A factory in Agbara pays 600 workers every month. Two years later, an audit finds 14 names on the payroll that match no real employee, plus six people who left long ago and are still paid into accounts controlled by a payroll officer. Payroll is repetitive, it is large, and it is easy to hide fraud in it. The auditor tests it with controls because checking every payslip is not practical.
This topic covers the four parts of the payroll cycle: calculating gross pay, calculating deductions, recording pay in the accounts and paying staff and the authorities, with the risks, objectives, controls and tests for each, followed by the weaknesses the examiner is likely to plant in a case study. The previous topic covered purchases and the next covers bank and cash.
In 30 seconds
Parts: gross pay; deductions; recording; payment. Risks: phantom or departed employees paid, pay for work not done, wrong gross pay, wrong or unauthorised deductions, wrong recording, wrong net pay, deductions not paid to the authorities, payment to the wrong person. Controls: segregation, authorised starters and leavers, authorised time records and overtime, senior review of totals, exception reports, written consent for voluntary deductions, control account reconciliations, authorised payment lists, bank reconciliations.
Typical weaknesses: clocking on for others, unauthorised overtime, junior staff paying wages, unauthorised lists, weak passwords, leaver e-mails ignored.
Key terms in plain English
| Term | What it means |
|---|---|
| Phantom employee | A person on the payroll who does not exist or has left |
| Gross pay | Pay before deductions |
| Net pay | Pay after deductions |
| Clock card | A card used to record time at work |
| Control account | A ledger total used to check detailed records |
| Exception report | A list of items that break a rule |
Syllabus check
This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:
- accounting systems and internal controls in the payroll cycle
- the evaluation of internal controls
- tests of controls
CAMA 2020 and the payroll system
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(2) | The auditor states whether proper books of account were kept | Payroll records are part of the books |
| s. 405 | Corporate responsibility for financial reports | Management designs payroll controls |
| s. 407(3) | Right of access to books, accounts and vouchers | Access to payroll records and bank lists |
The rules in more depth
The elements of the payroll system
The payroll cycle has four elements:
- (a) calculating gross wages and salaries
- (b) calculating tax and other deductions
- (c) recording wages and salaries payable in the accounts
- (d) paying wages and salaries
The tables below set out risks, objectives, controls and tests for each.
Calculating gross wages and salaries
| Risk | Control objective | Principal controls | Tests of control |
|---|---|---|---|
| Pay to people who are not employees, such as former staff or phantom employees | Only real employees are paid | Segregation: the person who prepares the payroll does not pay it. Formal authorisation and documentation for new employees, and for putting them on the payroll file. Departmental payroll lists authorised by an appropriate person | Check that segregation exists. Check authorisation documents for new employees. Check that the payroll lists are properly authorised |
| Pay for work not done | Employees are paid only for work done | Time sheets for time-paid staff, authorised by the supervisor; a clock card system for hourly workers. Formal personnel records of pay rates, start and leaving dates | Check time sheets for the supervisor's signature. Observe the clock card system operating. Check payroll file details against personnel records |
| Gross pay calculated wrongly | Gross pay is calculated correctly | A senior manager checks the total payroll cost each week or month for reasonableness. In an IT system, exception reports of gross pay over set limits are followed up | Check the signature or initials of the manager on the payroll list. Use test data to check that exception reports work, and review them for evidence of follow-up |
| Bonus or overtime paid without authority | Bonus and overtime payments are authorised | Authorisation by the appropriate manager | Check a sample of bonus payments for correct calculation and authorisation |
Tax and other deductions
Deductions include income tax under the pay-as-you-earn system, pension contributions and other deductions such as union dues and loan repayments.
