Ghost Employee Testing: Payroll Register to HR File to Bank Account

A ghost employee is a name on the payroll that does not correspond to a real, working employee. The scheme needs one thing: someone with access to set up or maintain payroll records and a way to collect the money. Ghost employee testing is a short set of procedures that closes the loop between three independent records: the payroll register, the HR personnel file and the bank. Run it in any audit where payroll is significant or where segregation of duties is weak. It sits inside the wider payroll audit program. This post is the external auditor's substantive data test. For the client-side control design that prevents ghost employees (master file change approval, HR-to-payroll segregation), see the hire-to-retire payroll RCM.

Why it matters in an audit

AU-C 240 asks the auditor to respond to the risk of fraud, including misappropriation of assets. For clients with one person who can add employees, change bank accounts and process payroll, the risk is real. The test costs little and the evidence comes from outside the payroll function.

Step 1: Get the full population

Request the payroll register for the period, ideally the final payroll of each quarter plus the full-year summary by employee. Request an employee master file extract with name, ID, hire date, termination date, address, department and bank account (last four digits are enough for matching). Confirm the extract is complete by tying the employee count and total gross pay to the register.

Step 2: Run data tests on the whole population

Using a spreadsheet or analytics tool, run these tests on every employee. Each is a search for an anomaly, not proof of fraud.

Document each test, the criteria and the number of hits. A test with zero hits is still a result.

Step 3: Trace a sample from the register to the HR file

Select employees from the register and agree to the personnel file: signed offer letter or hire form, Form W-4, Form I-9, documented pay rate, approved rate changes and a supervisor. The file confirms the person was hired through an authorized process. Include officers and employees paid by exception.

Step 4: Trace the same sample to the bank

For each sample employee, agree net pay to the bank evidence: the direct deposit file, the bank statement detail or the cleared check image. Look at the endorsements and the deposit account. Confirm the account belongs to the employee. For direct deposits, ask the client to provide the employee's voided check or bank authorization form from the file and compare to the account in the payroll system.

Step 5: Observe or confirm existence

When the data tests or the HR file raise doubt, confirm the employee exists. Options:

• Attend a payroll distribution and observe employees receiving pay or check stubs.
• Ask a supervisor, not the payroll clerk, to confirm the employee works for the department and what the employee does.
• Interview the employee, with management's permission, and compare the HR file details.

Existence is the objective. Use a method that does not depend on records the suspected person controls.

Worked example

A client has 84 employees and one payroll administrator who also reconciles the payroll bank account. The auditor runs the data tests on the year-end register.

• Duplicate bank accounts: two employees share an account ending in 4471. One is the administrator and the other is "R. Dellen" in the warehouse.
• No benefits or PTO: R. Dellen has no health deduction and no PTO accrual in 11 months.
• Rate: R. Dellen is paid $1,850 per biweekly period in round numbers; hourly warehouse peers have variable pay.

The senior pulls the HR file for R. Dellen. It has an offer letter with no signature, no Form I-9 and a Form W-4 with the administrator's address. The senior does not speak to the administrator. The manager asks the warehouse supervisor who confirms no one by that name works there.

The conclusion: a probable ghost employee, about $44,000 paid over 11 months (24 biweekly periods at $1,850). The engagement partner is told the same day. The response follows the fraud standard: consider whether other employees and other accounts are affected, extend procedures to the administrator's other transactions, tell management at a level above the person involved and the governance body, consider the effect on the financial statements and the representation letter, and consult counsel before any confrontation. The suspected fraud goes to governance promptly. See AU-C 260 communications.

What a clean result supports

If the data tests produce no unexplained hits and the sample traces cleanly, the file supports the conclusion that wages were paid to real employees in the amounts recorded. It does not prove no fraud occurred. State the conclusion in that scope.

Limits

• Data tests depend on the completeness of the master file extract. A ghost deleted from the file after being paid will not appear. Compare the extract to the full-year payroll register by employee.
• Employees paid through a processor may be out of the client's own system. Request the processor's detail.
• Fraudsters know common tests. The sample trace to HR and the supervisor confirmation add value because they come from sources outside payroll.

Documentation checklist

• Source of the population and the tie-out to the register total.
• Each data test with criteria and result.
• Sample selection method and size.
• HR file and bank trace for each item with tick marks.
• Existence confirmation for exceptions.
• Memo on hits and the partner's conclusion.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• Internal Revenue Service, Employment Tax Recordkeeping (employee records employers must keep): irs.gov
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 550 on communicating suspected fraud to those charged with governance: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error