The audit happens every quarter, not when someone remembers
A recurring schedule opens the audit after each quarter closes and assigns Phase 1 to the auditor. A skipped quarter shows up as an overdue checklist, not a gap the external auditor finds.
Payroll Audit Checklist Template
Payroll errors and payroll fraud rarely sit in a single pay run. They sit in the master file: a leaver who was never removed, a bank account changed on the strength of one email, a pay rise nobody approved. Each one repeats every payday until someone goes looking.
A payroll audit is that look. Once a quarter or once a year, someone independent of the payroll team tests the whole population, not this week’s changes. This free payroll audit checklist is for controllers, internal auditors and finance directors, whether payroll runs in-house or through a bureau or PEO. It covers master-file integrity, pay rates and hours, minimum wage, deductions, tax filings, the payroll-to-GL reconciliation and system access. Every test has an owner and an evidence field, exceptions switch on an investigation phase, and the audit ends with rated findings and a named sign-off.
Running Payroll vs Auditing Payroll: Two Different Controls
A pay-run procedure checks the inputs for one period before money leaves the bank: this month’s starters, leavers, timesheets and changes. Our Payroll Processing SOP Checklist covers that job. Its blind spot: it only sees what changed this period, and it is run by the people whose work is being checked.
An audit looks across three or twelve months at once, so it sees patterns a single run never shows: two employees paid into one bank account, overtime doubling in one department, a rate change in the system log with no approval, tax withheld that does not match what was remitted. It is also done by someone who does not process payroll. The person who can add an employee should not be the person who confirms every employee is real.
Pay-run SOP
Run by the payroll team every pay period
Question: are this period’s inputs complete, approved and calculated correctly?
Cadence: weekly, fortnightly or monthly, before each payday.
Scope: changes in the period and a variance check against last period.
Output: an approved pay run, filings made and payments released.
Payroll audit
Performed by someone independent of payroll
Question: is everyone paid real and paid correctly, and do filings and ledger agree?
Cadence: quarterly, plus a fuller year-end audit.
Scope: the whole population, the system change log, access rights and reconciliations.
Output: rated findings, management responses and a signed audit report.
What the Payroll Audit Checklist Covers
Five phases run on every audit. Two more switch on only when they are needed: an investigation phase when the master-file review finds exceptions, and a year-end phase for the annual audit.
Phase 1
Phase 1: Scope the Audit & Extract the Data
Owned by the auditor: internal audit, a controller or a finance lead who does not process pay runs.
- Define the audit period and scope — quarter or year, entities, pay groups and any bureau or PEO
- Confirm the auditor is independent of payroll processing — read-only access and no role in pay runs
- Carry forward open actions from the last payroll audit — re-test anything reported as fixed
- Extract the payroll data for the period — master file, registers, change log, bank files and filings
- Check the extract is complete — register totals agree to the ledger and bank before testing starts
Phase 2
Phase 2: Employee Master-File Integrity
- Match every paid employee to an HR record — with a start date, role, manager and cost centre
- Test leavers — no pay after the termination date except final pay, and final pay calculated correctly
- Test starters — signed contract or offer, tax setup and authorisation on file before the first payment
- Search for duplicate bank accounts, addresses and tax IDs — shared details need an explanation
- Verify bank detail changes made in the period — each confirmed by call-back to a number on file, not by email
- Record the master-file review result — log every exception and say whether any were found
Phase 3
Phase 3: Investigate Master-File Exceptions
Conditional: its tasks appear only when Phase 2 records exceptions. HR approves the corrections.
