Manpower planning and requisition
Risk: Positions are created or filled without approved budget, headcount plan, role justification or delegation authority.
Controls
- Annual manpower plan
- Approved requisition workflow
- Budget check
- Delegation matrix
Tests
- Trace hires to approved requisitions
- Compare headcount to budget
- Review emergency/backfilled roles
- Check approvals against delegation matrix
Evidence
Manpower plan, approved requisition, budget file, org chart, approval workflow and headcount report.
Recruitment, selection and background checks
Risk: Candidates are selected without objective evaluation, reference checks, conflict checks or documented offer approval.
Controls
- Candidate evaluation file
- Offer approval
- Background verification checklist
- Conflict-of-interest declaration
Tests
- Review selected recruitment files
- Match offer terms to approvals
- Inspect BGV completion before joining
- Check referral and related-party exceptions
Evidence
CV, interview evaluation, offer approval, BGV report, reference checks, declaration and exception approval.
Joining documents and employee master creation
Risk: Employee master is created with incomplete KYC, wrong bank details, wrong grade/location or duplicate employee records.
Controls
- Joining checklist
- Maker-checker master creation
- Bank validation
- Duplicate employee review
Tests
- Match employee master to joining file
- Check PAN/bank and identity evidence
- Search duplicate bank/PAN/mobile fields
- Review master change log
Evidence
Employee master, joining checklist, PAN, bank proof, identity/address proof, appointment letter and HRMS change log.
Attendance, leave and shift inputs
Risk: Payroll is processed using incorrect attendance, leave, overtime, shift or biometric data.
Controls
- Attendance cut-off
- Leave approval workflow
- Overtime approval
- HR-payroll input reconciliation
Tests
- Reconcile attendance to payroll input
- Review leave and overtime approvals
- Test manual attendance corrections
- Check negative leave and unusual overtime
Evidence
Attendance report, leave register, biometric extract, overtime sheet, payroll input file and approval trail.
Salary changes, incentives and reimbursements
Risk: CTC changes, arrears, incentives, reimbursements or deductions are processed without approved basis or period accuracy.
Controls
- Salary-change approval
- Variable-pay computation review
- Reimbursement policy
- Deduction exception review
Tests
- Trace increments and arrears to approvals
- Recompute variable-pay samples
- Review reimbursement evidence
- Check one-time payments and recoveries
Evidence
Increment letter, payroll input, incentive working, reimbursement claims, policy, approval and exception report.
Payroll processing and bank upload
Risk: Payroll is inaccurate, duplicated, paid to wrong bank accounts, paid to inactive employees or released without maker-checker.
Controls
- Payroll variance review
- Maker-checker bank upload
- Leaver hold control
- Net-pay reconciliation
Tests
- Compare current payroll to prior month
- Trace bank upload to approved payroll
- Review inactive/leaver payments
- Check duplicate bank accounts and round-sum exceptions
Evidence
Payroll register, variance report, bank upload, payment approval, leaver list, bank statement and reconciliation.
PF, ESI, professional tax and labour compliance
Risk: Employees are wrongly included/excluded, contributions are computed on incorrect wage bases or deposits/returns are delayed.
Controls
- Statutory eligibility mapping
- Contribution review
- Challan and return reconciliation
- Compliance calendar
Tests
- Tie PF/ESI/PT workings to payroll
- Review excluded employees and wage basis
- Trace challans and returns
- Check delayed filings and unpaid liabilities
Evidence
Payroll register, PF ECR, ESIC contribution file, PT return/challan, compliance calendar and statutory reconciliation.
Salary TDS, declarations and Form 16
Risk: Salary TDS is computed using stale declarations, wrong regime, missing previous-employer income or unsupported exemptions.
Controls
- Investment declaration workflow
- Proof verification
- TDS computation review
- Form 16 reconciliation
Tests
- Review declarations and proofs
- Recompute selected TDS cases
- Check previous-employer income and regime selection
- Tie payroll TDS to challans/Form 16
Evidence
Form 12BB/declarations, proof files, TDS computation, payroll register, challans, Form 16 and 26AS/AIS reconciliation where relevant.
Transfers, exits and full-and-final settlement
Risk: Transfers, resignations, terminations, notice recovery, leave encashment, gratuity or final settlement are not approved or settled accurately.
Controls
- Transfer approval
- Exit checklist
- Asset and access clearance
- F&F computation review
Tests
- Trace exits to resignation/termination approval
- Review F&F computation
- Check asset recovery and access removal
- Test post-exit payments and leaver payroll holds
Evidence
Transfer/exit approval, resignation letter, clearance checklist, F&F working, gratuity/leave support, recovery evidence and access closure.
HRMS access, segregation and monitoring
Risk: Users can create employees, change bank/CTC, approve attendance, run payroll or upload bank files without segregation or review.
Controls
- Role-based HRMS access
- SoD conflict review
- Master-change monitoring
- Leaver access review
Tests
- Review HRMS/payroll users
- Test bank and salary master changes
- Check leavers/shared IDs
- Inspect override logs and privileged access
Evidence
HRMS user list, payroll user matrix, master change log, leaver list, SoD report, override log and access review.
