Payroll Audit Procedures: A Step-by-Step Guide for Internal Auditors
7/14/2026
A payroll audit that samples randomly and tests arithmetic will find almost nothing, because payroll arithmetic is performed by software and is usually right. The errors live in configuration, in classification, and in the exceptions — and finding them requires a deliberately biased sample and tests aimed at specific failure modes.
This guide is written for whoever performs the review, whether that is internal audit, a payroll manager conducting a self-audit, or an external advisor.
Scoping
Define the period. One full quarter is the practical minimum, because quarterly reconciliation to the Form 941 is one of the primary tests and requires a complete quarter. A full year is better where the objective includes classification testing.
Define the population. Every entity, every EIN, every location, every state. A common scoping failure is auditing the main population and omitting a small acquired entity or a single-employee state, which is precisely where controls are weakest.
Identify the risk areas applicable to this organization, since not all apply everywhere: worker classification, exempt status, regular-rate calculation, taxable wage mapping, garnishments, multi-state obligations, imputed income, retirement plan administration, off-cycle payments, and access controls.
Establish the expansion trigger in advance. Decide before you begin what result causes you to widen scope. A reasonable standard: any single finding with a compliance consequence triggers a full-population review of that specific issue, even if the remainder of the sample is clean. One misapplied garnishment cap is not a sampling anomaly — it is a configuration error affecting every similar case.
Sampling: Stratify, Do Not Randomize
Random selection in payroll returns mostly ordinary salaried employees, because that is what most populations contain. Those employees are where errors are least likely.
Build a stratified sample deliberately including at least one of each:
- Each pay type — hourly non-exempt, salaried exempt, salaried non-exempt, commissioned
- Each work state, especially states with only one or two employees
- Anyone with an active garnishment
- Anyone who received a bonus, commission, or incentive in a week containing overtime
- Anyone who started or terminated mid-period
- Anyone paid off-cycle or by manual check
- Anyone with imputed income or a taxable fringe benefit
- The highest-paid employees, who trip wage bases and thresholds
- Anyone who changed states, classification, or bank details during the period
- Anyone with multiple pay rates
- Rehires
Every item on that list is low-frequency and high-error-rate. That combination is exactly what random sampling misses.
Substantive Tests by Risk Area
Reconciliation
Tie the payroll register to each filed Form 941 — wages, federal income tax withheld, Social Security wages and tax, Medicare wages and tax. Then tie the four returns to the Forms W-2 and W-3.
The mechanical trap: Form 941 reports the combined employer and employee share of Social Security and Medicare, while Form W-2 reports only the employee share. Halve the 941 figure for the base taxes — but not the 0.9% Additional Medicare Tax, which is employee-only. Missing this manufactures a variance that does not exist, and it is the most common false finding in a payroll audit.
Also reconcile bank disbursements to the register. This is the only test that finds a payment issued outside the system, and it should be performed first, because an off-system payment affects every subsequent test. See our year-end reconciliation guide.
Taxable Wage Mapping
Obtain a list of every earnings and deduction code and test the mapping against all four bases. The high-frequency errors:
- Traditional 401(k) deferrals incorrectly reducing FICA wages — they reduce income tax wages only
- Section 125 contributions not reducing unemployment wages
- HSA contributions treated as though routed through a cafeteria plan when they are not
- Group-term life coverage over $50,000 generating no imputed income
- Non-accountable expense reimbursements not treated as wages
Focus on codes created during the period. Mapping errors rarely originate in the initial configuration; they arrive with a new benefit added mid-year by someone who copied an existing code. See our pre-tax vs. post-tax deductions guide.
Worker and Exempt Classification
Pull every 1099 recipient and flag anyone paid continuously for over a year, paid more than a comparable employee's salary, working exclusively for the organization, supervising employees, or performing work central to the business. Confirm a classification memo exists for each, and confirm consistency within roles — inconsistent treatment generally forfeits Section 530 relief.
Separately, re-test exempt employees against both the salary test and the duties test, from evidence rather than job descriptions. Confirm the federal salary level of $684 per week is met, and check any state threshold that exceeds it. See our exempt vs. non-exempt guide.
Regular Rate
Select employees who received a non-discretionary bonus, shift differential, or incentive in a week containing overtime and recompute by hand: total straight-time compensation divided by total hours worked.
Then test whether multi-week bonuses were allocated back across the weeks earned to generate retroactive premium. Most systems do not do this, and its absence is a standard Wage and Hour finding. Also audit whether bonuses characterized as discretionary genuinely were — check the announcement, not the plan document. See our overtime calculation guide.
Garnishments
For each active order, recompute from the order itself: disposable earnings on legally required deductions only, the applicable cap using the more protective of federal and state, priority ordering across competing orders, and the aggregate ceiling. Confirm the amount is recalculated each period rather than set as a flat figure, and confirm any required answer was filed within the deadline. See our garnishment guide.
