What Is a Payroll Audit? Why Your Company Needs One Now
5/7/2026
A payroll audit is a systematic review of whether the money you paid, the taxes you withheld, and the records you kept actually match what the law and your own policies required. That sounds procedural. In practice it is the only reliable mechanism for finding errors that are individually invisible and collectively expensive.
There are two very different things called a payroll audit: the one you run on yourself, and the one an agency runs on you. This guide covers both — starting with the self-audit, because the entire argument for doing one is that it changes the outcome of the other.
The Two Kinds of Payroll Audit
Internal self-audit. You choose the scope, you control the timeline, and any error you find is a correction rather than an assessment. Most voluntary correction programs — reduced-rate settlements, penalty abatement for reasonable cause, retirement plan self-correction — are only available to employers who find and report the problem before an examiner does.
Agency examination. The IRS, the Department of Labor's Wage and Hour Division, a state revenue or unemployment agency, or a workers' compensation carrier sets the scope. They choose the lookback period. Findings become assessments with penalties and interest attached.
The difference is not the arithmetic. It is the price of the same finding.
Our How To Handle Payroll Audits & Penalties page covers both sides, and the How To Do A Payroll Audit — Former Auditor's Expert Advice session is taught from the examiner's perspective, which is the more useful vantage point.
What Triggers an Agency Examination
Payroll examinations are rarely random. The common triggers:
- A worker files for unemployment after being paid as a contractor. The state processes the claim, finds no wages reported, and opens an inquiry. This is the single most common trigger for a misclassification examination, and it frequently cascades to the IRS.
- An employee complaint to the Wage and Hour Division about overtime, off-the-clock work, or final pay. One complaint routinely expands into a review of the entire job classification.
- Form W-2 and Form 941 totals that do not reconcile. Automated matching flags the mismatch.
- A late or missed deposit, particularly a pattern of them.
- Retirement plan Form 5500 data inconsistent with reported payroll.
- Industry-targeted enforcement initiatives — construction, restaurants, home health, staffing, and janitorial services receive concentrated attention.
- A workers' compensation premium audit finding job classifications that do not match actual duties.
Notice that most triggers originate with a person, not a computer. That means your best protection is not statistical obscurity — it is being correct.
A 12-Step Self-Audit Procedure
Scope this to a representative sample first — one full quarter and a cross-section of 20 to 30 employees covering every classification, location, and pay type. If the sample is clean, extend selectively. If it is not, widen immediately.
1. Reconcile Wages to Filed Returns
Tie the payroll register to each Form 941 you filed for the period: total wages, federal income tax withheld, Social Security wages and tax, Medicare wages and tax. Then tie the year's four returns to the Forms W-2 and W-3.
Any variance is a finding. Common causes: a mid-year deduction code added without a tax mapping, imputed income posted to the general ledger but not to taxable wages, or a manual check issued outside the system.
Our Payroll Reconciliation And Reporting session covers the tie-out.
2. Validate the Taxable Wage Matrix
Build a grid of every deduction and earnings code against every tax base and verify each cell. The high-frequency errors:
- Traditional 401(k) deferrals incorrectly reducing FICA wages (they reduce income tax wages only)
- Section 125 contributions not reducing unemployment wages
- Group-term life coverage over $50,000 not generating imputed income
- Non-accountable expense reimbursements not treated as wages
3. Test Worker Classification
Pull every 1099 recipient and flag anyone paid continuously for over a year, paid more than a comparable employee's salary, working exclusively for you, supervising your employees, or performing work central to your business.
For each, confirm a classification memo exists applying the governing tests. Consistency within a role is what preserves Section 530 relief — treating some people in a role as W-2 and others as 1099 generally forfeits it.
See determining employee vs. independent contractor status and the How To Identify And Pay Independent Contractors session.
4. Test Exempt Classification
Separately, re-test every exempt employee against both the salary basis and the duties test. Job titles carry no weight. Check whether any state you operate in imposes a salary threshold above the federal level, and whether any exempt employee's pay has been docked in a way that destroys salary basis.
5. Recalculate Overtime at the Regular Rate
Select several employees who received a non-discretionary bonus, shift differential, or incentive payment in a week with overtime, and recompute the regular rate by hand: total straight-time compensation ÷ total hours worked.
Then check whether multi-week bonuses were allocated back to raise the regular rate for the weeks earned. Most systems do not do this automatically, and it is a standard Wage and Hour finding.
Our Payroll Wage & Hour Training & Certification Program and DOL rules on overtime session cover the calculation.
6. Audit Time Records
Look for the patterns that indicate systemic problems rather than isolated ones:
- Non-exempt employees recording exactly 40.0 hours every week
- Missing punches routinely defaulted to a standard shift
- Retroactive time edits without documented approval
- Meal breaks auto-deducted with no evidence the break was taken
- After-hours email or system activity by non-exempt staff with no corresponding time
Also confirm compensable time is captured correctly — required training, travel between job sites, and controlled waiting time. See travel pay rules.
