Payroll Audit: A Data-First Process and Checklist

A payroll audit is a structured review of payroll data, source records, processing controls, and evidence, run to verify that employees are paid accurately and that the records behind each payment are complete and compliant. It tests the employee population, authorizations and status changes, hours and pay rates, variable earnings, deductions and taxes, and access and segregation of duties. It produces two artifacts: an exception log listing everything that failed a test and how it was resolved, and an evidence package another reviewer can reproduce without asking the auditor a single question.

That last part is what most payroll audit guidance skips. Knowing what to inspect is easy; the checklists agree on employees, hours, taxes, and deductions. A defensible audit runs differently: build a traceable audit dataset from the source records first, prove the payroll population is complete, then test by assertion and document every exception with evidence tied back to a specific file and page. This guide walks through that sequence.

The records themselves carry retention obligations that shape the audit. In the United States, for example, IRS employment tax recordkeeping guidance advises employers to keep all records of employment taxes for at least four years after filing the fourth quarter for the year, including wage payment amounts and dates, employee data, withholding certificates, and tax deposit records. Those categories double as a working inventory of what a payroll audit should be able to put its hands on. Other jurisdictions set different periods, but the principle holds everywhere: if a record must exist, the audit can test against it.

Five Payroll Reviews That Get Called an Audit, and Which One This Is

The term gets applied to at least five different jobs, and mixing them up wastes preparation effort. Each one uses overlapping records but answers a different question.

A pre-run review checks the current payroll before it is released: new starters present, leavers stopped, one-off payments approved. It protects a single pay run and ends when that run is paid.

Payroll reconciliation ties totals during or after each cycle: register to general ledger, net pay to bank activity, withheld taxes to filings. It proves the numbers agree across systems, cycle by cycle.

A periodic internal payroll audit, the subject of this guide, evaluates the population, transactions, controls, and evidence across a wider period, typically a full year. You choose the scope, the criteria, and the thresholds, and you test whether the process, not just one run, holds up.

External audits apply someone else's rule set. A payroll compliance audit tests employer reporting against plan documents, trust agreements, or collective bargaining agreements. Purpose-specific variants have their own preparation demands: preparing payroll data for a workers' comp audit means organizing wages by classification code for an insurer, while a 401(k) audit package checklist assembles census, contribution, and remittance support for a plan auditor. In each case the plan terms, insurer rules, or statutes decide what gets tested, not you.

Transaction due diligence works many of the same records but asks deal-specific questions: what does this workforce cost, is the history consistent, what liabilities transfer with it.

The internal audit is the only one of the five you fully control, which is exactly why it is the one that finds problems before an external party does.

Build the Audit Dataset Before You Test Anything

Exception testing against a folder of PDF registers and mismatched exports produces findings nobody can retrace. Three months later, the question "why was this flagged?" has no answer because the flag lives in a highlighted cell with no source reference. The fix is structural: before any test runs, normalize the source records into one audit dataset, and run the entire payroll audit process against that dataset.

The working shape is an employee-period table: one row per employee per pay period. A practical schema, ready to lift into a spreadsheet:

Group	Fields	What it carries
Identity and scope	Stable employee ID, legal entity, employment status, pay-period start and end, payment date	Anchors each row to one person, one entity, one period
Pay inputs	Pay basis and rate; regular, overtime, and other hours; earning and deduction codes	What the pay was computed from
Amounts	Gross pay, taxes, deductions, employer contributions, net pay, payment reference	What was paid and where it went
Audit trail	Source file and page, exception reason, resolution, preparer, reviewer, sign-off date	Ties every row to its origin and carries the review itself

Adapt the fields to your payroll; the schema is a starting point, not a standard. What must survive any adaptation are the two groups that make this an audit file rather than a data dump. The source reference ties every row back to the exact register page or payslip it came from, so any number can be verified against its origin in seconds. The exception, resolution, and sign-off fields carry the review itself, so the dataset ends the audit as the record of what was tested and what was found.

The rows come from payroll registers, payslips, timekeeping exports, HR change logs, bank payment files, and filed tax returns. When registers and payslips arrive as PDFs or scans, as they usually do from providers and legacy systems, payroll data extraction is the normalization step that turns them into rows; the walkthrough on how to extract payroll data from PDF to Excel covers the conversion methods. Normalization produces the dataset and nothing more. Every judgment in the audit (what to test, what counts as an exception, how it resolves) is the auditor's.

