Method
Each test groups rows on a cleaned key and reports groups that meet its condition. Bank accounts compare on digits only, with at least four digits. Addresses are lower-cased, stripped of punctuation and put on common abbreviations, so 12 Oak Street and 12 Oak St. match. Names compare as sorted words, so Ann Lee and Lee Ann match. The spike test compares each pay line with the employee's own median gross pay, and the double-pay test looks for the same ID and the same pay date more than once.
Source
These are data-matching procedures an auditor can use when responding to assessed fraud risks (AU-C 240) and risks of material misstatement (AU-C 315) in the payroll cycle. The standards do not prescribe the tests, thresholds or multiples; they are choices to document in your methodology.
When to use it
Use it on a full-year register when payroll is significant and the master-data controls are weak or untested, or as a first pass before selecting items to trace to personnel files. It pairs with the vendor master test for the matching patterns on the purchasing side.
Limits
A hit is a lead, not a conclusion, and a clean result covers only the rows and columns supplied. The tool does not see terminated-employee payments unless the dates and IDs are in the data, and it cannot match typos in bank numbers or names. Check the result against your firm's methodology before relying on it.
Common questions
What tests does the finder run?
Six: different employee IDs paid to the same bank account; different IDs at the same address; the same name (in any order) under different IDs; one ID paid twice on one pay date; a pay line far above that employee's own median; and overtime hours at or above a limit you set. Each test works only when you map the columns it needs.
Does a shared bank account prove a ghost employee?
No. Spouses can share an account, and a payroll provider or a pay card program can put several employees behind one account number. A shared account is a lead to follow into the personnel file, the approval of the master data change and who receives the money.
How is the pay spike measured?
For each employee with at least three pay lines, the tool takes the median gross pay and flags any line at or above your multiple of it. Medians resist one-off amounts better than averages. Bonuses, retro pay and final pay will flag, so look for the approval and the supporting calculation.
How much personal data should I paste?
Only what the test needs. The tool runs in your browser and does not send or store what you paste, but you can still shorten bank accounts to the last four digits (the test needs at least four) and leave out names and addresses to run only the tests that use IDs and pay lines.
What do I do with a hit?
Trace it. Agree the employee to hire documents and the approver, confirm the person exists and works, check who changed the bank or address fields and when, and confirm the payment reached the account in the bank record. Document what you did even when the answer is innocent.
Runs in your browser. The figures you type are not sent to CORAA or stored. Check the result against your firm's methodology before relying on it.