Payroll Watchdog
Guide

What Triggers a Payroll Audit?

Three completely different things get called a payroll audit, and different people set each one off. Before you can answer what triggers one, you have to know which one is knocking.

Published July 30, 2026 · 9 min read

Which audit are we talking about?

People searching this question are usually holding a letter, and the letter is one of three things:

  • A federal or state employment tax examination. The IRS or your state revenue department wants to reconcile what you reported against what you deposited, and to test whether the people you call contractors are contractors.
  • A Department of Labor wage and hour investigation. Federal WHD or a state labor agency, looking at overtime, minimum wage, classification, and whether your records support what you paid. This one is complaint-driven far more often than the tax version.
  • A workers' compensation premium audit.This isn't triggered by anything. It's annual, it's in your policy, and your carrier does it to every policyholder to true up premium against actual payroll by class code. If this is your letter, relax — it's a bill reconciliation, not an enforcement action.

The third one accounts for a lot of the panic and almost none of the risk. The first two are what the rest of this covers.

The most common trigger is a person

Not an algorithm. A former employee who believes they were shorted, and who filed a complaint.

Wage and hour investigations are overwhelmingly complaint-driven, and the complaint doesn't have to be large or well-documented to open one. Somebody classified as a contractor who thinks they were an employee. Somebody who worked through unpaid lunches. Somebody who was fired and is now going through everything with a highlighter. The agency does not need a pattern to start, and once an investigator is looking at one employee's records they are permitted to look at everyone's — which is how a single complaint about one person's overtime becomes a two-year lookback across the whole payroll.

The uncomfortable version

One call

The most common path to a wage and hour investigation is a departing employee with a grievance and a phone. Terminations handled badly are a compliance risk, not just an HR one.

Worth connecting to the obvious: this is a reason to get the exit right even when you're entirely in the right. The firing sequence and the final-paycheck rules for time theft exist partly because a botched last check is exactly the grievance that produces the phone call.

What the IRS actually notices

The tax side is more mechanical. A handful of mismatches reliably generate correspondence, and correspondence sometimes becomes an examination:

  • Your four quarterly 941s don't total to your annual W-2s and W-3.The IRS and the Social Security Administration reconcile these against each other. When the numbers disagree, you get a notice, and this is the single most common way a small business ends up explaining its payroll. Usually it's a bookkeeping error. Occasionally it's the fingerprint of something worse.
  • Late or missed federal tax deposits. Deposit schedules are set by your lookback period, penalties escalate by how late you are, and a pattern of lateness is read as a business in distress — which is a category the IRS watches more closely, because withheld payroll tax is the money businesses in trouble borrow from first.
  • A lot of 1099s relative to W-2s. Especially in industries where the work looks like employment: construction, trucking, home services, salons. Classification is an enforcement priority for both the IRS and the states, and the ratio is a cheap screen.
  • A worker files a Form SS-8.That's a request for the IRS to formally determine whether they were an employee or a contractor. It puts your classification decision directly in front of the agency, and one determination tends to implicate everyone else doing the same job.
  • Large unexplained swings in reported wages. A headcount that halves without a corresponding story, or officer compensation in an S corporation that looks implausibly low against distributions.

The state angle people forget

State unemployment agencies run their own audits, and they have two triggers of their own. The first is a claim filed by someone whose wages you never reported — the agency now has a person saying they worked for you and a record saying they didn't. The second is anything that looks like SUTA dumping: shuffling payroll between entities to inherit a lower experience rate. States have been required to police that since 2004 and they use automated detection for it.

State revenue departments also share data with the IRS. An adjustment in one direction has a habit of producing a letter from the other.

What actually lowers your odds

Not much of this is exotic, and the quarterly discipline is worth more than everything else combined:

  • Reconcile 941s to your general ledger every quarter rather than discovering the gap in January. The fix is trivial in April and a notice in the following year.
  • Document every contractor classification when you make it — the control the person has over how the work is done, the equipment, whether they serve other clients. Reconstructing that reasoning three years later, under examination, is a much worse exercise.
  • Keep the records for the actual retention period. FLSA wants three years of payroll records and two years of the time records behind them; employment tax records run four years. An investigation where you can't produce time records tends to resolve in the employee's favor, because the burden of the missing record falls on the employer who was required to keep it.
  • Deposit on time, always.This one is entirely within your control and it's the pattern that draws attention.

Where this meets fraud

Two connections worth naming. First, some internal payroll fraud surfaces asan audit finding rather than being caught internally — withheld tax that was never remitted, wages reported for people who don't exist. If you get a 941-to-W-2 mismatch you can't explain, the possibility that someone inside created it deserves a look before you file it as a clerical error.

Second, the records an auditor asks for are almost exactly the records that catch a ghost employee, so the self-audit and the defensive preparation are the same afternoon of work. Our payroll audit checklist is the internal version — run it quarterly and an outside examination stops being a scramble. If it turns up a name nobody recognizes, the ghost employee guide picks up from there.

Standard caveat, meant sincerely: this describes how these agencies generally work, not what to do about a specific letter. A CPA or an employment attorney who has seen your actual notice is worth their fee, and responding to an examination on instinct is how a reconcilable discrepancy turns into an assessment.