Payroll data is dense with personal information, so build minimization in from the first row. Use stable internal IDs rather than names or Social Security numbers in working tables. Mask SSNs and bank account numbers wherever a field must exist at all. Restrict access to the working file to the people doing the audit, and retain the source documents separately from the review worksheet so access to one does not automatically grant access to the other.

Prove the Population Is Complete Before Testing Exceptions

Before asking whether any payment is wrong, prove that no payment and no person is missing. This ordering is the core of how to audit payroll defensibly, and it is the step the standard checklists omit. An exception test run over an incomplete population passes silently over exactly the runs and people most likely to hide problems: the off-cycle bonus run that never made it into the folder, the terminated employee whose final period sits in neither report.

Four tie-outs establish completeness.

Run calendar tie-out. List every payroll run you expect for the period from the pay calendar: regular cycles, off-cycle runs, bonus runs, correction runs. Tie each expected run to a register actually received. A missing off-cycle run is a completeness failure; resolve it before anything else proceeds.

Period and entity coverage. Confirm each register covers the date range and legal entity it claims. Check the boundaries specifically: no missing days between consecutive periods, no overlap where a correction run double-covers dates, no register that mixes two entities.

Headcount roll-forward. Opening headcount plus hires minus terminations must equal closing headcount, reconciled against HR records for the same period. Then check the individual cases the roll-forward implies: every new hire appears from their first eligible period, every terminated employee disappears after their final payment, and employees on leave appear or not according to their pay status in every period.

Control-total tie-out. For each run, tie gross pay, total taxes, total deductions, and net pay between the source register and the audit dataset. This proves the normalization step transferred the data faithfully, so every later exception traces to a real record.

Completeness is binary. Either every expected run, period, entity, and person is accounted for, or the gap is identified and explained before testing continues. Document each tie-out with its totals and its outcome; these worksheets become the first entries in the evidence package.

Test by Assertion: Authorizations, Hours, Rates, and Exceptions

With completeness proven, every remaining test asks whether recorded pay was authorized, whether it is accurate, whether the payee is valid, and whether the controls around all three held. Grouping payroll audit procedures by what they prove, rather than by which document they touch, keeps each test pointed at a findable exception with a documentable resolution.

Authorization and master-data changes. Pull every hire, termination, rate change, and status change in the period from the HR change log. Trace each to a signed or system-logged approval. Two patterns get flagged without exception: changes with no approval trail, and changes entered and approved by the same person.

Hours and rates. For a sample of employee-periods, tie paid regular and overtime hours to the timekeeping records, then recompute gross pay from rate and hours and compare it to the register. Recomputation catches what visual review cannot: a rate applied from the wrong effective date, overtime paid at the base multiplier, hours shifted across a period boundary. Investigate any employee whose gross pay spikes against their own prior periods.

Variable and one-off payments. Pull every bonus, commission, retroactive adjustment, and correction run in the period and trace each payment to its authorization. One-off payments deserve full coverage rather than sampling, because a payment that occurs once, outside the regular cycle, is where an unauthorized amount hides most comfortably.

Deductions, benefits, and taxes. For the sample, agree each deduction code and amount to the employee's election forms and to the statutory tables in force for the period. Confirm employer contributions follow the current plan terms.

Payee validity. Screen the full population for payments dated after termination, duplicate bank account references across different employee IDs, and near-duplicate employee records. Review every void and reversal for what it corrected and who approved the correction; reversals are where errors get buried as well as fixed.

Access and segregation of duties. Confirm that the people who change master data, approve payroll, and release payments are three roles, not one login. Then compare system access lists against current job responsibilities; a payroll internal controls audit routinely finds active credentials belonging to people who changed roles a year ago.

Prior-period variance. Compare each employee's current gross to their prior run. Set the variance threshold before looking at results, then explain every variance above it. A threshold set after the fact bends toward whatever explanation is convenient.

Reconciliation runs through this program as a single consumed procedure: the audit verifies that the per-cycle payroll reconciliation process was performed and reviews its unresolved variances, but the general ledger, bank, Form 941, and W-2 tie-out mechanics belong to that process, not inside this one. The audit consumes reconciliation's results; it does not repeat its work.

Record Exceptions So Another Reviewer Can Reproduce Them

Scattered notes and highlighted cells are where audit findings go to die. The alternative costs one structured record per finding.

An exception record carries seven fields: the source reference (file and page), the condition found, the criteria it was tested against, the explanation obtained, the resolution or correction applied, who resolved it, and reviewer sign-off with date. Keep one row per exception, in or alongside the audit dataset, so the finding and the data it came from never separate.