7. Recalculate Garnishments
For every active garnishment, recompute from the order:
- Disposable earnings = gross less legally required deductions only (not health premiums, not 401(k))
- The applicable cap — the more protective of federal and state
- Priority ordering where multiple orders exist, and the aggregate ceiling
Garnishment compliance is close to strict liability; under-withholding on a support order can make the employer liable for the shortfall. Our garnishment hub with state-by-state rules and the Garnishments, Child Support Orders, And Other Levies session cover the calculation.
8. Verify Deduction Authorizations
Every voluntary deduction needs written, specific, revocable authorization on file. Pay particular attention to overpayment recoveries — most states require fresh authorization for the specific recovery, and several cap the per-period amount or prohibit the deduction entirely.
See Payroll Deductions: Mandatory vs Voluntary.
9. Review Deposit Timing
Confirm every federal deposit was made on the correct schedule for the year's lookback period, and check whether any payroll triggered the $100,000 next-day rule — a single bonus or severance run can, and it also promotes the employer to semi-weekly status going forward.
Separately confirm retirement plan deferrals were deposited as soon as administratively feasible. Late deferral deposits are an ERISA prohibited transaction requiring correction, not simply a delay.
10. Confirm the Multi-State Footprint
List every state where any employee performs work and confirm, for each: withholding registration, unemployment insurance account, new hire reporting, paid family and medical leave contributions, pay statement content requirements, and final paycheck deadlines.
Check reciprocal agreement paperwork for anyone living in one state and working in another — the residence-state-only treatment requires the employee's non-residency certificate on file.
See Multi-State Taxation training and multi-state payroll tax compliance.
11. Test Internal Controls
Walk the process and answer plainly:
- Can one person add an employee, set a rate, change bank details, and release payroll?
- Does a variance report get reviewed by someone other than the preparer before release?
- Does anyone reconcile HR's active roster to the payroll register?
- Are bank account changes reviewed, including multiple employees sharing an account?
Ghost employees and inflated hours both depend on concentrated authority. Our How to Prevent Payroll Fraud session covers the control set.
12. Review Records and Retention
Confirm you can actually produce, for the full retention period: time records, pay registers, tax returns and deposits, W-4s and state certificates, I-9s, garnishment orders and correspondence, and deduction authorizations.
The FLSA requires payroll records for three years and wage-computation records for two; employment tax records should be retained at least four years after the tax is due or paid, with ERISA and state law adding their own periods. See payroll recordkeeping requirements and Payroll Records: What To Keep, What To Toss.
How to Scope and Sample Properly
An audit that reviews everything never gets finished, and an audit that reviews a convenient handful proves nothing. Sampling is what makes a self-audit both credible and completable.
Build a stratified sample, not a random one. Random selection in payroll tends to return a pile of ordinary salaried employees, because that is what most populations are. Instead, deliberately include at least one of each of the following:
- An employee in every pay type — hourly non-exempt, salaried exempt, salaried non-exempt, commissioned
- An employee in every work state, especially any state with only one or two workers
- Anyone with an active garnishment
- Anyone who received a bonus, commission, or incentive payment in a week containing overtime
- Anyone who started or terminated mid-period
- Anyone paid off-cycle or by manual check
- Anyone with imputed income or a taxable fringe benefit
- The highest-paid employees, who trip wage bases and thresholds
- Anyone who moved states, changed classification, or changed bank details during the period
That list is where errors live. The single-employee state, the mid-period termination, and the bonus-plus-overtime week are all low-frequency and high-error-rate — exactly what a random sample tends to miss.
Set an error threshold in advance. Decide before you begin what result causes you to expand scope. A reasonable standard: any single finding with a compliance consequence triggers a full-population review of that specific issue, even if the rest of the sample is clean. One misapplied garnishment cap is not a sampling anomaly; it is a configuration error that is almost certainly affecting every similar case.
Distinguish isolated errors from systemic ones. A one-time keying mistake is a correction. A rule mapped wrongly in the system is a population-wide liability. Ask of every finding: could this have happened only to this person, or would it happen to anyone in the same situation? The second answer changes both the scope and the urgency.
Time it deliberately. The best window is after a quarter closes and before year-end pressure begins — late in the first or third quarter for most employers. Auditing in December guarantees you find something you no longer have time to fix cleanly.
Write it down as you go. Scope, procedures performed, sample selected, findings, corrections, and dates. An undocumented audit provides no evidence of reasonable care, which is the entire point of doing it before someone else does.
