Connect with us

Accounting Fraud

Audit Strategy for Payroll Fraud



Audit Strategy for Payroll FraudPayroll fraud by its essence is an uncomplicated scheme. However, finding the fraudulent transaction and, subsequently, proving the payroll fraud can be difficult because of the dollar magnitude and volume of transactions involved with the payroll cycle. The two typical inherent fraud schemes are associated with “ghost employees” and overtime reporting fraud. In addition, payroll calculation schemes concerning the payroll office occur, but on a less frequent basis.

This post provides detail guidelines to understand major fraud schemes in the payroll area by discussing the above two major issues:


  • GHOST EMPLOYEES: What is ghost employees, common variations of ghost employees and audit strategy that auditor can implement to catch them, red flags for ghost employees, knowing ghost employees by knowing its characteristics, ways to determine common department where ghost employees are, audit procedures for ghost employees
  • OVERTIME REPORTING FRAUD: Variations of misstated hours and its verification procedures.
  • In addition, to make this post even more comprehensive, I also discuss ”FRAUD OPPORTUNITIES IN THE PAYROLL OFFICE” which outlines various fraud schemes related to payroll and benefit calculation in deatil.



Ghost employeesare individuals listed in the payroll register, who are not providing services, but who are receiving a payroll check. The generic fraud scheme requires the ability to place an individual or retain a terminated employee on the payroll system, falsify the time and attendance reporting, and divert the payroll payment. The conversion cycle occurs through the diversion of the payroll payment or collusion with an employee receiving the paycheck.


Variations of Ghost Employees

There are eight typical variations of the inherent ghost employee fraud scheme.

1. Fictitious employee – The employee is placed on the payroll system, allowing the supervisor to falsify time reporting, and then, a payroll check is diverted or the payment is directly deposited into a false bank account. Data mining for fictitious employees would focus on these data elements:

  • High withholding exemptions or no withholding for income taxes
  • No voluntary deductions for health insurance, retirement, or other normal deductions for the employee population
  • No vacation, sick, or personal time charges
  • No salary adjustments, merit adjustments, or promotions
  • Duplicate bank account numbers
  • Matching to other logical databases, e.g., security access, computer security access file or company telephone records

Audit Strategy for Fictious Employee

  • For each person, meet the individual and inspect government-issued identification.
  • Search for evidence of work performance. This may be as simple as inspecting employee’s work area.


2. Terminated ghost employee scheme. The employee exists at the time of hiring, but terminates employment without notifying human resources. The supervisor falsifies the time report, indicating that the employee is working, and diverts the employee’s payment. The terminated employee may remain on the payroll system indefinitely, especially if they do not question year – end payroll statements. However, the supervisor may remove the employee after diverting a few payroll checks, if the employee receives and questions the year – end payroll statement. Data mining for terminated ghost employees would focus on these data elements:

  • Change to direct deposit bank account information
  • Endorsements on payroll checks
  • Terminated status

 Audit Strategy Terminated Ghost Employee

  • Compare endorsement on the check for the last payroll period to the first payroll period.
  • Compare handwriting on the final time report to the first time report


3. Pre-employment ghost employee scheme. This scheme occurs when a supervisor places the employee on the payroll system one pay period before the actual commencement of services. The scheme occurs with employees who are not likely to question a payroll reporting statement. The data mining would focus on: new employees and date of first payment.

Audit Strategy Pre-employment Ghost Employee

  • Compare first payment week to other relevant databases to establish a work performance date.
  • Interview employees to determine their recollection of their first day or week of work.


4. No-show ghost employee scheme. This scheme occurs when an employee, who is a real person, provides no actual services. The no-show ghost employee is typically in collusion with a supervisor. Since the individual is a real person, data – mining steps are limited. Treating the no – show ghost employee in the same manner as a fictitious employee may provide positive results.

Audit Strategy for No-Show Ghost Employee

  • Search for evidence of work performance.
  • Interview coworkers.
  • Examine access security databases for evidence of work performance.


5. Temporary employees bypass critical hiring controls. These employees exist, but because of the temporary nature of their employment, hiring controls may be bypassed. Control over temporary employees is usually vested with the local manager making such bypassing uncomplicated. Data mining for temporary employees focuses on those coded in the system as temporary or as employees with short durations of employment.

