Payroll control is one of the biggest controlling aspect in financial and accounting field after the cash and inventory (finished good and raw material). Why? Quiet straight forward reason; payroll or wages takes the second biggest portion of the “Cost Of Goods Sold” allocated in every company (or business in general) after the inventory. So, payroll control should be one of main focus of the controlling task of any financial managers, accounting manager, controllers, and the CFOs or the business owner (in a small business). Loosing control on the payroll system would lead a company into a big risk.
Unless you know what control you should apply to the payroll system, controlling this activities (read: transaction) could be a super complicated (yet tricky) task that you can not even imagine. You should understand the nature and flow of a payroll process. I know, you may not literate with human resource filed. It is not your expertise, yes so do I, but as a financial manager or controller, you should be familiar (hence become literate) with the payroll transaction and its nature. In this post, I am going to provide you set of control that will cover nearly every aspect of payroll system, such as: basic payroll system control, computerized timekeeping controls, computerized payroll system controls, payroll self-service controls, electronic payroll payment controls, cash payroll payment controls, electronic payroll remittance controls, and outsourced payroll controls.
Basic Payroll System Control
Controls are required for nearly every aspect of the basic payroll system, covering hours to be paid, deductions, pay rates, tax remittances, and pay distributions. The controls are as follows:
Verify time card receipt – The payroll staff will match received time cards against the current employer list and investigate all missing time cards.
Obtain approval for hours worked – The payroll staff will obtain the written approval of supervisors for hours worked by their direct reports, including overtime hours.
Obtain approval of pay rate changes – The payroll staff will obtain the written approval of a high-level manager on the standard pay change form for all changes in pay rates.
Obtain approval of negative deductions – The payroll manager will approve all negative payroll deductions.
Obtain approval of payroll advances – An employee’s immediate supervisor and the controller will approve any request for a payroll advance.
Review wage and tax calculations. A second payroll clerk will review the payroll wage and tax calculations for errors, and adjust any errors found.
Match payroll register to authorizing documents. A second payroll clerk will compare the payroll register to authorizing deduction forms, pay requests, change forms, and so on to ensure that all components of the payroll were properly authorized.
Issue checks directly to recipients. The paymaster will require a photo identification before issuing paychecks to employees, and require recipients to sign for checks received.
Retain unclaimed paychecks. The paymaster will retain an employee’s check in a secure location until the employee is personally available to receive it.
Segregate the paymaster function. The paymaster will not have responsibility for any other payroll activities.
Review un-cashed payroll checks. The paymaster will follow up with employees regarding un-cashed paychecks.
Review tax remittances. A second payroll clerk will review the amount of tax remittances and the completeness of accompanying remittance documents prior to the remittances being delivered to the government.
Remit taxes on a timely basis. The payroll manager will ensure that all payroll taxes are remitted to the appropriate government entities on a timely basis.
Review outstanding advances. The payroll staff will regularly review the repayment status of all outstanding pay advances.
Limit access to completed change authorization forms. The payroll clerk will store signed payroll change authorization forms in a secure location to reduce the risk of subsequent document modification.
Issue paycheck list to department managers. The paymaster will issue a list of paychecks distributed to the department managers, with instructions to search the list for ghost employees.
Reconcile the payroll bank account. The controller will reconcile the payroll bank account and investigate any variances.
Audit pay deductions. The internal audit staff will periodically compare deduction authorizations to the actual deductions being taken from employee pay, and investigate any variances.
Audit no-deduction paychecks. The internal audit staff will periodically search for paychecks having no deductions, and determine if these are being written for ghost employees.
Audit employee addresses. The internal audit staff will periodically search for matching employee addresses on multiple paychecks, and determine if multiple instances of the same address are caused by employees fraudulently paying themselves through ghost employees.
Compare tax forms to pay documentation. The internal audit staff will periodically match year-end employee tax forms to employee pay change authorizations and termination documentation, and investigate any variances.
Compare payroll payments to human resources files. The internal audit staff will periodically verify that human resources files exist for all employees being paid, and investigate any missing files.
Review paychecks for double endorsements. The internal audit staff will periodically review a selection of paychecks for double endorsements, indicating the possible use of ghost employees.
Compare the payroll salary budget to actual expenditures. The internal audit staff will match the expected payroll as outlined in the budget to actual payments, and investigate any differences.
Computerized Timekeeping Controls
Controls for computerized time clocks are used to ensure that the correct numbers of hours are recorded by the employees who actually worked the recorded hours. The controls are as follows:
Time clock controls employee hours. The computerized time clock will block out hours when employees are allowed to clock in or out.
Time clock requires overtime approval. The computerized time clock will require a supervisory approval code before an employee can record overtime hours.
Review time clock reports. The payroll clerk will review time clock exception reports for such items as missed punches, late punches, and overtime hours worked, and investigate problems as necessary.
Use biometric clocks. Biometric clocks will not allow time recording by anyone but people specifically
Identified as being current employees. Link photo images of employees to badge scanner. An electronic camera will record the image of each employee as they enter time in the time clock, which the payroll clerk will monitor to detect buddy punching.
