How to Audit Payroll: Controls, Recalculation, and Compliance

To audit payroll, you set a scope and pull the records, test the internal controls that stand between raw time data and a signed check, run queries for fraud patterns, recalculate a sample of paychecks end to end, verify tax and wage-law compliance, correct any errors on the right forms, and document every step in workpapers that support a written report to management. The work sits at the intersection of accounting and regulatory compliance, and the penalties for getting it wrong are steep: the IRS failure-to-deposit penalty starts at 2% and climbs to 15% once you ignore a formal notice.¹

Set the Scope and Pull the Records

Draw a clear boundary first. Most payroll audits cover one fiscal quarter or a full year, and the period you pick should reflect where the risk sits. A recent payroll system conversion or turnover in the payroll department is reason enough to focus the review on that transition window.

Inside the window, capture every pay component: base wages and salaries, commissions, bonuses, shift differentials, and accrued paid time off. Deductions belong in scope on both sides, mandatory (federal and state income tax, FICA) and voluntary (401(k) contributions, health premiums). For 2026 the 401(k) elective deferral limit is $24,500, so any employee running near that ceiling deserves a closer look.²

Then request the documents. You need the employee master file with current pay rates, classifications, and tax elections; the timekeeping records; the payroll register; and the general ledger entries for total payroll expense. Signed Forms W-4 for every employee and completed Forms I-9 verifying employment eligibility should be on hand.³⁴ Pull authorization forms for every voluntary deduction, and if you can get one, the organizational chart that shows how payroll data flows from time entry through disbursement.

Test the Internal Controls

Controls testing looks at the system of checks between raw hours and a finalized paycheck. Start with a walkthrough. Follow a single pay cycle from clock-in through the bank transfer, and confirm each handoff and approval. You are looking for where the process would catch an error, and where it wouldn’t.

Segregation of duties matters most. The person who enters time or edits the master file must not also authorize disbursements or reconcile the bank account. When one person can create an employee, submit hours, and generate payment, that’s a textbook ghost-employee vulnerability. Pull user access logs from the payroll system and map each user’s permissions against the approval hierarchy. Overlap is a finding.

Then check that key changes carry authorization. Every new hire’s pay rate should have a manager’s sign-off before the first check runs. Every termination should be documented and processed promptly, because a terminated employee sitting on payroll is one of the most common fraud patterns. Master file changes (address, pay rate, bank account) should produce a change log with the old value, the new value, and the approver.

Sample timecards and confirm that a supervisor reviewed and signed off on hours before payroll ran. The FLSA does not mandate a specific timekeeping format, but it does require complete and accurate records.⁵ If policy calls for daily approval but time records show batch approvals days after the pay period closes, flag the gap between policy and practice.

Run Queries for Fraud Patterns

Some anomalies won’t show up in a manual review. Run the queries that surface them:

Two or more employees depositing to the same bank account. A duplicate-match on direct deposit records is one of the strongest ghost-employee signals.
Employees sharing an address or phone with an accounts-payable vendor, or with an employee in a different department.
Blank or duplicate Social Security numbers in the payroll file. Sometimes data entry, sometimes fabrication.
Any name on the payroll register after a documented termination date. Compare HR termination dates against the last disbursement for every separated employee in the period.
Payments dated before an employee’s official start date, which can point to backdated records.

None of these prove fraud alone. Each is a thread to pull, and several turning up under the same supervisor or in the same department is reason to expand your substantive sample there.

Recalculate a Sample of Transactions

Substantive testing is where you rebuild the numbers yourself. Draw a representative sample across departments, pay frequencies, and employee types. Sample more where controls tested weak and less where they tested strong.

Gross Pay

For hourly employees, multiply verified hours from timekeeping by the authorized rate in the master file, and compare to the register. For salaried employees, divide annual compensation by pay periods and confirm the per-period figure. Trace bonuses and commissions back to their documented approval and calculation method. A $0.50 rounding error on an hourly rate, spread across 2,000 hours and dozens of people, adds up.

