Payroll exception reports an auditor should ask for
Which payroll exception and standing-data change reports an auditor should obtain, how to test who changed what, and how to follow up each exception.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Payroll is usually one of the largest costs in a client's income statement, and one of the most repetitive. The same people are paid the same amounts month after month, which is exactly why errors and frauds hide in it so well. A fictitious employee looks like every other line. A pay rate quietly raised looks like last month's figure with a little more on it.
Two kinds of report bring those lines into view: exception reports, which show transactions outside expected limits, and standing data change reports, which show who changed the payroll master file and when. An auditor who obtains and tests both often learns more about payroll than vouching a handful of payslips ever would. This article explains which reports to ask for and how to use them.
ACCA's control objectives for wages
ACCA lists typical control objectives for wages: employees are paid only for work done, wages are paid only to valid employees, all wages are authorised, wages are paid at correct rates and correctly calculated, wage transactions are correctly recorded, and deductions are paid over to the right third parties, such as tax authorities. Its article on the audit of wages works through those objectives with the controls and tests that go with them.
Exception and change reports map neatly onto those objectives. Exception reports speak to work done, authorisation and calculation. Change reports speak to valid employees and correct rates.
Exception reports: limits, overtime and unusual pay
ACCA advises that payroll software should produce exception reports listing processed transactions that exceed pre-determined limits, giving as examples employees earning more than $2,000 per week or working more than 30 hours of overtime. Those figures are ACCA's illustration; the useful limits for a client in rand, naira or shillings depend on its own pay scales and working patterns. ACCA stresses that error reports and exception reports should both be investigated closely.
Ask the client which exception reports its payroll system produces and which limits are set. Typical ones include:
- pay above a set amount for the pay period;
- overtime above a set number of hours;
- pay that differs from the previous period by more than a set margin;
- payments to employees with no hours recorded;
- duplicate bank accounts or identity numbers across employees;
- payments after a recorded termination date.
If the system produces none, or nobody reviews them, that is a finding in itself, and the audit leans more heavily on substantive tests.
Standing data changes: pay rates, starters and leavers
ACCA advises that changes to standing data on the payroll master file should be made by staff independent of processing the payroll, and that changes such as rates of pay and new starters or leavers should be supported by forms approved by a senior responsible official.
A standing data change report, or the system's audit log, should show every change during the year: who made it, when, and what changed. For each change selected, the test asks three questions. Was it supported by an approved form? Was the approver senior and independent of payroll processing? Did the change match what was approved, in amount and effective date?
Who may change standing data
ACCA states that the common feature that often facilitates payroll frauds is inadequate segregation of duties. The most important question about standing data is therefore not what changed but who could change it. Obtain the list of users with rights to edit the payroll master file and compare it with the people who process and pay the payroll. Anyone on both lists can create an employee, set a rate and pay it.
Bank account changes deserve particular attention, because they are the step that turns a payroll fraud into cash. Where the client runs its payroll on Achekam, an employee's bank account entered or changed by one person must be verified by another person before it is paid in the payment schedule or bank file. That is a control in the client's own books worth testing: confirm the verifier was a different person, and look at what the verification consisted of.
Requesting the reports and sampling changes
In Achekam, staff can create, send and track requests to clients for documents, answers and confirmations in one RFI console, whichever screen the request was raised from. List the reports precisely: the exception reports for each pay period of the year with evidence of review, the standing data change report or audit log for the full year, and the list of users with edit rights. Ask for the reports as the system produced them, not as spreadsheets retyped by the payroll officer.
For testing, load the change log as a population in Audit Intelligence. Achekam risk-scores it and proposes a sample, a reviewer who did not prepare the plan approves it before it is drawn, and every draw can be reproduced from its stored seed. Include all changes to bank details and all new starters if the population is small enough, using the specific items or all items methods, and sample the rest.
Following up every exception
An exception report is only a control if someone acts on it. For each exception the auditor examines:
- Was it reviewed, by whom and when?
- What explanation was recorded?
- Is the explanation supported, for example by overtime authorisations, a promotion letter or a signed termination?
- Was any error corrected, and the correction approved?
- Did the same exception recur without anyone asking why?
Unexplained or unsupported exceptions become findings, and patterns among them, such as one manager's team always over the overtime limit, deserve a closer look. For the wider substantive work on payroll, see auditing payroll costs, and where exceptions point to something deliberate, forensic payroll schemes.
Asking for the reports costs one request. Not asking means auditing the most repetitive figure in the accounts without seeing the lines that break the pattern.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
