When a company withholds income tax and the employee share of Social Security and Medicare from wages, it holds that money for the government. If the company does not pay it over, the law lets the IRS pursue individuals as well as the company. That exposure shapes how payroll tax controls should be designed and who should own them. This post sets out the statute, what IRS guidance says, and the controls that a finance team and its advisers should expect to see.
The statute
Section 6672(a) of the Internal Revenue Code imposes a penalty on any person required to collect, truthfully account for, and pay over a tax who willfully fails to collect the tax, or truthfully account for and pay it over, or willfully attempts to evade or defeat it. The penalty equals the total amount of the tax evaded, not collected, or not accounted for and paid over. Section 6672(b) requires written notice, delivered by mail or in person, that the person will be subject to an assessment, at least 60 days before the notice and demand, except in a jeopardy case.
IRS Publication 15 (2026) summarizes the consequence: the penalty applies when withheld federal income, Social Security or Medicare taxes are not withheld, deposited or paid; it is 100 percent of the unpaid trust fund tax; and it may be imposed on responsible persons who acted willfully.
Publication 15 (2026) adds two definitions. A responsible person can be an officer or employee of a corporation and may include one who signs checks for the business or otherwise has authority to cause the spending of business funds. Willfully means voluntarily, consciously and intentionally: a responsible person acts willfully if the person knows the required collecting, accounting or paying over is not taking place, or recklessly disregards obvious and known risks to the government's right to receive trust fund taxes. Treat anyone with authority over payments as potentially exposed.
What the controls need to prove
A payroll tax control environment should be able to demonstrate five things.
- Withholding is computed correctly and held. Register totals agree to the general ledger liability accounts.
- Deposits are made on time. The deposit calendar follows the company's schedule under Publication 15, Section 11: monthly depositors by the 15th of the following month; semiweekly by the following Wednesday or Friday depending on the payment day; next-business-day deposit when $100,000 or more accumulates in a deposit period. Electronic funds transfer is required.
- Returns are filed. Form 941 is due by the last day of the month after the quarter, or the 10th day of the second month for timely, full depositors.
- Liabilities agree to deposits. A quarterly reconciliation ties register taxes to deposits and to the Form 941.
- Someone independent sees it. An officer outside payroll reviews deposit confirmations, so a shortfall cannot sit unnoticed.
See /us/blog/payroll-tax-deposits-monthly-and-semiweekly-schedules-explained and the payroll matrix in /us/blog/hire-to-retire-payroll-rcm-key-controls-and-test-steps.
Worked example
A company with 150 employees uses a payroll provider that debits taxes and files returns. The controller reconciles the general ledger liability monthly. During a cash shortage in the second quarter, the CFO instructs the provider to delay tax debits for two pay cycles, planning to catch up. Payroll continues; employees see withholding on pay stubs.
What the control failure looks like: the liability account balance rises by the withheld taxes, but a monthly reconciliation that compares only the total liability to the provider's summary report shows the amount as "due" and not as late. No one outside the CFO sees the bank. The quarter ends with $212,000 of trust fund taxes unpaid.
Control improvements:
- A monthly report from the tax authority account or the provider showing deposits made and date, reviewed by someone other than the CFO or payroll.
- A flag for any liability older than the deposit due date.
- A requirement that any change to the provider's debit schedule needs approval by two officers and notice to the audit committee chair or board.
- A bank-covenant and cash forecasting step that treats trust fund taxes as paid first, ahead of vendors.
Accounting and reporting
Unpaid payroll taxes are liabilities that must be recorded and disclosed accurately. A balance of past-due payroll taxes is also a signal to the auditor about liquidity and possible going concern. See /us/blog/going-concern-assessment-au-c-570. Penalties and interest assessed by the IRS belong in the accrual analysis.
Internal audit and auditor angles
Standard 9.4 Internal Audit Plan requires the plan to consider coverage of fraud risk and other high-risk areas, and trust fund deposits in a cash shortage are both. A deposit review that reaches the tax authority account or the bank confirmation is a short engagement for a company with a payroll provider. Cash-poor periods carry the highest risk.
Mistakes to avoid
- Relying on the provider's assurance that taxes were filed with no evidence from the tax authority account.
- Letting the person who approves payroll also control bank releases to the tax authority.
- Treating a late deposit as a cash management decision instead of a trust fund issue.
- Failing to retain the deposit confirmation records, since Publication 15 says to keep all employment tax records for at least 4 years.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- Internal Revenue Code section 6672, 26 U.S.C. 6672(a) and (b): https://www.law.cornell.edu/uscode/text/26/6672
- IRS, Publication 15 (2026), Circular E, Employer's Tax Guide, Section 11 (Depositing Taxes, including Deposit Penalties and Trust Fund Recovery Penalty), Section 12 (Filing Form 941) and Recordkeeping: https://www.irs.gov/publications/p15
- The IIA, Global Internal Audit Standards (2024), Standard 9.4 Internal Audit Plan: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error