Deductions

Check federal income tax withholding against the current tables in Publication 15-T and the employee’s W-4.⁶ Confirm Social Security withholding stops once the employee’s earnings reach $184,500 for 2026; Medicare has no wage cap and applies to all earnings.⁷ Voluntary deductions like 401(k) contributions must stay within both the employee’s signed authorization and the annual IRS limit.⁸

Garnishments

If any sampled employee has an active order, verify the math. Federal law caps ordinary garnishments (not child support or tax levies) at the lesser of 25% of disposable earnings or the amount by which weekly disposable earnings exceed 30 times the federal minimum wage.⁹ Disposable earnings here means what remains after legally required deductions like taxes and the employee’s share of Social Security and Medicare. Voluntary deductions like union dues or extra insurance don’t reduce the garnishment base. Getting this wrong exposes the employer to liability from both creditor and employee.

Net Pay and Disbursement

Confirm the calculated net actually reached the right person. Trace net pay from the register to the EFT file or cancelled check image, and compare employee names and bank account numbers on the disbursement against the master file. Payment diversion often starts with a quiet bank account change nobody questioned.

Finish by testing accruals at period end. Verify that accrued vacation and sick leave liabilities follow company policy, and that total payroll expense in the general ledger reconciles to your quarterly and annual payroll tax filings.

Verify Tax and Wage-Law Compliance

This is the highest-stakes portion of the work. Errors here carry direct penalties and, in some situations, personal liability for the people who sign the returns.

Form 941 and Deposit Schedules

Sample the quarterly Form 941 filings and reconcile reported wages and withholdings against the general ledger. Verify deposits were made on time under the correct schedule. If total tax liability during the lookback period was $50,000 or less, the schedule is monthly; above that, it’s semiweekly.¹⁰ The failure-to-deposit penalty starts at 2% for one to five days late and reaches 10% after fifteen days. Miss the ten-day window after a formal IRS notice and it becomes 15%.¹

W-2 Filing

The statutory deadline to furnish W-2s to employees is January 31; when that falls on a weekend or holiday, it moves to the next business day.¹¹ Late filing with the Social Security Administration is $60 per form if corrected within 30 days, $130 if corrected by August 1, and $340 per form after that. Intentional disregard is $680 per form with no cap.¹² With hundreds of employees, those figures compound fast.

Trust Fund Recovery Penalty

Income tax and FICA withheld from paychecks are held in trust for the federal government. If those funds aren’t turned over, the IRS can assess a penalty equal to 100% of the unpaid trust fund taxes against any “responsible person” who willfully failed to pay. Officers, directors, or anyone with authority over the company’s finances can be held personally liable, even if the business goes bankrupt.¹³ If the audit turns up late or missing trust fund deposits, escalate immediately.

Overtime and Exempt Classification

Confirm that every employee classified as exempt actually qualifies. The federal executive, administrative, and professional exemptions require a duties test plus salary-basis pay of at least $684 per week.¹⁴ Misclassifying an employee as exempt to skip overtime is one of the most common and expensive FLSA violations. A court finding willful misclassification can order back pay covering three years of unpaid overtime per affected worker.

For non-exempt employees in the sample, recalculate overtime. The rate must be at least one and one-half times the regular rate for hours over 40 in a workweek.¹⁵ Watch how “regular rate” is computed when the employee earns bonuses or shift premiums, because those amounts often have to be folded in before the multiplier is applied. State labor codes sometimes impose stricter meal, rest, and overtime rules than federal law.

1099 Contractors

Review anyone receiving a Form 1099 rather than a W-2. The IRS weighs three categories: behavioral control (do you direct how the work is done?), financial control (do you control the business side of the worker’s job?), and the type of relationship (benefits, written contracts, expected permanence).¹⁶ A 1099 worker who looks like an employee under these factors exposes the employer to retroactive liability for the worker’s share of FICA, income tax withholding, and FUTA.

A limited safe harbor under Section 530 of the Revenue Act of 1978 can shield the employer from reclassification liability. You must have consistently treated the worker as a contractor, filed all required 1099s, and reasonably relied on a prior IRS audit, judicial precedent, recognized industry practice, or another reasonable basis such as advice from an attorney or accountant.¹⁷ If the audit turns up questionable classifications, document the Section 530 analysis now.

FUTA and State Unemployment

FUTA is 6.0% on the first $7,000 of wages per employee. Employers who pay state unemployment taxes on time and in full receive a credit of up to 5.4%, so the effective FUTA rate drops to 0.6%.¹⁸ Verify that wages reported to state unemployment agencies match federal filings. Discrepancies usually mean you’re overpaying or underpaying premiums. State wage bases vary widely, so confirm the correct cap for each state where you have employees.