Multi-State
List every state where any employee performed work during the period — built from payroll data, not from a list of states the organization believes it operates in. Confirm for each: withholding registration, unemployment account and correct rate including add-on assessments, new hire reporting, paid family leave enrollment, pay statement content, and final-pay handling. Verify reciprocity certificates where residence-state-only withholding is applied.
Deposits and Filings
Confirm every deposit was made on the correct schedule for the year's lookback period, and specifically whether any payroll triggered the $100,000 next-day rule. Confirm retirement plan deferrals were transmitted as soon as administratively feasible — late deposits are an ERISA prohibited transaction, not merely a delay.
Time Records
Look for systemic patterns rather than individual errors: non-exempt employees recording exactly 40.0 hours consistently, missing punches defaulted to a standard shift, retroactive edits without documented approval, meal breaks auto-deducted with no evidence the break was taken, and after-hours system activity by non-exempt staff with no corresponding time.
Control Testing
Substantive testing finds errors; control testing predicts them.
Walk the process and establish, from observation rather than from a policy document:
- Can one person add an employee, set a rate, change bank details, and release payroll?
- Is a variance report reviewed by someone other than the preparer before release?
- Are bank account changes verified through a second channel?
- Does anyone reconcile HR's active roster to the payroll register?
- Is there a third-source headcount confirmation, such as department manager verification?
- Are exception reports actually reviewed, by a named person, within a defined time?
- Is access removed on departure and role change?
- Are the quarterly reconciliations performed and documented?
For each, test whether the control operated during the period, not merely whether it exists. A documented control that was performed twice in four quarters is a finding.
See our segregation of duties guide and How to Prevent Payroll Fraud.
Reporting Findings Usefully
Distinguish isolated from systemic. For every finding, ask whether it could have happened only to this person, or whether it would happen to anyone in the same situation. The second answer changes both the scope and the urgency, and it is the distinction management most needs.
Quantify where possible. "Overtime computed on the base rate for 140 non-exempt employees" is actionable in a way that "regular rate errors noted" is not. Estimate the exposure including the lookback period and liquidated damages where applicable.
Identify the root cause, not the symptom. A mapping error is not the finding; the absence of a review step when new codes are created is the finding. Correcting the instance without the cause guarantees recurrence.
Rank by exposure, not by count. One misclassification affecting a job family outweighs a dozen keying errors.
Note what you did not test. If the sample excluded a population, a period, or a jurisdiction, say so. A report that reads as comprehensive when it was not is worse than one that states its limits.
Document the audit itself — scope, sample basis, procedures performed, findings, and dates. Beyond audit standards, this file is the organization's evidence of reasonable care, which is the standard most penalty abatement turns on.
Our How To Do A Payroll Audit — Former Auditor's Expert Advice session is taught from the examiner's perspective, and How To Handle Payroll Audits & Penalties covers the examination side.
Frequently Asked Questions
How do you audit payroll?
Scope a full quarter minimum across every entity, EIN, and state; build a stratified sample deliberately including exception cases rather than a random one; perform substantive tests by risk area — reconciliation, taxable wage mapping, classification, regular rate, garnishments, multi-state obligations, deposits, and time records; test whether key controls actually operated during the period; then report findings distinguishing isolated errors from systemic ones with root causes identified.
Why shouldn't a payroll audit sample be random?
Because random selection returns mostly ordinary salaried employees, which is where errors are least likely. Errors concentrate in low-frequency, high-complexity cases — the single-employee state, the mid-period termination, the bonus paid in an overtime week, the employee with a garnishment, the highest earners who trip wage bases. A stratified sample deliberately including one of each finds what random sampling structurally misses.
What is the most common false finding in a payroll audit?
A phantom Social Security or Medicare variance caused by comparing Form 941 to Form W-2 without adjusting for scope. Form 941 reports the combined employer and employee share while Form W-2 reports only the employee share, so the 941 figure must be halved for the base taxes — but not for the 0.9% Additional Medicare Tax, which is employee-only and is not matched.
What should an internal auditor test in payroll configuration?
The mapping of every earnings and deduction code against all four tax bases — federal income tax, Social Security, Medicare, and unemployment wages — with particular attention to codes created during the period. Mapping errors rarely originate in the initial setup; they arrive with a new benefit added mid-year by someone who copied an existing code and inherited its flags.
How do you distinguish an isolated payroll error from a systemic one?
Ask whether the error could have happened only to that person, or whether it would happen to anyone in the same situation. A keying mistake is isolated and requires a correction; a rule mapped incorrectly in the system is systemic and represents a population-wide liability. That distinction determines both the scope of the correction and its urgency, and it is what management most needs from the report.
What should be included in a payroll audit report?
Scope and the basis of the sample, procedures performed, findings ranked by exposure rather than count, each finding characterized as isolated or systemic with a root cause identified, quantification where possible including lookback and liquidated damages exposure, and an explicit statement of what was not tested. Document the audit file itself, since it serves as the organization's evidence of reasonable care.
Going Deeper
Test configuration and exceptions rather than arithmetic, bias the sample toward complexity, and state the limits of what was covered. Document the audit file — it is the organization's evidence of reasonable care.
