Payroll Internal Audit Checklist and RCM: PF, ESI, TDS, PT and LWF
Payroll internal audit tests whether employees are real, salary inputs are authorised, statutory deductions are correct, payments go to the right bank accounts and exits are closed properly. For Indian companies, the payroll RCM must include PF, ESI, TDS under Section 192, professional tax, labour welfare fund and full-and-final settlement.
Payroll is a sensitive internal-audit cycle because errors hit employees directly and statutory defaults create avoidable disallowance, interest, damages and reputational exposure. The RCM below is illustrative and should be tailored to the entity's HRMS, payroll processor, state footprint, headcount and internal-audit scope.
Payroll RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Employee master | Ghost or duplicate employee | HR onboarding should require KYC, PAN, bank and joining documents | Test new employees, duplicate bank accounts and duplicate PAN; use Aadhaar only where lawfully collected |
| Attendance and leave | Salary paid for unauthorised absence | Attendance/leave data should be locked before payroll run | Compare payroll days to attendance and leave records |
| Salary changes | Unauthorised CTC revision | Increment and variable-pay approvals should be captured in HRMS or approval records | Test all salary changes above threshold |
| Payroll processing | Wrong gross-to-net computation | Maker-checker review of payroll register should be evidenced | Recompute salary, deductions and reimbursements |
| PF | Eligible employee not covered or wrong basis | PF eligibility and wage-basis review should be performed | Compare basic+DA, ceiling restriction, ECR and challan |
| ESI | Eligible employee missed or wrong contribution | ESI eligibility and contribution-period review should be performed where ESI applies | Test wage ceiling, contribution rate and challan |
| TDS | Salary TDS short deducted | Annual tax estimate and monthly deduction review should be evidenced | Recompute Section 192 TDS, regime, declarations and perquisites |
| PT / LWF | State-wise deduction missed | State mapping should be maintained in payroll master | Test work location/state against PT and LWF rules |
| Bank file | Salary paid to wrong account | Bank file maker-checker and change control should be in place | Match bank account changes before payroll and salary credits |
| Exit / F&F | Ex-employee paid or dues not recovered | Exit clearance and F&F approval should precede final payment | Test final settlement, notice recovery, gratuity/leave encashment |
Ghost employee and master-data tests
Start with master data. Payroll fraud often enters through the employee master or bank master.
- Same bank account used by multiple employees
- Employee without PAN or joining documents
- Employee added and paid in the same month without approval
- Salary credited after exit date
- No attendance but full salary paid
- Employee in payroll but not in HR headcount report
- Bank account changed just before payroll
- Round monthly allowances added without CTC approval
If Aadhaar is used in any payroll master-data test, use it only where the entity has lawfully collected it with consent and retention controls. Prefer masked Aadhaar or offline e-KYC reference data where available, and do not collect Aadhaar only for duplicate testing.
Reportable observation example: Seven employees received salary after the recorded exit date. In four cases, HRMS status was inactive but payroll status remained active. The exit-control design is not preventing post-exit salary leakage.
PF, ESI and employee contribution checks
For statutory payroll audit, do not stop at whether a challan exists.
| Area | Internal audit test |
|---|---|
| PF eligibility | Employees below threshold and covered employees correctly included |
| PF basis | Basic + DA reviewed; artificial salary splitting considered |
| PF remittance | Employee and employer contribution tied to ECR and challan |
| ESI eligibility | Wage ceiling and contribution-period continuation rule checked |
| ESI contribution | Current employee and employer rates tested where applicable |
| Due date | PF/ESI paid by the statutory due date, ordinarily the 15th of the following month |
| Clause 20(b) | Employee contribution separately tracked for tax audit disclosure |
Employee contribution is especially important. Once deducted from salary, late deposit is not saved merely because payment happened before the income-tax return due date. The internal audit file should track employee share, due date and actual payment date month by month.
Salary TDS and perquisite checks
TDS under Section 192 is not a year-end exercise. Monthly payroll should be tested against the employee's projected annual income.
- Regime selected and documented
- Previous-employer income considered
- Declarations supported by evidence at year-end
- Perquisites included where applicable
- Bonus and variable pay included in annual estimate
- Rent/HRA, LTA, deductions and exemptions reviewed
- TDS deposited by due date and reconciled to Form 24Q / AIS / Form 16
Full-and-final settlement checklist
Exit is where payroll, HR, legal and finance meet. Test:
- Last working day and payroll stop date
- Notice period pay or recovery
- Leave encashment and tax treatment
- Gratuity eligibility and exemption
- Bonus or incentive payable
- Asset recovery and loan recovery
- PF/ESI/TDS treatment on settlement components
- F&F approval and bank payment trail
What to report
Useful payroll observations quantify both people and rupees.
- Condition: 11 employees had bank account changes within seven days before payroll. Three changes did not carry independent HR or employee confirmation.
- Criteria: Payroll policy requires bank-detail changes to be supported by employee request and HR maker-checker approval before salary release.
- Cause: HRMS allows bank changes by payroll admin without independent confirmation workflow.
- Effect: Salary may be diverted to unauthorised bank accounts.
- Recommendation: Lock bank changes five working days before payroll, require employee confirmation, and generate exception report for internal audit.
Payroll audit data fields to request
Payroll testing needs HR, attendance, payroll and bank data together. One file alone rarely proves the control.
| Data table | Minimum fields |
|---|---|
| Employee master | Employee ID, name, PAN, joining date, exit date, department, location/state, bank account, payroll status |
| Salary master | CTC, basic, allowances, variable pay, effective date, approver, change reason |
| Attendance/leave | Payable days, leave days, loss-of-pay days, overtime, lock date, approver |
| Payroll register | Gross pay, deductions, reimbursements, net pay, PF/ESI/TDS/PT/LWF components |
| Statutory returns | PF ECR, ESI challan, TDS challan, Form 24Q, PT/LWF challans where applicable |
| Bank file | Beneficiary name, bank account, amount, upload user, approval trail, payment date |
Payroll internal audit FAQ
What is a payroll internal audit?
A payroll internal audit tests whether employees are valid, salary inputs are authorised, deductions are computed correctly, statutory payments are made on time and salary payments go to approved bank accounts.
Which payroll controls should be tested first?
Start with employee master, bank-account changes, payroll status after exit, attendance-to-payroll mapping and statutory deduction reconciliation. These controls catch the largest leakage and compliance risks early.
Should payroll audit include PF, ESI and TDS?
Yes. For Indian companies, payroll audit should reconcile PF, ESI, TDS under Section 192, Professional Tax and Labour Welfare Fund wherever applicable. The file should separate employee contributions from employer contributions because late employee-share deposits have different tax and compliance consequences.
Related CORAA resources
- Internal Audit Software for India
- Payroll Audit Automation
- Payroll Compliance Calendar Generator
- EPF Contribution Calculator
- ESI Contribution Calculator
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- EPFO employer/member guidance and contribution-rate downloads
- ESIC, Employees' State Insurance Act, 1948
- Income-tax Act, 1961 - Section 192, Section 36(1)(va) and Section 2(24)(x)