own risk: the Department of Labor can assess civil penalties of up to $2,515 per violation for repeated or willful violations, and courts can award liquidated damages equal to the amount of unpaid wages, effectively doubling what the employer owes.²⁰

Keep the Records

Federal law imposes overlapping retention periods, and you must satisfy the longest applicable requirement. The IRS requires employment tax records to be kept for at least four years after the later of the return’s due date or the date the tax was paid.²¹ That includes records of fringe benefits and expense reimbursements.⁷

The Fair Labor Standards Act runs on its own schedule: payroll records, collective bargaining agreements, and sales and purchase records for at least three years, and records used as the basis for wage calculations (timecards, piece-rate tickets, work schedules, wage rate tables) for at least two years.²² In practice, the IRS four-year rule will be the binding requirement for most payroll documents. Archive the completed audit report itself alongside them; it becomes the baseline for next year’s review.

1
Internal Revenue Service. Publication 15 (2026), Circular E, Employer’s Tax Guide
2
Internal Revenue Service. 5.19.14 Trust Fund Recovery Penalty
3
Internal Revenue Service. Information Return Penalties
4
Internal Revenue Service. About Form W-4, Employee’s Withholding Certificate
5
Internal Revenue Service. About Form W-2, Wage and Tax Statement
6
Internal Revenue Service. FUTA Credit Reduction
7
Internal Revenue Service. Employment Tax Recordkeeping
8
Internal Revenue Service. Independent Contractor (Self-Employed) or Employee
9
U.S. Department of Labor. Earnings Thresholds for the Executive, Administrative, and Professional Exemption
10
U.S. Department of Labor. Fact Sheet 17A – Exemption for Executive, Administrative, Professional, Computer and Outside Sales Employees Under the FLSA
11
Internal Revenue Service. Topic No. 751, Social Security and Medicare Withholding Rates
12
Social Security Administration. Contribution and Benefit Base
13
Internal Revenue Service. Questions and Answers for the Additional Medicare Tax
14
eCFR. 26 CFR 31.3402(g)-1 – Supplemental Wage Payments
15
Office of the Law Revision Counsel. 15 U.S. Code 1673 – Restriction on Garnishment
16
U.S. Department of Labor. Fact Sheet 30 – Wage Garnishment Protections of the Consumer Credit Protection Act
17
Department of Defense Office of Inspector General. Fraud Scenario – Ghost Employees
18
Office for Victims of Crime. Internal Controls and Separation of Duties Guide Sheet
19
Internal Revenue Service. Instructions for Form 941-X
20
eCFR. 29 CFR Part 578 – Tip Retention, Minimum Wage, and Overtime Violations, Civil Money Penalties
21
Internal Revenue Service. How Long Should I Keep Records
22
U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the FLSA