- Investigate each exception with HR and the line manager — confirm whether the person, account or change is genuine
- Stop payments that should not be made — and agree how any overpayment will be recovered
- Escalate suspected fraud before contacting the employee — to the finance director and, where policy requires, legal
- Correct the master file — changes made by HR or payroll, never the auditor, with before-and-after evidence
- HR sign-off of master-file corrections — the HR lead approves or returns the corrections
Phase 4
Phase 4: Pay Rates, Hours & Deductions
- Test a sample of pay rates to approved documents — contract or signed change form, applied from the right date
- Trace every rate change in the system log to an approval — start from the log, not from the forms HR sent
- Test hours and overtime — paid hours agree to approved timesheets; overtime at the correct rate
- Test minimum wage compliance — the right federal, state or local rate in the US; the right NLW/NMW age band in the UK, after deductions
- Test deductions against elections and orders — benefits, garnishments or attachment of earnings orders, salary sacrifice
- Check retirement and pension contributions — correct amounts, paid on time, UK auto-enrolment assessments made
- Test one-off payments — bonuses, commissions and payroll expense reimbursements approved and taxed correctly
Phase 5
Phase 5: Tax, Ledger & System Access
- Reconcile tax withheld to filings — register totals agree to Forms 941 (US) or the FPS and EPS submissions (UK)
- Reconcile filings to payments — paid in full and on time; log any penalty notices
- Reconcile the payroll register to the general ledger — explain every reconciling item
- Agree net pay to the bank payment file — totals match and every payee in the file appears in the register
- Review payroll system access — who can change employees, rates or bank details; remove excess rights
- Test segregation of duties — nobody can both change master data and release a pay run
Phase 6 — Year-End Only
Phase 6: Year-End Reconciliation
Conditional: its tasks appear only when Phase 1 marks this as the year-end audit.
- Reconcile annual totals to year-end forms — W-2/W-3 totals agree to the four Forms 941 (US); P60s agree to the final FPS (UK)
- Confirm year-end forms were issued on time — W-2s, W-3 and Form 940 (US); P60s by 31 May (UK)
- Reconcile benefits in kind — P11D and P11D(b) by 6 July or payrolled benefits (UK); taxable fringe benefits in W-2 wages (US)
- Check for new reporting requirements — form and code changes for the coming year, and any payrolling deadlines
- Confirm the year’s records are archived for the required retention period — registers, filings, timesheets, approvals
Phase 7
Phase 7: Findings, Remediation & Sign-Off
Approved by the controller or finance director by name, not by the payroll manager whose area was audited.
- Rate each finding — high, medium or low, with the root cause
- Agree a management response for each finding — an owner, an action and a due date
- Draft the payroll audit report — scope, tests, sample sizes, exceptions and an overall conclusion
- Finance director or controller sign-off of the audit report — approve, or return with questions
- Schedule follow-up testing — re-test high-rated findings next quarter
US vs UK Payroll Audit Reference
The audit steps are the same on both sides of the Atlantic; the rules you test against are not. The table lists the federal and national rules checked most often, as at September 2026. US states and cities add their own wage, sick leave and filing rules. Treat it as a starting point, not tax or legal advice.
| Area | United States (federal) | United Kingdom |
|---|---|---|
| Periodic tax reporting | Deposits by electronic transfer, monthly or semi-weekly per the lookback period. Form 941 due the last day of the month after each quarter. | FPS on or before each payday. EPS by the 19th of the following tax month. PAYE paid electronically by the 22nd. |
| Year-end forms | W-2 to employees and W-2/W-3 to the SSA by 31 January, or the next business day (2026 forms are due 1 February 2027). Form 940 for FUTA. | Final FPS for the tax year ending 5 April. P60s by 31 May. P11D and P11D(b) by 6 July. |
| Minimum wage | $7.25 an hour federally since July 2009. Many states and cities set higher rates; the employer must meet both. | From 1 April 2026: £12.71 (21 and over), £10.85 (18–20), £8.00 (under 18 and apprentices). Averaged over each pay reference period, after deductions. |
| Overtime | FLSA: non-exempt employees get at least time and a half for hours over 40 in a workweek. | No statutory premium. Overtime premiums do not count as minimum wage pay, so extra hours can pull the average below the minimum. |
| Sick pay | No federal paid sick leave requirement; many states and cities have one. | Since 6 April 2026, SSP is paid from the first day of sickness with no lower earnings limit: £123.25 a week or 80% of average weekly earnings, if lower. |