An exception is not the same thing as an error. An exception is anything that failed a test until explained, and many resolve as documented, legitimate variances: the rate change approved verbally and papered a week later, the negative net pay that turns out to be a benefits correction. Recording the explanation is what stops next year's audit from re-investigating the same items, and it is what distinguishes a resolved exception from an ignored one when someone else reads the file.

The evidence package is the audit's deliverable, and these payroll audit working papers have five components: the audit dataset itself, the completeness tie-outs with their totals, the exception log, copies of or references to the key approvals tested, and the sign-off record showing who prepared and who reviewed each part. The test of a finished package is reproducibility: a reviewer holding the package and the source records should reach the same conclusions without asking the original auditor anything. If a conclusion depends on something the auditor remembers but did not write down, the package is not done.

Store the package under the same discipline as the dataset: masked working tables, source documents held separately, access limited to those who need it. Retain it against the record-keeping horizons the records themselves carry, at least four years for U.S. employment tax records under the IRS guidance cited earlier, or the equivalent period in your jurisdiction.

Some findings outgrow the internal process. Underreported plan contributions, misclassified workers, or missed statutory filings implicate external obligations, and those move into the relevant external process with counsel or the plan administrator. The internal package becomes the starting evidence for that process, which is a considerably better position than starting the investigation from zero.

Reusing the Audit Dataset for Payroll Due Diligence

When a company is bought, sold, or raising capital, diligence teams ask deal-specific questions of the same population an internal audit already normalized: what does this workforce actually cost by entity and period, how is compensation structured and trending, are taxes and contributions consistent with the filings, are workers classified defensibly, and does historical payroll behave consistently from period to period.

A working payroll due diligence checklist draws directly from the audit table's own fields:

• Verified headcount by period and entity, from the roll-forward rather than an org chart
• Gross-to-net consistency across periods, with every structural break explained
• Variable-pay concentration: who receives bonuses and commissions, and how much of total cost they represent
• Off-cycle payment history, complete with authorizations
• Open exceptions and their resolutions from the most recent audit

The lens differs from the internal audit's in one sentence: diligence reviewers apply deal criteria and materiality thresholds, not the company's own control criteria, so the same record can pass an internal audit and still raise a diligence question.

The practical payoff runs in the seller's favor. A company that audits its payroll annually walks into diligence with the evidence package already built, answers request-list items by exporting from a dataset instead of excavating PDFs, and shortens the cycle at exactly the moment delays are most expensive.

The Payroll Audit Checklist, Organized by What Each Step Proves

This payroll audit checklist encodes the full sequence. Each item is an action with a verifiable done-state; a stage is complete when every item in it is documented, not merely performed.

1. Scope and dataset

• Define the audit period and the legal entities in scope
• Gather registers, payslips, timekeeping exports, HR change logs, bank payment files, and tax filings for the period
• Build the employee-period table with a source file and page reference on every row
• Mask SSNs and bank details; replace names with stable internal IDs in working tables

2. Completeness

• Tie every run on the pay calendar, including off-cycle runs, to a register received
• Confirm period and entity coverage with no gaps or overlaps at boundaries
• Reconcile the headcount roll-forward to HR records; confirm hires, terminations, and leave cases appear in the correct periods
• Tie control totals (gross, taxes, deductions, net) between each register and the dataset

3. Authorization and master data

• Trace every hire, termination, rate change, and status change to an approval
• Flag any change entered and approved by the same person

4. Hours, rates, and recomputation

• Tie paid hours to timekeeping records for the sample
• Recompute gross from rate and hours; explain every recomputation difference

5. Variable and off-cycle payments

• Trace every bonus, commission, retro adjustment, and correction run to its authorization, at full coverage

6. Deductions, benefits, and taxes

• Agree deductions to election forms and statutory tables in force for the period
• Confirm employer contributions against current plan terms

7. Payee validity

• Screen for payments after termination, duplicate bank references, and duplicate employee records
• Review every void and reversal for cause and approver

8. Access and segregation of duties

• Confirm master-data changes, payroll approval, and payment release sit with different people
• Match system access lists to current roles

9. Reconciliation results

• Confirm per-cycle reconciliations were performed; review unresolved variances

10. Evidence and sign-off

• Complete the exception log with resolutions and sign-offs
• Assemble the evidence package: dataset, tie-outs, exception log, approval references, sign-off record
• Obtain reviewer sign-off on the package as a whole

Run the full program at least annually. After a payroll system migration, an acquisition, or a burst of headcount change, rerun stages 2 and 3 without waiting for the next annual cycle, because completeness and authorization are what those events break first. Keep the dataset schema between audits: next year's audit should start from a known structure and a prior exception log, not from scratch.