Payroll Audit Procedures: Walkthrough, Control Tests and Substantive Tests With a Worked Example

Payroll is the largest expense for most service businesses. Volumes are regular, the third-party evidence (tax filings, bank debits, benefit invoices) is strong, and analytical procedures work. It is also an area where fraud schemes such as ghost employees and unauthorized pay changes live. This guide runs the cycle in order. See ghost employee testing and payroll liabilities testing for the two areas that deserve their own program.

Step 1: Walk through the cycle

Pick one employee and follow one pay period from start to finish. Record each step and who performs it.

1. Hire and set-up. HR approves the hire; payroll sets up the employee with the rate, tax forms, direct deposit and benefits.
2. Time and attendance. Hourly time is captured and approved; salaried employees go through a different path.
3. Payroll processing. Payroll calculates gross pay, withholdings and employer taxes, whether in-house software or an outside processor.
4. Review and approval. Someone other than the preparer reviews the payroll register before release.
5. Payment. Funds go by direct deposit or check from the payroll bank account.
6. Recording. The general ledger entry records wages expense, withholdings payable and cash.
7. Tax deposits and filings. Federal deposits, quarterly Form 941, state filings and year-end Forms W-2.

Record the control activities you see at each step, and which employees can do more than one. If a processor runs payroll, note it as a service organization and consider whether its report matters. See SOC 1 reports.

Step 2: Choose the controls to test

Controls worth testing, if you plan to rely on them:

• Pay rate changes are authorized by someone outside payroll and agree to HR files.
• New employees and terminations are approved by HR before payroll processes them.
• The payroll register is reviewed and approved before release.
• Payroll bank reconciliation is done by someone who does not process payroll.
• Time approvals for hourly staff are by a supervisor.

For each control, select a sample from the full population of occurrences. A weekly or biweekly payroll control has fewer occurrences than a daily transaction control, so the sample may be small. The GAO Financial Audit Manual gives a starting point for attribute sampling: with a tolerable deviation rate of 5 percent at a 90 percent confidence level, a sample of 45 items with zero deviations supports reliance, and larger samples (78 items, one deviation acceptable) apply when deviations are expected. See attribute sampling.

Step 3: Reconcile the payroll register to the general ledger

This is the core substantive test. Take the annual or year-to-date totals from the payroll register or the processor's year-end summary and tie them to the ledger.

Investigate every difference. The $1,350 above turned out to be a state unemployment rate adjustment booked in January. Trace the quarter totals to the Forms 941 and the annual totals to the Forms W-2 summary (Form W-3). Where an outside processor is used, the processor's reports are the starting point but still need a tie to the ledger.

Step 4: Build an analytical expectation

Payroll expense is predictable. Build an expectation from headcount and average rates.

• Average headcount by month times average pay rate times hours or periods.
• Add known changes: raises, overtime patterns, bonuses, new hires and terminations.
• Compare to the recorded expense by month and by department.

For the worked example, a client with 120 employees recorded wages of $8.41 million against an expectation of $8.25 million. The difference of $162,600, about 2.0 percent, exceeded the firm's threshold. Inquiry showed a bonus accrued in December that the expectation omitted. The bonus agreed to the board minutes and the payment was made in February. The explanation was corroborated and the analytical procedure was concluded without further testing. See analytical procedures.

Step 5: Test a sample of payroll transactions

Select employees, not payroll runs, for detail testing. For each sampled employee, agree:

• The rate used to the signed offer letter, rate change forms or compensation file.
• Hours worked on hourly employees to approved timesheets.
• Gross-to-net calculation reperformed or agreed to the processor's output.
• Withholding amounts to the Form W-4 on file.
• The net pay to the bank record: direct deposit file or cleared check.
• Employee existence by reference to the HR file, I-9 and tax forms.

Use a mix of random selection and targeted items, such as employees paid just before termination, employees with large overtime, and officers.

Step 6: Terminations and new hires

Select terminated employees and confirm the last pay date matches the termination date. Select new hires and confirm the start date matches the first pay date. Payments after termination are a fraud and control indicator. Compare the termination list to the payroll registers for the months after.

Step 7: Related accounts

Payroll audit work covers three balance sheet accounts in addition to expense: accrued wages and bonuses, accrued paid time off, and payroll taxes and withholdings payable. Test the accruals as of year end using cutoff to the first pay date after year end. See payroll liabilities testing.

What the IRS requires clients to keep

The IRS tells employers to keep employment tax records for at least four years after the fourth-quarter return for the year is filed. The list includes dates and amounts of wage payments, employee names and Social Security numbers, Forms W-4, tax deposit dates and amounts, and copies of filed returns. A client missing these has a records problem that affects both the audit and tax compliance.

Documentation checklist

• Walkthrough narrative with each step and who performs it.
• Controls tested, populations, sample size, results.
• Register-to-ledger reconciliation with differences resolved.
• Analytical expectation, source data, threshold and explanations corroborated.
• Employee detail test results with tick marks.
• Terminations and new hires results.
• Conclusion on payroll expense and the related liabilities.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained; AU-C Section 520, Analytical Procedures
• Internal Revenue Service, Employment Tax Recordkeeping: irs.gov
• Internal Revenue Service, Publication 15, Employer's Tax Guide (calendar of quarterly Form 941 due dates): irs.gov
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 450 on attribute sampling: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error