Payroll Watchdog
Guide

Payroll Audit Checklist: The Checks That Actually Catch Fraud

A payroll audit sounds like something you hire a firm for. The version that catches most fraud is an afternoon with four reports you already have, run by someone who doesn't process payroll. Here's the checklist, in the order that finds problems fastest.

Published July 6, 2026 · 9 min read

Before you start: pull four things

The whole audit rests on comparing records that a fraudster would need to falsify separately. Pull these before you look at anything:

  • The payroll register for the last three to six months — every payment, every person, from your payroll system.
  • The employee roster from HR— or wherever hiring records live, as long as it's notan export from the payroll system. If both lists come from the same place, a ghost employee appears on both and you've checked nothing.
  • Bank statements for the payroll account, same period.
  • Time records, including the edit log if your system keeps one (most do; few people ever open it).

One rule about who runs this: not the person who processes payroll. That's nothing personal — it's the entire point. An audit performed by the only person able to commit the fraud is a formality, and the ACFE's case files are full of formalities. If you're the owner, the auditor is you.

Part 1: The roster — hunting ghosts

  • Match every name on the payroll register to the HR roster.Anyone paid who isn't on the roster gets explained in writing, today. This single check catches most ghost employees.
  • Search for duplicate bank accounts. Two employees direct-depositing into one account is occasionally a married couple and frequently a fraud. Duplicate addresses deserve the same look.
  • Flag employees with no PTO, no benefits, and no tax-form activity.Ghosts don't take vacations, elect health insurance, or update a W-4. A payroll record with zero life around it is worth a physical “does anyone know this person?”
  • Check terminated employees against recent payments. Payments dated after a termination date are either a final-paycheck straggler or someone reactivating departed employees and pocketing the run.
  • Count W-2s against headcount at year end. More tax forms than humans is the cheapest ghost detector there is.

Part 2: Pay data — the numbers that don't sit right

  • List every pay-rate change in the period and match each to a written authorization. Unauthorized raises — often small, often self-granted — compound quietly for years.
  • Rank everyone by overtime. The top few names should make operational sense. A back-office employee out-earning the warehouse crew on overtime is a classic padded-hours signature.
  • Pull every off-cycle and manual payment.Fraud loves the runs nobody reviews — bonuses, corrections, “missed hours” make-ups. Each one needs a reason and an approver who isn't the payee.
  • Scan commissions and bonuses for spikes against the sales or performance records that supposedly justify them.

Part 3: Time records

  • Open the punch edit log.Look for one supervisor editing the same employee's time repeatedly, or anyone editing their own.
  • Look for identical punch patterns — two people clocking in at the same second, every shift, is a shared login or buddy punching.
  • Confirm no one approves their own time.Where a manager approves their team's hours, someone else approves the manager's.

Part 4: Follow the money

  • Reconcile the payroll bank account against the register: total out of the bank should equal net pay plus taxes plus garnishments, to the dollar. Unexplained differences are never fine.
  • Review the direct-deposit change log. Every bank-account change should trace to an employee request — this is where both inside diversion and email-compromise scams leave their fingerprints.
  • Verify tax deposits actually arrived at the IRS and state. Withheld-but-never-remitted payroll tax is a fraud the business itself ends up owing.

Part 5: Access — who can do what

  • List everyone who can add an employee AND run payroll. Ideally that list is empty. If it isn't, segregation of duties is your next project, not this checklist.
  • Confirm the audit trail is on and that admin access matches current job duties — not the duties people had two roles ago.

How often, and how predictably

A reasonable cadence: the roster match and direct-deposit log monthly (fifteen minutes), the full checklist quarterly, and once a year an unannounced pass at an irregular time. The unannounced part does real work — a fraudster who knows the audit lands the first week of January cleans up in December. Uncertainty is a control.

What software does that this checklist can't

Everything above is point-in-time. Payroll fraud is a flow — the median scheme runs 13 months precisely because quarterly snapshots leave long dark stretches (the full 2026 numbers). Anomaly-detection tools run these same comparisons continuously and flag the weird payment the week it happens instead of the quarter after. If the checklist keeps finding things, or payroll has outgrown one reviewer, that's the signal to look at dedicated detection software. And if it finds something real, stop and read how to report payroll fraud before you confront anyone — the first 72 hours matter more than people expect.