Auditing a client's payroll costs

How an audit team tests payroll: ghost employees and wrong rates, monthly analytics, sample tests to contracts, approval controls and statutory returns.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

For many of the clients a small firm audits, salaries and wages are the largest expense in the income statement. Payroll is also a favourite place for fraud: an employee who left in March and is still being paid in November, a relative on the books who never comes to work, a bank account quietly changed the week before the run. None of these shows up as an odd balance on the trial balance. They show up only when someone tests who is paid, how much and into which account.

This article sets out a practical approach to auditing payroll costs: where the risks are, which analytics are worth doing, what to test on a sample, which controls matter most and how to agree payroll to the ledger and the statutory returns.

Where payroll goes wrong

The main risks, by assertion:

• Occurrence: payments to people who do not exist or no longer work for the client, often called ghost employees.
• Accuracy: wrong rates, unauthorised increases, overtime or allowances paid without approval.
• Classification: labour capitalised to assets or projects without basis, or directors' remuneration mixed into wages.
• Completeness of liabilities: unpaid leave, bonuses and statutory deductions not accrued at year end.
• Compliance: deductions withheld but not paid over to the tax authority or funds, which creates liabilities and possible penalties.

Ask early who can add an employee, change a rate, change bank details and approve a run. On many small clients, the honest answer is "the same person", and that answer shapes the whole approach.

Analytics on headcount and cost by month

Payroll suits analytical work because it is driven by a small number of factors: how many people, at what rates, for how many periods. Build an expectation and compare:

• total cost by month, which should move with headcount and known increases;
• average cost per head by department, which should be stable except where increases or bonuses explain a change;
• starters and leavers by month against the change in headcount;
• overtime as a share of basic pay, by department.

Where the client runs payroll on Achekam, payroll reports show cost, headcount and staff movements by month and by department, which gives the team the raw material for this analysis directly. Investigate the month that does not fit, not just the year-end total.

Testing a sample of employees to contracts

Analytics tell you where to look; detailed testing tells you whether individual payments were valid. For a sample of employees across the year:

1. Agree the employee to an employment contract or appointment letter and to identity documents.
2. Agree the rate paid to the contract and any approved increase.
3. Recompute gross pay, including overtime and allowances, from approved inputs.
4. Check that deductions follow the employee's tax and fund details.
5. Confirm the bank account is in the employee's own name.
6. For leavers in the sample, check that payments stopped after the last working day.

Select the sample from a complete population: the full list of payments, agreed to the payroll total. In Achekam's Audit Intelligence, the team loads the population, Achekam risk-scores it and proposes a sample, a reviewer who did not prepare the plan approves it before it is drawn, and every draw can be reproduced from its stored seed. No size is proposed without approved materiality and a confidence level.

Controls over approval and bank detail changes

The two controls that matter most in payroll are approval of each run and verification of bank detail changes. If the team intends to rely on them, it must test that they operated throughout the period.

Where the client's payroll is on Achekam, both are enforced by the system. A pay run is approved by someone other than the person who prepared it, nobody can approve a run that pays themselves, and an approved run is never recalculated. An employee's bank account entered or changed by one person must be verified by another before it is paid in the payment schedule or bank file. As a result, a business needs at least two people in payroll roles to run payroll at all.

System enforcement does not end the auditor's work. The value of a segregation control depends on who holds the roles. Inspect the list of users with payroll roles, ask whether any of them share log-in details, and look at who verified the bank changes made during the year. Read changes made shortly before a run, or reversed shortly after, with particular care. Where the firm itself runs the client's payroll, the same control sits with the firm; see bank detail changes at a payroll bureau.

Agreeing payroll to the ledger and statutory returns

Finally, tie the payroll system to the accounting records and to what was declared:

• agree the payroll register totals for the year to the wages accounts in the general ledger, and explain differences;
• agree deductions withheld to the amounts declared and paid over each month;
• review year-end accruals for leave, bonuses and unpaid deductions.

The returns differ by country. In South Africa, where payroll runs on Achekam, it prepares the monthly EMP201 figures and PDF and the IRP5 and IT3(a) certificates from approved runs, and a person files them on SARS eFiling and records the reference. For a Nigerian employer, payroll computes PAYE by the employee's State of residence, pension, NHF, NSITF and the ITF levy, and prepares schedules for a person to file and pay. For a Kenyan employer, it computes PAYE, the Affordable Housing Levy, NSSF, SHIF and the NITA levy and prepares the P10 and other schedules for a person to file. In every case, Achekam prepares and a person files, so the audit evidence of filing and payment is the authority's own acknowledgement and the bank payment, not the prepared schedule.

Recording the work

On each payroll work item, a step is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. Note in the response which employees were tested, what each was agreed to, and any exceptions. The ACCA's article on the audit of wages explains how auditors test wages and salaries, from controls testing at the interim audit to substantive and analytical procedures. For the disclosure side, see the staff costs note from payroll.

One question to ask this week

On your next payroll client, ask for the list of bank detail changes made during the year and who verified each. If nobody can produce it, you have found the first finding for the management letter.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.