Review hours worked. Supervisors will regularly review time clock reports itemizing hours worked by employee, and investigate any unusual amounts.
Computerized Payroll System Controls
Controls in a computerized payroll system should incorporate many of the controls already noted for a manual system, but can be streamlined in the area of timekeeping controls. The controls are as follows:
Restrict access to the employee master file. The computer system will restrict access to the employee master file to authorized employees.
Automatic reporting of missing time cards. The computer will automatically compare the employee master file to submitted time cards, and report on employees for whom no timecard has been received.
Compare time card totals to data entry totals. A non-data entry person will compare keypunched employee time records to time cards for data entry errors, and correct any errors found.
Review payroll register for errors. The payroll staff will compare source documents to the payroll register report, and correct any errors found.
Independent review of payroll register. The payroll manager will independently print the payroll register and review it for evidence of improper payments.
Review exception reports. The payroll manager will print and review computergenerated exception reports, addressing such areas as negative deductions, as well as unusually large base pay, overtime, or hours being paid, and investigate as necessary.
Send a manual check copy to the general ledger clerk. The payroll staff will copy each manual check created and forward it to the general ledger clerk for recording in the general ledger.
Audit employee master file. The internal audit staff will periodically determine if all employees listed in the employee master file are actual employees who are currently employed, and investigate any differences.
Payroll Self-Service Controls
When payroll self-service systems are used, all related controls are automated, and center
on data entry issues and user notifications. The controls are as follows:
Limit the pre-allowed amount of pay rate changes. The self-service system will impose restrictions on the amount of pay raises that managers can grant employees, above which supervisory approval is required.
Send change verification e-mails. The self-service system will automatically send an e-mail message to the person initiating a payroll change, verifying the change made.
. The self-service system will notify the controller by e-mail if the bank account information for any employee is changed.
Reject entry of unauthorized residency states. The self-service system will reject the entry of a state of residence for which the company is not set up to record state income or unemployment tax remittances, and notify the payroll staff.
Link termination information to self-service system. The human resources system will be linked to the payroll self-service system, so that entry of termination information by the human resources staff will automatically shut down access to the payroll self-service system.
Cash Payroll Payment Controls
When employees are paid their wages in cash, strong controls are required to ensure that the correct amount of cash is received by the intended recipient. The controls are as follows:
Complete pay envelope information in ink. The payroll clerk will write employee pay information on the pay envelope in ink to avoid subsequent modification of pay amounts.
Match payroll register to pay envelopes. A second clerk will compare the payroll register to the pay amount listed on each pay envelope, investigate any differences, and initial each correct envelope.
Complete cash requirements form in ink. The payroll clerk will complete a cash requirements form (on which specific bill and coin amounts are requested) in ink to avoid subsequent modification.
Require approval of the cash requirements form. The payroll manager will review and approve each completed cash requirements form before cash is issued.
Casher retains copy of cash requirements form. The cashier will retain a copy of the cash requirements form once cash has been issued.
Count and sign for received cash. The paymaster will count cash received from the cashier and match the amount received to the cash requirements form prior to signing for receipt of the cash.
Employee signs pay receipt. Each employee being paid will count the cash received from the paymaster and match it to the pay amount listed on the pay envelope prior to signing for receipt of the cash.
Electronic Payroll Payment Controls
The primary controls over electronic payments are the proper authorization and verification of electronic payment information. The controls are as follows:
Require electronic payments. The human resources manager will enforce the use of direct deposit or payroll card payments to all employees.
Match routing and account numbers on employee check to submitted information. The payroll clerk will verify that the routing and account numbers on the check accompanying any employee request for direct deposit payment match the corresponding numbers entered in the payroll software.
Require direct deposit verification. The payroll clerk will not process a change to an employee’s direct deposit information without the employee’s signature and formal identification.
Securely store direct deposit authorization forms. The payroll clerk will store all completed direct deposit authorization forms in a locked cabinet.
Investigate multiple payments to the same bank account. The payroll manager will periodically print a computer report itemizing all bank accounts referenced multiple times in the payroll database, and investigate any payments from multiple employees to such accounts.
Electronic Payroll Remittance Controls
When payroll remittance information is provided online, there is no risk of asset loss, but there is a risk of inappropriate access to personal information, which is mitigated by the following control:
Require user verification. Employees will create user identification and password information for access to their online payroll remittance and W-2 accounts.
Outsourced Payroll Controls
When the payroll function is outsourced, the key additional controls are to verify that the supplier is indeed remitting taxes, and that paychecks are still routed through the company paymaster. These controls are shown below:
Obtain verification of tax remittances. The payroll manager will obtain receipts for all tax remittances made by the payroll supplier and match them to required remittance information.
Route incoming paychecks through a paymaster. The payroll supplier will send all employee paychecks to a paymaster rather than directly to employees; the paymaster will verify the existence of each employee prior to issuing the paychecks.