What Auditors Find Most Often
Across internal and agency reviews, the same findings recur:
|
Finding
|
Why it happens
|
|
Overtime on base rate, not regular rate
|
Bonuses and differentials not mapped as includable
|
|
Contractors who are employees
|
Long-term engagements never re-tested
|
|
Exempt employees failing the duties test
|
Classification set at hire and never revisited
|
|
W-2 to 941 variances
|
A deduction code added without tax mapping
|
|
Garnishment under-withholding
|
Disposable earnings computed after voluntary deductions
|
|
Missing I-9s or technical I-9 errors
|
No periodic self-audit
|
|
Unregistered state withholding
|
Remote hire treated as an address change
|
|
Late retirement plan deferrals
|
No monitoring of deposit timing
|
|
Undocumented overpayment recoveries
|
Reliance on a general authorization
|
If an Examination Notice Arrives
- Do not volunteer scope. Answer what is asked. An examination of one quarter should not become an examination of four years because you offered the files.
- Involve counsel early, particularly where misclassification or willfulness may be alleged. Some communications are privileged only if counsel is genuinely engaged.
- Designate a single point of contact. Multiple people answering the same question inconsistently is its own finding.
- Reconstruct the record before you produce it. Know what your own files show.
- Do not correct the past silently while the examination is open. Coordinate corrections with counsel; unilateral fixes can look like concealment.
- Preserve everything. Suspend routine document destruction immediately.
Our How To Minimize And Eliminate Payroll Penalties session covers reasonable-cause abatement and penalty mitigation.
Why "Now" Is the Right Answer
Three reasons the timing argument holds regardless of your situation.
Voluntary correction is a limited-time offer. Reduced-rate settlement programs, penalty abatement for reasonable cause, and plan self-correction are generally unavailable once an examination begins. The value of the self-audit is precisely that it happens first.
Statutes of limitation run in both directions. Every month an error continues, the exposure grows and your window to correct the earliest periods narrows.
2026 introduced a new reporting obligation. Beginning with the 2026 tax year, employers must separately report qualified tips and qualified overtime compensation on Form W-2 under the One Big Beautiful Bill Act, and only the premium portion of FLSA-mandated overtime qualifies. If your system posts all overtime to one earnings code, the data you need in January does not exist yet. That is a configuration project with a hard deadline, and a self-audit is how you discover it in time. See our OBBBA payroll forms update session.
Frequently Asked Questions
What is a payroll audit?
A systematic review of whether the wages paid, the taxes withheld, and the records retained actually match what the law and the employer's own policies required. There are two distinct versions: an internal self-audit, where you set the scope and any finding is a correction, and an agency examination by the IRS, the Department of Labor, or a state agency, where they set the scope and findings become assessments with penalties and interest.
Why does a company need a payroll audit?
Because most payroll errors are individually invisible and automatically repeating, so nothing surfaces them except a deliberate review. The financial argument is timing: reduced-rate settlement programs, penalty abatement for reasonable cause, and retirement plan self-correction are generally available only to employers who find and report a problem before an examiner does. The same finding costs materially less when you discover it.
What do payroll auditors look for?
The recurring findings are overtime computed on the base rate rather than the FLSA regular rate, contractors who meet the tests for employee status, exempt employees who fail the duties test, Form W-2 totals that will not reconcile to the Forms 941, garnishment under-withholding from disposable earnings computed incorrectly, missing or technically deficient Forms I-9, unregistered state withholding for remote workers, late retirement plan deferral deposits, and overpayment recoveries taken without fresh written authorization.
How do you conduct a payroll self-audit?
Reconcile the payroll register to each filed Form 941 and then to the Forms W-2 and W-3; validate the taxable wage matrix code by code; re-test worker and exempt classifications; recalculate overtime at the regular rate for weeks containing bonuses; review time records for systemic patterns; recompute every active garnishment from the order; verify deduction authorizations; check deposit timing including the $100,000 rule; confirm the multi-state footprint; test internal controls and segregation of duties; and confirm records are retrievable for the retention period.
How should a payroll audit sample be selected?
Stratified rather than random. Random selection returns mostly ordinary salaried employees, which is where errors are least likely. Deliberately include one of each pay type, one employee from every work state including single-employee states, anyone with an active garnishment, anyone who received a bonus in a week containing overtime, anyone who started or terminated mid-period, anyone paid off-cycle, anyone with imputed income, and the highest-paid employees who trip wage bases.
What should an employer do if it receives an audit notice?
Answer only what is asked rather than volunteering scope, involve counsel early where misclassification or willfulness may be alleged, designate a single point of contact so inconsistent answers do not become their own finding, reconstruct your own records before producing them, coordinate any corrections with counsel rather than fixing the past unilaterally while the examination is open, and immediately suspend routine document destruction.
Build the Capability
A self-audit performed once is useful. Performed on a schedule, it changes the department's risk profile permanently.
Document each audit: scope, procedures performed, findings, corrections, and the date. That file is your evidence of reasonable care — and reasonable care is the standard most penalty abatement turns on.