Audit Strategy foro Temporary Employee Bypass Critical Hiring Control

  • Confirm the existence of the employee through a telephone interview.
  • Search for evidence of work performance.
  • Interview coworkers.


6. Temporary employees working through agencies. These individuals bypass the hiring process because they are not employees of the organization. The temporary agency is in collusion with human resources or the requesting manager. The requesting manager approves the invoice indicating the individuals were present and worked the days noted on the vendor invoice. In essence, the agency bills the company for individuals who did not provide services. The agency provides a kickback to the company employee who approves the charge. Data mining for temporary employees focuses on identifying departments incurring temporary agency expense via general ledger review.

Audit Strategy for Temporary Employees Working Through Agency

  • Examine temporary agency payroll records to ensure that the individual was compensated and that time records support the work location.
  • Search for evidence of work performance.

7. Family member ghost employees. In closely held corporations, owners may place family members on the payroll to minimize taxes or divert funds for other personal reasons. Data mining for family member ghost employees focuses on employees with common names, addresses, telephone numbers, or bank account information.

Audit Strategy for Family Member Ghost Employee: Search for evidence of work performance.”


8. Unclaimed payroll check scheme. This scheme involves the theft of an unclaimed payroll check. It may occur with a recently terminated employee or by diverting a stale payroll check once it becomes obvious that no employee will collect it. Data mining considerations involve reviewing bank reconciliations for outstanding payroll checks that subsequently clear.

Audit Strategy for Unclaime Payroll Check

  1. Examine checks for false endorsements.
  2. Compare bank clearing stamps on early checks to last check to see if the bank used to negotiate check has changed.


Finding Ghost Employees

Due to the large number of employees, the geographic spread of companies, and multiple work shifts, auditors need to develop a data – mining strategy to search for ghost employees. Ghost employees tend to occur in departments where they would not be evident, and the local manager has a high degree of control over the hiring process. These characteristics are useful in the search for the ghost employee.


Department Characteristics that Facilitate Ghost Employees

In cases where the nature of a department facilitates the concealing of ghost employees, the following departmental characteristics should be considered:

  • Decentralized, remote departments that have low visibility employees
  • Departments that experience regular turnover
  • Department or locations that are managed by an individual with a high degree of authority
  • Departments where employees are more likely to collude to conceal a ghost employee
  • Entry – level positions
  • Departments with employees who work remotely
  • Departments where payroll budget and actual payroll expenditures would normally differ
  • Large departments where a ghost employee would not be evident


Questionnaires to Identify Department Where Ghost Employee Are
As a reminder, there are no absolutes. However, these questions are useful in identifying departments where ghost employees are more likely to be used in a payroll fraud scheme:

  • Who has the ability to place an individual on the payroll?
  • Are any employees hired directly by a hiring supervisor?
  • Does a hiring supervisor verify the existence or identity of new employees?
  • Do any employees bypass an interview with human resources?
  • Does any department submit employee forms or start requests directly to human resources?
  • Do any employees terminate without an exit conference with human resources?
  • Can one individual place an employee on the payroll system without a second review or reconciliation?
  • Does the manager approving the payroll change have the necessary knowledge to identify a fictitious employee?
  • Do employees know to notify human resources regarding termination benefits and rights?


The Red Flags of Ghost Employees

  • Use of a common name, e.g., Smith
  • No physical address
  • No personal or vacation leave
  • No deductions for voluntary deductions (i.e., health insurance, pension, etc.)
  • High withholding allowance to minimize income tax withholding
  • Missing employee information
  • Invalid social security numbers
  • IRS notice regarding invalid social security numbers
  • No evidence of work performance
  • Changes to direct deposit bank account numbers
  • Payroll checks that are cashed in company accounts
  • Duplicate bank accounts for direct deposits


Ghost Employee Characteristics

The nature of an employee’s work status facilitates the concealing of ghost employees. Consider the following employee types:

  • Employees who work remotely, so, no one in the company sees them
  • Foreign nationals, where the supervisor simply states that, to the best of their knowledge, the employee has returned to the country of origin
  • Employees who would bypass normal hiring or termination controls, because the supervisor maintains a high degree of control over employees
  • Transient employees, because they typically work for a limited period of time and then move to a different geographic area


Another way to identify ghost employees is to identify opportunities that allow for the diversion of the payroll payment. The characteristics associated with payroll check diversion are:

  • Payroll checks are delivered to the supervisor.
  • Direct deposits are established for employees that bypass normal hiring practices.
  • Direct deposit changes are allowed without independent verification.
  • Poor controls exist regarding unclaimed payroll checks.