Correct Errors on the Right Forms

Fixing a finding correctly on paper is as important as finding it. The correction path depends on the direction of the error.

If you underreported payroll taxes on a filed Form 941, file Form 941-X for the affected quarter, one 941-X per quarter. Underpayments use the “adjusted employment tax return” process and you pay the difference. Overpayments give you a choice: apply the credit to a future return, or file a formal claim for refund.¹⁹ You’ll also certify whether corrected W-2c forms have been issued to affected employees.

For FLSA violations like unpaid overtime, calculate the back wages and pay them, and document everything. The Wage and Hour Division accepts voluntary compliance, and self-correcting before an investigation generally helps on penalties. For retirement plan errors like late 401(k) deposits, the DOL’s Voluntary Fiduciary Correction Program allows employers to self-correct certain ERISA violations and receive conditional relief from excise taxes.²⁰

Keep the Records Long Enough

The audit is only as defensible as the records behind it. Federal retention periods overlap, and the longest one governs.

Employment tax records, four years. The IRS requires records tied to employment taxes, including Forms 941, 940, W-2, and W-4, for at least four years after the later of the tax due date or the date the tax was paid.²¹
Payroll records, three years. The FLSA requires payroll records (pay rates, deductions, total wages) for at least three years. Supporting documents like time cards, wage rate tables, and work schedules must be kept for two.⁵
Retirement plan records, six years. ERISA Section 107 requires records related to plan contributions, including 401(k) deferrals and employer matches, for at least six years after the filing date of the documents based on that information.

Because the IRS four-year clock doesn’t start until the tax is paid or due, and ERISA runs to six, most employers adopt a blanket six-year retention policy for all payroll records. That single rule covers every federal minimum and leaves margin if a dispute surfaces later.

Document Findings and Deliver the Report

Every test needs workpapers a reviewer could pick up cold and follow. Document the sampling methodology, the population sampled, each control tested, and every calculation discrepancy. If you tested 40 overtime calculations and two were wrong, the workpapers should identify which two, the correct amount, and the dollar impact.

The final report synthesizes the workpapers for management. Organize findings by severity. A material weakness, like one person being able to create employees and authorize their payments, ranks above a minor process gap like inconsistent timecard signatures. Each finding needs the condition (what you found), the criteria (what the rule or policy requires), the effect (the financial or compliance risk), and a specific recommendation. “Improve controls” is not a recommendation. “Restrict master file edit access to the HR director and require a second approval from the controller for all pay rate changes” is.

Schedule an exit conference to walk management through the results. The cycle closes when management provides a written response and a timeline for each recommendation. That response becomes part of the permanent file, and the starting point for the next audit.

1
Internal Revenue Service. Failure to Deposit Penalty
2
Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500
3
Internal Revenue Service. About Form W-4, Employee’s Withholding Certificate
4
U.S. Citizenship and Immigration Services. I-9, Employment Eligibility Verification
5
U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
6
Internal Revenue Service. Publication 15-T Federal Income Tax Withholding Methods
7
Social Security Administration. Contribution and Benefit Base
8
Internal Revenue Service. Retirement Topics – 401(k) and Profit-Sharing Plan Contribution Limits
9
U.S. Department of Labor. Fact Sheet 30 – Wage Garnishment Protections of the Consumer Credit Protection Act (CCPA)
10
Internal Revenue Service. Instructions for Form 941 (03/2026)
11
Social Security Administration. Deadline Dates to File W-2s
12
Internal Revenue Service. Information Return Penalties
13
Office of the Law Revision Counsel. 26 U.S. Code 6672 – Failure to Collect and Pay Over Tax, or Attempt to Evade or Defeat Tax
14
U.S. Department of Labor. Fact Sheet 17A – Exemption for Executive, Administrative, Professional, Computer and Outside Sales Employees Under the Fair Labor Standards Act
15
U.S. Department of Labor. Fact Sheet 23 – Overtime Pay Requirements of the FLSA
16
Internal Revenue Service. Independent Contractor or Employee
17
Internal Revenue Service. Worker Reclassification – Section 530 Relief
18
Internal Revenue Service. Topic No. 759, Form 940 – Employers Annual Federal Unemployment (FUTA) Tax Return
19
Internal Revenue Service. Instructions for Form 941-X
20
U.S. Department of Labor. Voluntary Fiduciary Correction Program
21
eCFR. 26 CFR 31.6001-1 – Records in General