Payroll Process Internal Audit Checklist

A risk-and-control checklist for the payroll (hire-to-retire) cycle — ghost employees, unauthorised master changes, statutory-deduction compliance and exit settlements — with space for your own test results.

Free · CORAA original — SA-aligned

Updated 28 Jul 2026

Standard

SIA 220 / SIA 330

Cycle

Payroll / H2R

Key risk

Ghost employees, unauthorised master changes

Format

Microsoft Word (.docx)

Share this template

Your firm — letterhead

Appears at the top of the document as the audit firm letterhead.

Audit firm name

Audit firm address

Used as the letterhead block.

Engagement partner

ICAI membership no.

Firm registration no.(optional)

Engagement details

The client and period this document is for.

Entity name

Audit period

Functional area / process covered(optional)

Report addressed to

Date of report

Live preview

7 required fields left to fill

Payroll Process Internal Audit Checklist

31 July 2026

PAYROLL PROCESS — INTERNAL AUDIT CHECKLIST

Entity: {{client_name}} · Period: {{audit_period}}

Scope: the payroll (hire-to-retire) cycle — employee master maintenance, payroll processing, statutory deductions, and exit settlement. Prepared per SIA 220 and SIA 330.

Risk & Control Matrix

Sub-process	Key risk	Control activity	Control type	Control objective
Employee master	Ghost employees on the payroll register	HR-to-payroll headcount reconciliation performed each cycle	Detective	Existence
Payroll processing	Unauthorised change to salary or bank account	Maker-checker approval on every payroll master change	Preventive	Authorisation
Attendance & processing	Payroll computed on incorrect attendance/overtime data	Attendance-system feed reconciled to payroll input before processing	Detective	Accuracy
Statutory deductions	PF / ESI / PT / TDS (Sec 192) default or delay	Statutory due-date compliance calendar with a named owner per obligation	Preventive	Compliance
Exit management	Unrecovered dues at exit — loans, notice pay, unreturned assets	Full-and-final settlement checklist requiring clearance sign-off before final payment	Preventive	Completeness

Conclusion

Overall conclusion on the design and operating effectiveness of payroll controls: ____________________________________________

Prepared by: __________ Reviewed by: __________ Date: 31 July 2026

Free · Email required once · Firm data stays in your browser

What’s inside

An excerpt from the template.

PAYROLL PROCESS — INTERNAL AUDIT CHECKLIST

Entity: ___ · Period: ___

Scope: the payroll (hire-to-retire) cycle — employee master maintenance, payroll processing, statutory deductions, and exit settlement. Prepared per SIA 220 and SIA 330.

Risk & Control Matrix

↑ Excerpt only — the full template is what you download as Word

About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

How is a "ghost employee" typically detected?

The core detective control is a periodic reconciliation between the HR system's active-employee headcount and the payroll system's paid-employee headcount — any name paid but not on the current HR roster (or vice versa) is investigated. Cross-checking bank account numbers for duplicates across different employee codes is a common supplementary test.

Why does statutory-deduction compliance sit inside a payroll internal audit rather than being purely a tax-audit matter?

PF, ESI, professional tax and TDS under Section 192 all originate from the payroll process itself — a control gap here (a missed due date, a wrong deduction rate) creates the compliance default that later shows up as a finding in the tax audit or a demand notice. Testing the control at source, inside payroll, catches it before it becomes a statutory default.

What should a full-and-final settlement checklist actually verify?

That every amount owed BY the exiting employee (outstanding loans/advances, notice-period shortfall, unreturned company assets) is recovered or adjusted, and every amount owed TO the employee (leave encashment, gratuity where applicable, final salary) is computed correctly — with sign-off from HR, finance and the reporting manager before the final payment is released.

Related templates

You might also need.

Employee Benefits Audit Working Paper (Ind AS 19 / AS 15) — ICAI Audit Working Paper

Free employee benefits audit working paper (ind as 19 / as 15) audit working paper template (ICAI, Chapter 3).

IT General Controls (ITGC) Checklist

Free IT General Controls (ITGC) checklist for internal audit. Access management, change management, SoD, backu