Audit Procedures for Ghost Employees

The six audit procedures for ghost employees are:

  • Examine employee’s government identification documents.
  • Compare their employee’s government identification to known true government identification for signs of alteration or creation.
  • Obtain employee files to identify documents and handwriting.
  • Interview employees regarding their department or job duties.
  • Examine documents for evidence of job performance.
  • Examine other logical databases for performance: (a) Computer sign – on/off; (b) Telephone records; (c) Security systems



Overtime reporting fraud occurs, when employees falsify the hours worked, or due to a breakdown in the time card approval process. The conversion occurs through the employee’s payroll check or a kickback to a second person operating in collusion with the employee. Overstated hours fraud can also occur when part – time employees are paid for more hours worked, but not exceeding the typical full – time standard of 40 hours.

The variations for the misstated hours occur in these ways:

  • Employees misstate hours piecemeal, and supervisors approve the hours unknowingly.
  • Employees operate in collusion to misstate each other’s hours, and supervisors approve the hours unknowingly.
  • An employee misstates hours in collusion with the supervisor. The supervisor falsely approves the hours and receives a kickback from the employee. The supervisor could also be motivated to provide disguised compensation to the employee for any number of reasons.
  • Employees forge the approval of their supervisor on their time cards.
  • Employees alter their time cards after the supervisor properly approves the cards. The control breakdown occurs by the employees obtaining access to properly approved time cards.
  • A payroll employee overstates their hours on a properly approved time card.


The opportunity for time card fraud is enhanced when:

  • Supervisors do not have firsthand knowledge of an employee’s workday.
  • Supervisors believe that overtime is a method to provide additional compensation to key employees.
  • Properly approved time cards are returned to an employee.
  • Employees complete manual time cards.
  • There are staggered stop and start time employees on a work shift.
  • Employees work in the field without reporting to a central office.


Examination Approach To Detect Overtime Reporting Fraud

Typically, the examination of time cards does not detect overtime fraud, because the hours are reported and the cards are approved. However, auditors should be on the lookout for alterations and false approvals. To detect time card fraud, auditors need to identify a database that records work times. Then, the auditors can compare the hours on the time card to the hours on the independent database. Auditors should access security logs, computer sign – on and off logs, and telephone records; and parking lot registers are all useful for matching purposes. If no database is available, detecting time card fraud through standard audit procedures can be difficult.

Other verification procedures are:

  • Interview employees in the department who did not receive overtime regarding department work schedules.
  • Set up surveillance of suspected departments.
  • Perform surprise inspection of work areas and examine the reported hours on that day.



The payroll office has the greatest fraud opportunity. A properly completed and approved time card can be altered by the payroll clerk and processed for higher hours. The clerk can simply discard the time card stating 40 hours and pay a friend for 60 hours instead. In addition, salary change forms could be processed at a higher rate than approved.


Payroll Calculation Fraud Schemes

Employee’s compensation can be falsely calculated by using false grades, pay scales, or annual salary amounts. Once the false information is entered into the computer, the calculation becomes automatic. Within the payroll system, several database fields or subsystems allow for increasing weekly pay or other forms of compensation.

