Investigating payroll fraud schemes
The payroll fraud schemes a forensic accountant should look for, where each one shows up in the records and how to trace pay from contract to bank.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Payroll is often a client's largest regular payment run, made every month or every week to many people, and checked by very few. That combination makes it attractive to anyone looking to take money quietly. A payroll scheme can run for years, because each individual payment looks ordinary.
When a client suspects that something is wrong with its wages, the forensic accountant's job is to know the usual schemes, where each leaves traces, and how to follow the money from the employment contract to the bank account it actually reached.
Where payroll fraud sits
ACCA's article on forensic accounting describes fraudulent disbursements, a form of asset misappropriation, as using company funds to make fraudulent payments. One of its common examples is a payroll scheme paying fictitious, or "ghost", employees. ACCA states that asset misappropriation frauds are by far the most common category.
ACCA's article on the audit of wages lists the common payroll frauds: ghost employees, deliberate timing errors with starters and leavers, inflated net pay or altered bank transfer lists, and unauthorised overtime. Each needs a different test.
Ghost employees
ACCA identifies fictitious employees on the payroll as a common payroll fraud, and gives a classic setting for it: factory supervisors who keep blank clock cards and also distribute wage packets. Modern versions use bank transfers rather than wage packets, but the pattern is the same. Someone who can add a person to the payroll is also in a position to control where that person's pay goes.
Traces to look for:
- employees with no HR file, no signed contract or no identity document on record;
- employees who never take leave, never claim expenses and never appear on training or access records;
- several employees paid into the same bank account, or into an account in another employee's name;
- employees with no tax number, or with the same address or contact number as a staff member;
- people on the payroll who do not appear on site registers or shift rosters.
Starters and leavers timed to someone's advantage
ACCA lists deliberate timing errors with starters and leavers. A leaver kept on the payroll for a month or two after leaving, with the extra pay diverted, is a common variation. So is a starter added before they actually start.
The test is to compare dates across records: the resignation letter or termination notice against the last payroll run; the first day on the access register against the first pay. Any gap should have an explanation, such as notice pay or leave paid out, that agrees to the employment contract or the law.
Inflated net pay and altered bank lists
ACCA also lists inflated net pay and altered bank transfer lists. Here the person exists, but the amount paid, or the account it goes to, has been changed after the payroll was approved.
Look for:
- differences between the approved payroll report and the bank payment file for the same run;
- net pay that does not follow from gross pay less deductions;
- changes to bank details shortly before a pay run, especially changes reversed soon after;
- manual payments made outside the normal run.
Where the client keeps its payroll on Achekam, an employee's bank account entered or changed by one person must be verified by another person before it is paid in the payment schedule or bank file. In an investigation, that verification record is evidence in itself: it shows who entered each change and who verified it.
Unauthorised overtime
Overtime is a quieter scheme. Hours are inflated, approvals forged or skipped, and the extra pay shared. Compare overtime paid with time records, shift rosters and the work that was actually done. Look for overtime that rises at month end, overtime approved by the person who earns it, and departments where overtime is consistently high without a business reason.
The common thread: who can do what
ACCA states that the common feature that often facilitates payroll frauds is inadequate segregation of duties. AccountingTools makes the specific point: the person who adds new employees or updates payroll records should not also distribute or authorise payroll payments, to prevent a ghost employee being paid.
Early in any investigation, map who can do each of these: add or remove an employee, change pay rates, change bank details, approve the run, release the payment. Where one person can do two or more, focus testing there.
Tracing from contract to bank
ACCA gives, as a substantive procedure to confirm wages are paid only to valid employees, selecting a sample of employees from the payroll and vouching them to individual contracts of employment held in the HR department. For an investigation, extend it in both directions: from HR records to the payroll, and from bank payments back through the payroll to HR.
Achekam can help with selection. In Audit Intelligence, Achekam risk-scores a loaded population and proposes a sample; a reviewer who did not prepare the plan approves it before it is drawn, and every draw can be reproduced from its stored seed. Methods include random, systematic, monetary unit, specific items and all items, and no sample size is proposed without approved materiality and a confidence level. For a fraud investigation, "specific items" and "all items" are often the right choice: the point is to find every ghost, not to estimate how many there might be.
Achekam also ships working-paper template packs written in its own words, including one for forensic work, for a firm to adopt and approve. The catalogue is marked unapproved platform content until the firm adopts it, so confirm it is available and approved in your workspace first.
A starting checklist
- Obtain payroll reports and bank payment files for the period, and agree them run by run.
- Match every payee bank account against the employee master file and staff records.
- Vouch employees to contracts, identity documents and tax registration.
- Compare starter and leaver dates with pay dates.
- Review bank detail changes, and who made and approved them.
- Analyse overtime by person, department and approver.
Auditors will find the overlap with routine work in auditing payroll costs, and bank detail changes at a payroll bureau looks at one of the commonest weak points. Start every payroll investigation by asking for the bank file, not the payroll report; the money goes where the bank file says.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
