H2R Internal Audit Checklist: Hire-to-Retire RCM for HR and Payroll
Hire-to-retire internal audit tests the employee lifecycle from manpower approval to exit closure. Payroll audit is one part of H2R, but H2R is wider: requisition, recruitment, background checks, joining documents, master-data creation, attendance, salary changes, transfers, statutory mapping, resignations and full-and-final settlement.
The H2R audit question is whether every person paid by the company is valid, authorised, correctly classified and properly exited. The RCM below is an illustrative starting point and should be tailored to the entity's HRMS, outsourced payroll model, locations, union/labour profile and internal-audit scope.
H2R RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Manpower planning | Hiring outside approved budget | Requisition should be approved against manpower plan and budget | Match new hires to approved requisition and cost-centre budget |
| Recruitment | Candidate selected without documented basis | Interview and selection records should be retained | Test offer file, approvals and compensation benchmarking |
| Onboarding | Employee master created without valid joining evidence | HR onboarding checklist should be complete before payroll activation | Test joining forms, PAN, bank proof, offer acceptance and start date |
| Background checks | Sensitive roles filled without verification | Role-based background check should be completed or exception-approved | Test high-risk roles and pending verification ageing |
| Attendance | Salary paid for unauthorised absence | Attendance and leave data should be locked before payroll input | Compare payroll days with attendance, leave and shift records |
| Transfers | Location/state mapping incorrect | Transfer workflow should update payroll state, PT/LWF and reporting manager | Test transfers against payroll master and statutory mapping |
| Salary changes | Unauthorised increments or allowances | CTC changes should require HR and business approval | Test all changes above threshold and all manual allowances |
| Exit | Ex-employee remains active | Payroll stop and access disablement should be triggered by exit workflow | Match exit list to payroll, access logs and final settlement |
| Full-and-final | Recovery or statutory treatment missed | F&F should require HR, finance, IT and admin clearance | Test notice recovery, asset recovery, leave encashment, gratuity and TDS |
H2R audit data fields to request
| Data table | Minimum fields |
|---|---|
| Manpower requisition | Requisition ID, role, cost centre, budget approval, vacancy reason, approver |
| Employee master | Employee ID, joining date, department, location, reporting manager, payroll status, exit date |
| Offer and CTC data | Offered CTC, salary components, effective date, approver, joining confirmation |
| Attendance and leave | Payable days, leave balance, loss-of-pay days, overtime, lock date |
| Transfer history | Old/new location, old/new cost centre, effective date, approver |
| Exit tracker | Resignation date, last working day, clearance status, access disabled date, F&F paid date |
Fieldwork checklist
- Employees in payroll but missing from HR active headcount
- Employees marked exited in HRMS but paid after last working day
- Employees created and paid in the same month without completed onboarding file
- Salary changes effective before approval date
- Manual allowances added outside CTC structure
- Transfers not reflected in payroll state mapping
- Attendance locked after payroll processing
- Exit clearance incomplete before F&F payment
- IT access active after last working day
H2R audit programme
| Step | Procedure | Evidence expected |
|---|---|---|
| 1 | Reconcile HR active headcount, payroll register and user-access master | Exception list of active/inactive mismatches |
| 2 | Test all new hires in the period | Requisition, offer approval, joining documents and payroll activation |
| 3 | Test salary and grade changes | Approval, effective date, CTC structure and payroll impact |
| 4 | Test transfers and location changes | Transfer approval, cost-centre update, PT/LWF/state mapping update |
| 5 | Test exited employees | Last working day, payroll stop, access disablement and F&F approval |
| 6 | Review background-check ageing for sensitive roles | Verification status, exception approval and closure plan |
Sample and population guidance
Run full-population tests for active-headcount mismatch, employees paid after exit, duplicate bank accounts, duplicate PAN, salary changes and access active after exit. Use samples for joining-file completeness, background-check evidence and policy walkthroughs. For privacy, avoid collecting more identity data than the entity already lawfully maintains.
What to report
- Condition: 9 employees were paid after HRMS exit date; 3 still had active system access after last working day.
- Criteria: Exit policy requires payroll stop and access disablement on or before the last working day.
- Cause: Exit workflow does not automatically notify payroll and IT when HR marks an employee inactive.
- Effect: Risk of salary leakage, unauthorised system access and incomplete recovery of company assets.
- Recommendation: Link HRMS exit status to payroll block and IT access workflow, with weekly exception review by HR operations.
H2R internal audit FAQ
What is H2R in internal audit?
H2R, or hire-to-retire, is the internal audit cycle covering the full employee lifecycle: hiring approval, onboarding, payroll activation, attendance, salary changes, transfers, statutory mapping, exit and full-and-final settlement.
How is H2R different from payroll audit?
Payroll audit checks salary computation and statutory deductions. H2R checks whether the employee itself, the role, the approval, the location, the compensation and the exit status are valid before payroll is processed.
What is the highest-risk H2R test?
The strongest first test is a three-way match between HR active headcount, payroll register and access-control/user master. Differences quickly surface ghost employees, exited employees still paid and active users who should have been disabled.
Related CORAA resources
- Internal Audit Software for India
- Payroll Internal Audit Checklist
- Payroll Compliance Calendar Generator
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- Income-tax Act, 1961 - salary TDS and perquisite treatment where payroll entries are tested