A description of those fraud opportunities follows:

  • Salary adjustment field – In the payroll database, a field exists for providing an employee a manually calculated lump-sum adjustment. Retroactive merit adjustments are common examples. In addition, the field can be used to provide fraudulent adjustments to an employee. For example, a payroll clerk can provide themselves, or an employee, a false adjustment. Data-mining procedures should be used to search for employees receiving more than one adjustment. In one case, a manager provided an employee with 52 weekly salary adjustments for local travel. Upon further investigation, it was found that the manager was bypassing the compensation system controls by increasing the employee ’ s gross compensation beyond the salary level for the particular job grade.
  • Othersalary adjustment field – Databases often include a category or field called “other”. Other database fields exist to provide employee’s payments for various reimbursements: (1) Employee incentive bonus; (2) Other reimbursements; (3) Local travel reimbursements; and (4) Allowance programs. Auditors should verify salary adjustments against the original source documents, independently verify the reason for the adjustment, and recalculate the salary amount.
  • Manual payroll checks – There are a variety of reasons to provide an employee with a manual payroll check. A termination paycheck is one example. In one case, a controller issued himself 52 automated checks and 8 manual payroll checks. The manual checks were recorded to a non-payroll general ledger account through a journal entry.
  • Other compensation fields – Various data fields influence retirement, health benefits, and personal leave calculations. The altering of any of these fields would provide an employee with other compensation benefits.


Fringe Benefit – Related Schemes

Health insurance has become a valuable benefit for employees. Yet, very few companies reconcile the total number of employees receiving health insurance to the active payroll or to COBRA benefits to terminated employees. Since family health coverage exceeds $ 10,000 per year, the benefit is a prime target for fraud.

The scheme is simple and operates in the following ways:

  • The health insurance administrator provides a nonemployee with health insurance coverage.
  • An employee claims a nondependent on the coverage or an employee falsely claims that a live – in companion is a spouse.
  • The COBRA benefit period is falsely extended for terminated employees.


Other fringe benefit–related schemes are associated with false reimbursement for benefits or allowances. The fraud occurs by the employee submitting false documents or the payroll employee falsely providing the employee with the payment.


Misuse-of-Employees Schemes

In misuse-of-employees schemes, the employee performs no job-related duties. Examples of the misuse of employees include using employees in political campaigns, for personal errands, or for other activities. Since there is no record of the misuse, typically, the frauds are revealed by whistleblowers.


Sales Commissions and Bonus Schemes

Sales representatives, who are paid on sales performance, have the opportunity to manipulate sales activities to increase their compensation in a number of ways. They can:

  • Book fictitious year-end sales – Reasons for booking these sales might be to achieve sales quotas and obtain bonuses or to attend key sales meetings. Auditors should scrutinize returns and adjustments in the next period.
  • Change quotas to allow a sales representative to receive a bonus – Typically, this scheme is performed by the sales manager. The manager receives a kickback from the sales representative out of the false bonus. Auditors should compare end – of – the – year quotas to beginning-of-the-year quotas to identify potential fraudulent changes. Auditors should ensure that any changes were approved and that the reason for the change was valid and authorized by a manager above the approving manager level.
  • Providing customers with false benefits – In this scheme, the sales representative receives a kickback from the customers.
  • Providing customers with false credits on unsold goods – The sales representative receives a kickback from the customer or the customer purchases additional items allowing the sales representative to earn commissions.
  • Selling sales promotional items – The sales representative simply keeps the money from the sale.
    Innovative Fraud – Sales representative’s compensation is based on sales performance and maximizing the interpretation of the commission program. Sales representatives have come up with clever techniques to increase their compensation. In one such scheme, a sales representative sold an item to a customer and, then provided the customer with the money to pay for the item. The sale allowed the representative to earn a bonus.


In another scheme, a publishing company was experiencing a drop in subscription sales. The company implemented a new commission program to compensate salespeople for getting customers to renew their subscription. However, one salesperson convinced customers to let their subscription lapse for one period. The salesperson would rewrite a sales order for the subscription. The customer would receive a one – year discount on the subscription, and the sales representative would receive a commission.


Diversion of Payroll Tax Deposits

In small businesses, a common fraud is the theft of payroll tax deposits. The payroll clerk diverts the check for their own benefit. The concealment occurs because of the overreliance by the owner on the payroll clerk and, so, the payroll clerk handles all government notices. The accountant may also miss the scheme because net payroll and the alleged tax payments reconcile to the gross payroll. The fraud is detected when the government becomes aggressive in the collection of the delinquent tax payments. Auditors should ensure that the canceled check for the taxes was deposited in the proper tax account.

Are you looking for easy accounting tutorial? Established since 2007, hosts more than 1300 articles (still growing), and has helped millions accounting student, teacher, junior accountants and small business owners, worldwide.