An H2R internal audit programme tests the employee lifecycle from manpower approval and recruitment to employee master changes, attendance, payroll, statutory deductions, reimbursements, exits, full-and-final settlement and access removal.
Payroll errors become recurring leakage. H2R audit needs HR, payroll, finance, bank-upload and IT access evidence in one programme, otherwise ghost employees and leaver payments are missed.
Objective: Hiring is approved and new employees are valid.
MRF, offer letter, BGV, joining checklist, HRMS log.
New joiners and lateral hires during the period.
Objective: Salary and bank changes are authorised.
Employee master, change log, revision letter, bank proof, approval.
All high-risk changes plus random sample.
Objective: Payroll is computed from approved inputs and statutory deductions are supported.
Attendance report, payroll register, deduction workings, challans/returns.
Selected months and employee categories.
Objective: Leavers are settled and removed from systems promptly.
Exit checklist, FNF sheet, payroll register, access logs, bank upload.
All leavers or risk-based leaver sample.
ICAI IASB lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026. Use this page as a practical workpaper starter, then verify the latest standard, law, regulation, ERP report and client fact pattern before concluding.
It should cover manpower approval, hiring, onboarding, employee master, attendance, payroll changes, statutory deductions, reimbursements, exits, full-and-final settlement and access removal.
No. It is a fieldwork starter. The internal auditor must tailor it to the approved scope, ERP, delegation matrix, locations, volumes, materiality, prior findings and current legal position.
Yes. Use the linked CORAA workbook for the cycle. It contains editable RCM, testing, evidence and monitoring sheets that can be used as a fieldwork base.
