No Credit Card Required
A payroll audit is that look. Once a quarter or once a year, someone independent of the payroll team tests the whole population, not this week’s changes. This free payroll audit checklist is for controllers, internal auditors and finance directors, whether payroll runs in-house or through a bureau or PEO. It covers master-file integrity, pay rates and hours, minimum wage, deductions, tax filings, the payroll-to-GL reconciliation and system access. Every test has an owner and an evidence field, exceptions switch on an investigation phase, and the audit ends with rated findings and a named sign-off.
A pay-run procedure checks the inputs for one period before money leaves the bank: this month’s starters, leavers, timesheets and changes. Our Payroll Processing SOP Checklist covers that job. Its blind spot: it only sees what changed this period, and it is run by the people whose work is being checked.
An audit looks across three or twelve months at once, so it sees patterns a single run never shows: two employees paid into one bank account, overtime doubling in one department, a rate change in the system log with no approval, tax withheld that does not match what was remitted. It is also done by someone who does not process payroll. The person who can add an employee should not be the person who confirms every employee is real.
Question: are this period’s inputs complete, approved and calculated correctly?
Cadence: weekly, fortnightly or monthly, before each payday.
Scope: changes in the period and a variance check against last period.
Output: an approved pay run, filings made and payments released.
Question: is everyone paid real and paid correctly, and do filings and ledger agree?
Cadence: quarterly, plus a fuller year-end audit.
Scope: the whole population, the system change log, access rights and reconciliations.
Output: rated findings, management responses and a signed audit report.
Five phases run on every audit. Two more switch on only when they are needed: an investigation phase when the master-file review finds exceptions, and a year-end phase for the annual audit.
Owned by the auditor: internal audit, a controller or a finance lead who does not process pay runs.
Conditional: its tasks appear only when Phase 2 records exceptions. HR approves the corrections.
Conditional: its tasks appear only when Phase 1 marks this as the year-end audit.
Approved by the controller or finance director by name, not by the payroll manager whose area was audited.
The audit steps are the same on both sides of the Atlantic; the rules you test against are not. The table lists the federal and national rules checked most often, as at September 2026. US states and cities add their own wage, sick leave and filing rules. Treat it as a starting point, not tax or legal advice.
| Area | United States (federal) | United Kingdom |
|---|---|---|
| Periodic tax reporting | Deposits by electronic transfer, monthly or semi-weekly per the lookback period. Form 941 due the last day of the month after each quarter. | FPS on or before each payday. EPS by the 19th of the following tax month. PAYE paid electronically by the 22nd. |
| Year-end forms | W-2 to employees and W-2/W-3 to the SSA by 31 January, or the next business day (2026 forms are due 1 February 2027). Form 940 for FUTA. | Final FPS for the tax year ending 5 April. P60s by 31 May. P11D and P11D(b) by 6 July. |
| Minimum wage | $7.25 an hour federally since July 2009. Many states and cities set higher rates; the employer must meet both. | From 1 April 2026: £12.71 (21 and over), £10.85 (18–20), £8.00 (under 18 and apprentices). Averaged over each pay reference period, after deductions. |
| Overtime | FLSA: non-exempt employees get at least time and a half for hours over 40 in a workweek. | No statutory premium. Overtime premiums do not count as minimum wage pay, so extra hours can pull the average below the minimum. |
| Sick pay | No federal paid sick leave requirement; many states and cities have one. | Since 6 April 2026, SSP is paid from the first day of sickness with no lower earnings limit: £123.25 a week or 80% of average weekly earnings, if lower. |
| Record retention | FLSA: payroll records 3 years, time cards and wage-rate tables 2 years. IRS: employment tax records at least 4 years after the fourth-quarter return is filed. | PAYE records 3 years from the end of the tax year. Minimum wage records 6 years (for records created on or after 1 April 2021). |
| Worker classification | IRS common-law rules for tax; the FLSA economic-reality test for wages (a revised DOL rule was proposed in February 2026, not yet final). Some states are stricter. | Off-payroll working rules (IR35): public sector and medium or large clients decide the status of contractors working through their own company. |
| Retirement and pensions | 401(k) deferrals must reach the plan as soon as they can reasonably be segregated, and no later than the 15th business day of the following month. | Auto-enrolment earnings trigger £10,000 for 2026/27. Re-enrol every three years and re-declare compliance within five months of the third anniversary of the duties start date. |
| Other jurisdictions | Elsewhere, the checklist structure carries over: check the local equivalent of every row above. | |
Two changes belong in this year’s year-end phase. The 2026 Form W-2 adds Box 12 codes for total tips and qualified overtime compensation, so check the payroll system captures them. In the UK, payrolling company cars, vans, fuel and medical benefits becomes mandatory from 6 April 2027, with most other benefits following in April 2028, so the audit moves from P11Ds to benefit values reported on the FPS.
A recurring schedule opens the audit after each quarter closes and assigns Phase 1 to the auditor. A skipped quarter shows up as an overdue checklist, not a gap the external auditor finds.
Conditional logic keeps the quarterly audit short. Investigation tasks appear only when the master-file review records exceptions, and year-end tasks only when the audit is marked year-end.
Register extracts, reconciliations, access listings and exception lists are attached to the test they support. HR’s approval of corrections and the finance director’s sign-off are recorded against named people with timestamps, and the finished audit exports as a single trail.
CheckFlow is not a payroll system and does not calculate pay, withhold tax or file returns. It runs the checks, evidence and approvals around the payroll system you already use. CheckFlow’s compliance checklist software shows how recurring reviews like this one sit in your compliance calendar, and our HR checklist software covers the starter and leaver processes that keep the master file clean in the first place.
Pair this audit with the Payroll Processing SOP Checklist for each pay run, and the Month-End Close Checklist, where the payroll journal is posted and reconciled. When the external auditors arrive, the External Audit Preparation Checklist puts your signed payroll audits on the PBC list.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
A payroll audit is a periodic, documented test of whether payroll is accurate, authorised and compliant. It checks that everyone paid is a real, current employee, that rates and changes were approved, that hours and deductions were right, that tax was filed and paid, and that payroll agrees to the ledger and the bank. Unlike pay-run checks, it covers a whole period and is done by someone independent of processing.
Set the scope and extract the data, checking it agrees to the ledger. Test the master file against HR records: leavers, starters, duplicate bank details and bank detail changes. Test a sample of rates, hours and deductions against approvals, and check minimum wage. Reconcile tax to filings and payments, and the register to the ledger and bank. Review system access. Then rate the findings, agree actions and get the report signed off.
No US or UK rule sets a frequency for an internal payroll audit, so it is a risk-based decision. Many organisations run a focused audit each quarter and a fuller one at year-end, when W-2s or P60s are reconciled. Audit more often after a system change, a new bureau, a merger or a fraud incident.
Match every person paid to a current HR record. Then look for the signs: pay after a termination date, two employees sharing a bank account, address or tax ID, no benefit elections, and names their stated manager does not recognise. Check every bank detail change was independently confirmed. Escalate suspected fraud before approaching the employee.
Someone independent of processing: internal audit, a financial controller or an outside accountant. The payroll team supplies data but should not test its own work. HR approves master-file corrections, and the finance director or controller signs off the report.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
