Payroll is a major expense for most organizations and has two audiences for its controls: the financial statements and the tax authorities. A weak control produces a misstatement or a penalty, sometimes both. This post gives a hire-to-retire RCM with test steps and analytics, and includes the employment tax elements that appear in IRS Publication 15.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| H2R-01 | Payments to a nonexistent employee | New hires entered only from an approved offer or requisition by HR; payroll cannot add employees | Preventive | Occurrence | Select hires in period; agree to approval, offer and identity documents; test payroll user rights |
| H2R-02 | Unauthorized pay or deduction changes | Master file changes require HR approval; monthly change report reviewed by someone outside payroll | Preventive and detective | Accuracy | Full change log; sample to approval; test reviewer evidence |
| H2R-03 | Terminated employees paid | Termination notice from HR to payroll by workflow; final pay review | Preventive | Occurrence | Compare terminations to payroll registers for pay dates after the termination date |
| H2R-04 | Hours or overtime misstated | Time approved by supervisors; system flags overtime above threshold | Preventive | Accuracy | Sample time records to approvals; test overtime flag |
| H2R-05 | Payroll register errors | Payroll register reviewed against prior period and headcount before release; variances above a threshold investigated | Detective | Accuracy | Reperform for sample periods; see /us/blog/management-review-controls-precision-design-and-evidence |
| H2R-06 | Payroll funding or direct deposit diverted | Direct deposit changes verified with the employee; bank file release by two approvers | Preventive | Occurrence | Test change verification; compare bank file to register |
| H2R-07 | Accrued payroll and bonus misstated | Month-end accrual computed from calendar and approved bonus plans; reviewed by controller | Detective | Completeness, cutoff | Reperform accrual for two period ends |
| H2R-08 | Employment taxes not withheld, deposited or filed | Deposit schedule calendar; reconciliation of payroll register to tax deposits and Forms 941 each quarter | Detective | Completeness, accuracy | See below |
| H2R-09 | Workers misclassified as contractors | Classification review for new nonemployee service providers; periodic review of long-term contractors | Preventive | Presentation | Compare 1099 vendor list to HR and payroll records |
| H2R-10 | Payroll records not retained | Retention schedule for employment tax and payroll records | Preventive | Presentation | Inspect retention schedule and sample records |
Employment tax tests
Publication 15 (2026) supplies the criteria: Section 11 for depositing taxes, Section 12 for filing Form 941, and the Recordkeeping section, which says to keep employment tax records for at least 4 years. Form 941 is filed quarterly, due the last day of the month after the quarter ends. Deposit schedules, the lookback period and the $100,000 next-day rule are explained in /us/blog/payroll-tax-deposits-monthly-and-semiweekly-schedules-explained, and the personal liability that follows unpaid deposits is covered in /us/blog/trust-fund-recovery-penalty-payroll-tax-controls-and-responsible-person-exposure.
Test step for H2R-08: for each quarter, agree total wages, withholding and employer taxes in the payroll register to the Form 941; agree the deposits made through the electronic deposit system to the liabilities by date; compare the actual deposit dates to the schedule the company is required to follow; investigate penalties and notices.
Analytics
IIA Standard 14.2 says internal auditors should understand and use technology that tests an entire population rather than a sample. Payroll analytics:
- Employees without required fields: missing tax identifier, address or bank account.
- Duplicate bank accounts or addresses across employees, and matches to vendor records.
- Pay after termination date.
- Pay with no time records for hourly employees.
- Rate changes just before large payments or bonuses.
- Round-dollar manual payments outside regular cycles.
- Headcount to payroll expense trend by department. Compare recorded payroll expense against changes in the average number of employees.
Worked example
A company with 480 employees and $38 million of annual payroll. The full-population test of H2R-03 compares the termination list (62 terminations) with payroll registers. Result: 4 employees were paid after the termination date, with overpayments of $2,100, $5,800, $890 and $14,400. The $14,400 case continued for six weeks because the termination notice reached payroll after the manager sent it by email and HR keyed it late.
Finding: criteria, the company's termination procedure requiring HR to notify payroll the day of termination; condition, 4 of 62 terminations paid after date; cause, notice by email with no workflow or ticket; effect, $23,190 overpaid and unrecovered. Recommendation: a termination ticket workflow that blocks payroll processing for the employee after the effective date. See /us/blog/internal-audit-findings-criteria-condition-cause-and-effect-standard-14-3.
Worker classification
Publication 15 (2026) discusses who is an employee under the common-law rules in Section 2, including statutory employees and nonemployees. A control that reviews long-term contractors and compares 1099 vendors to the roles of employees helps prevent misclassification. See /us/glossary/worker-classification.
Fraud considerations
Segregate HR, payroll and bank release duties so no one person can add an employee, change pay and release the funds. See /us/blog/segregation-of-duties-conflict-matrix-design-and-testing and /us/blog/embezzlement-detection-guide-for-auditors.
Mistakes to avoid
- Testing payroll accuracy on a sample without testing master file changes.
- Skipping the register-to-941 reconciliation.
- Letting payroll staff both change rates and review the change report.
- Treating contractor classification as an HR matter outside the control program.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- IRS, Publication 15 (2026), Circular E, Employer's Tax Guide, Section 2 (Who Are Employees), Section 11 (Depositing Taxes), Section 12 (Filing Form 941) and Recordkeeping: https://www.irs.gov/publications/p15
- The IIA, Global Internal Audit Standards (2024), Standard 14.2, Analyses and Potential Engagement Findings: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error