| Record retention | FLSA: payroll records 3 years, time cards and wage-rate tables 2 years. IRS: employment tax records at least 4 years after the fourth-quarter return is filed. | PAYE records 3 years from the end of the tax year. Minimum wage records 6 years (for records created on or after 1 April 2021). |
| Worker classification | IRS common-law rules for tax; the FLSA economic-reality test for wages (a revised DOL rule was proposed in February 2026, not yet final). Some states are stricter. | Off-payroll working rules (IR35): public sector and medium or large clients decide the status of contractors working through their own company. |
| Retirement and pensions | 401(k) deferrals must reach the plan as soon as they can reasonably be segregated, and no later than the 15th business day of the following month. | Auto-enrolment earnings trigger £10,000 for 2026/27. Re-enrol every three years and re-declare compliance within five months of the third anniversary of the duties start date. |
| Other jurisdictions | Elsewhere, the checklist structure carries over: check the local equivalent of every row above. | |
Two changes belong in this year’s year-end phase. The 2026 Form W-2 adds Box 12 codes for total tips and qualified overtime compensation, so check the payroll system captures them. In the UK, payrolling company cars, vans, fuel and medical benefits becomes mandatory from 6 April 2027, with most other benefits following in April 2028, so the audit moves from P11Ds to benefit values reported on the FPS.
Why Run Your Payroll Audit in CheckFlow?
Only the relevant phases appear
Conditional logic keeps the quarterly audit short. Investigation tasks appear only when the master-file review records exceptions, and year-end tasks only when the audit is marked year-end.
Evidence and sign-off in one record
Register extracts, reconciliations, access listings and exception lists are attached to the test they support. HR’s approval of corrections and the finance director’s sign-off are recorded against named people with timestamps, and the finished audit exports as a single trail.
CheckFlow is not a payroll system and does not calculate pay, withhold tax or file returns. It runs the checks, evidence and approvals around the payroll system you already use. CheckFlow’s compliance checklist software shows how recurring reviews like this one sit in your compliance calendar, and our HR checklist software covers the starter and leaver processes that keep the master file clean in the first place.
Pair this audit with the Payroll Processing SOP Checklist for each pay run, and the Month-End Close Checklist, where the payroll journal is posted and reconciled. When the external auditors arrive, the External Audit Preparation Checklist puts your signed payroll audits on the PBC list.
Frequently Asked Questions
What is a payroll audit?
A payroll audit is a periodic, documented test of whether payroll is accurate, authorised and compliant. It checks that everyone paid is a real, current employee, that rates and changes were approved, that hours and deductions were right, that tax was filed and paid, and that payroll agrees to the ledger and the bank. Unlike pay-run checks, it covers a whole period and is done by someone independent of processing.
How do you audit payroll step by step?
Set the scope and extract the data, checking it agrees to the ledger. Test the master file against HR records: leavers, starters, duplicate bank details and bank detail changes. Test a sample of rates, hours and deductions against approvals, and check minimum wage. Reconcile tax to filings and payments, and the register to the ledger and bank. Review system access. Then rate the findings, agree actions and get the report signed off.
How often should payroll be audited?
No US or UK rule sets a frequency for an internal payroll audit, so it is a risk-based decision. Many organisations run a focused audit each quarter and a fuller one at year-end, when W-2s or P60s are reconciled. Audit more often after a system change, a new bureau, a merger or a fraud incident.
How do you find ghost employees in payroll?
Match every person paid to a current HR record. Then look for the signs: pay after a termination date, two employees sharing a bank account, address or tax ID, no benefit elections, and names their stated manager does not recognise. Check every bank detail change was independently confirmed. Escalate suspected fraud before approaching the employee.
Who should perform an internal payroll audit?
Someone independent of processing: internal audit, a financial controller or an outside accountant. The payroll team supplies data but should not test its own work. HR approves master-file corrections, and the finance director or controller signs off the report.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.