Money leaves the company when a supplier charges more than you agreed. Payroll & HR finds it. Every pay run checked against your employee records and pay rates, so the people you pay are the people you employ, at the rate you agreed.
What it checks
- Paid after termination. No one is paid for a period after their leaving date, beyond the final pay your policy allows.
- One person, one account. No two employees share a bank account, an address and a tax id together.
- Pay rate against the record. The rate on each pay run equals the rate on the employee's record for that period.
- Rate change approved. A change to a pay rate has a recorded approver who is not the employee.
- Hours within pattern. Overtime, or hours outside an employee's normal pattern, is flagged with the amount, unless you have said to expect it.
- Headcount ties. The number of people paid equals the number on your employee list for that period.
- Payroll ties to the ledger. The pay run total equals the payroll entries in your books and the payment out of your bank.
- New starter has a record. Every first payment goes to someone with a complete employee record created before the pay run.
A finding, in its own words
Employee E-042 was paid $3,120.00 on 31 August. The employee record shows a termination date of 15 July and a final pay on 31 July. That is one pay period after termination: $3,120.00.
Employee E-017's rate changed from $28.00 to $34.00 an hour on 1 June. I cannot find an approver. Tell me who approved it and I will record it and re-test.
What it may ask you
- After someone leaves, how many more pay runs can they appear in? For example 1 for a final pay. Unless you say otherwise: 1.
- Who can approve a pay-rate change? Unless you say otherwise: the approvers in approval_limits.
- Any times of year when overtime is normal? For example 'November and December'.
- Are any contractors paid through payroll rather than by invoice? Name them.
- Do any two employees share a bank account on purpose, like a couple? Name them.
What it draws on
- The people paid are the people employed. COSO Control Activities, principle 10; SOX: Payroll existence and validity.
- Pay rates match the record and changes are approved. COSO Control Activities, principle 10; SOX: Payroll master data and rate change controls.
- Authorisation of transactions and changes. COSO Control Activities, principle 10; SOX: Authorisation of transactions.
- Hours paid fit the pattern, and overtime is real. COSO Monitoring Activities, principle 16; SOX: Payroll hours validation.
- Payroll ties to the ledger and the bank. COSO Information and Communication, principle 13; SOX: Payroll reconciliation.
- The ledger agrees with its sub-ledgers. COSO Information and Communication, principle 13; SOX: Sub-ledger to general ledger reconciliation.
What it needs
- pay runs, as an export from your payroll provider or through a Connection
- your employee list, with start and leaving dates
- pay rates and their history, so a change can be checked for an approver
- Connections, optional: your payroll provider, and QuickBooks or Xero and your bank for the tie to the books. A pay-run export is enough to start.