How to Run a Payroll Audit Before Someone Else Does

An internal payroll audit costs a few days. A statutory inspection that finds the same issues costs retrospective dues, interest and penalties across multiple years. The arithmetic favours auditing yourself.

Scope and preparation

Audit a full financial year. Gather:

• Monthly payroll registers
• Bank payment advices and statements
• PF ECR filings and challans
• ESI returns and challans
• TDS challans and Form 24Q acknowledgements
• Professional Tax returns
• Attendance and leave records
• Employee master data
• Appointment letters and salary revision records
• Full and final settlement files

Reconciliation 1: Payroll to bank

For each month, total net pay per the payroll register must equal the bank debit. Investigate every difference. Common causes: failed payments not reversed in payroll, off-cycle payments made outside payroll, and manual adjustments made at the bank file stage.

Reconciliation 2: Payroll to statutory filings

• Total PF per payroll = total PF per ECR, for each month
• Total ESI per payroll = total ESI per return
• Total TDS per payroll = total TDS per challans, and per Form 24Q
• Total PT per payroll = total PT remitted, per state
• Employee counts in filings match payroll headcount

Differences here are the ones that create statutory exposure, so reconcile to zero rather than to "immaterial".

Reconciliation 3: Payroll to general ledger

Salary expense, statutory liability accounts and payable balances should agree. Unexplained balances in statutory liability accounts usually mean something was deducted and not remitted — or remitted twice.

Reconciliation 4: Headcount

For every month: opening headcount + joiners − leavers = closing headcount. Then verify:

• Every person paid exists in the employee master and has an appointment letter
• Every leaver stopped being paid from the correct date
• No duplicate records, particularly for rehires
• Every active employee has PAN, bank details and UAN recorded

Statutory verification

• PF — correct wage base applied; ceiling policy applied consistently; EPS capped at ₹1,250; EDLI and admin charges borne by employer; exit dates marked in EPFO
• ESI — correct coverage decisions; contribution-period continuation rule applied for employees crossing ₹21,000 mid-period
• PT — correct state applied per work location, not per payroll location
• TDS — annual projections recomputed on salary changes; declarations supported by proof; perquisites valued and taxed
• Overtime — paid at twice ordinary wages; hour caps not breached
• Minimum wages — nobody below their applicable rate
• Bonus — eligibility assessed and paid within the statutory window
• Gratuity — accrued; paid within 30 days for eligible leavers

Salary structure review

• Does each structure sum to the stated CTC?
• Is basic a defensible proportion, or is most of the package in a universal special allowance? If the latter, your PF wage base is a live risk.
• Are structures consistent within grades, or has ad-hoc negotiation created anomalies?
• Are reimbursements supported by bills where tax exemption was allowed?

Controls testing

• Segregation of duties — the person who adds an employee should not be the person who approves payment
• Approval evidence — is each payroll run signed off, and by whom?
• Change audit trail — can you see who changed a salary, bank account or attendance record, and when?
• Bank detail changes — are they verified independently? This is the most common payroll fraud vector.
• Access review — who can view and edit salary data, and should they still?

After the audit

• Document findings with evidence and a severity rating
• Fix statutory shortfalls promptly — voluntary correction is treated far better than discovery
• Address the control weakness, not just the instance
• Re-test the significant findings after remediation
• Schedule the next audit, annually at minimum