| Risk | Control objective | Principal controls | Tests of control |
|---|---|---|---|
| Tax and other deductions calculated wrongly | Deductions are calculated correctly | Procedures, manual or IT, use up-to-date tax rates. Senior management checks total deductions each week or month | Review manual procedures and the rates used. In an IT system, check the general IT controls over development, testing and implementation, and use test data compared with independently calculated figures. Check for the manager's signature on total deductions |
| Voluntary deductions without the employee's consent | Voluntary deductions are made only with consent | Written authorisation by the employee, kept in the payroll file | Check the payroll file against the deductions made, to confirm that voluntary deductions are authorised |
Recording wages and salaries in the accounts
| Risk | Control objective | Principal controls | Tests of control |
|---|---|---|---|
| Gross pay, deductions and net pay not properly recorded | They are recorded properly and accurately | Accounts prepared from payroll data approved by a senior manager. Accounting for payroll completed within a strict timescale. Payroll control accounts regularly reconciled to the payroll records of all employees | Evidence of formal approval of the payroll. Checks on the recording procedures and the time taken. Documentary evidence of reconciliations and of their review |
In an integrated IT system, the nominal ledger is updated automatically.
Payment of wages and salaries
| Risk | Control objective | Principal controls | Tests of control |
|---|---|---|---|
| Wrong net pay | Correct net pay is paid | For automated bank transfers, the payment list is authorised by an appropriate manager | Check the authorised lists of payments |
| Wrong amounts of deductions paid to the authorities | The correct deductions are paid to the tax and other authorities | Formal procedures and a timetable for paying deductions and recording the payments | Check the procedures and the recording of payments |
| Payment to the wrong person | Net pay goes only to the employee | Bank statements checked against payments recorded in the accounts | Evidence of bank reconciliation checks |
| Payments wrongly recorded | Payments are correctly recorded | Controls to reconcile the total payable to the total paid | Check that each payroll, payable and paid, is reconciled; in an integrated IT system, process a dummy payroll run to be satisfied the system works |
These assume payment by bank transfer. When wages are paid in cash, or casual labour is paid in cash, additional controls are needed, such as payment in the presence of a supervisor, signature on a payroll sheet by each recipient, a record of unclaimed wages, and prompt banking of any unclaimed cash.
Possible control weaknesses in a payroll system
In a case study the examiner may describe a payroll system and ask for the weaknesses. Possible ones are:
- Recording of time at work. Hourly-paid staff use identity cards and a clock to "clock on" and "clock off". The risk is that an employee clocks on for a colleague using the colleague's card. The control is daily observation of the clocking-on process.
- Overtime not authorised, or the amount not checked and authorised.
- Payments made by a junior person in accounts without proper authorisation.
- Departmental payroll lists not authorised, with a risk of phantom employees.
- Passwords that can be guessed, such as names of family members or pets. They should be hard to guess, with letters and numbers, and changed regularly.
- E-mails as the only notice that staff have left. Information not on paper is more likely to be overlooked, so former employees continue to be paid. A control is numbered e-mails with a confirmation of receipt by payroll.
Other points to look for are:
- no independent review of the payroll before payment
- the same person adding employees, changing pay rates and processing payroll
- bank details of employees changed without evidence of request
- failure to compare the payroll list to the staff list or to an independent head count
Substantive consequences
If the tests of controls show that payroll controls operate, the auditor can reduce substantive tests on payroll expense, such as the detailed re-calculation of pay, but analytical procedures of total payroll cost against headcount and pay rates remain useful.
If controls are weak, the auditor extends detailed tests, can include a surprise payout of wages to verify that employees exist, and checks that accrued wages, pension and tax liabilities at the year end are complete.
Worked examples
Example 1: phantom employee. The payroll clerk can add employees to the payroll file and also process the monthly payroll.
- There is no segregation, so a phantom employee could be added and paid into the clerk's account.
- Starters should be approved by HR and a manager, and the payroll list reviewed against the personnel records.
Example 2: clocking on. A supervisor notices that the card of a worker is clocked on at 7.00 a.m. but he is absent until 10.00 a.m.
- A colleague has clocked on for him.
- The control is observation of clocking-on and supervisor review; the auditor can observe the process in operation.
Example 3: leaver. Human resources e-mails payroll that an employee left in March. Payroll does not act, and he is paid until July.
- Four months of pay were paid to a former employee.
- The control is a numbered leaver notice and a confirmation from payroll, plus review of the payroll for leavers.
Example 4: test data. The auditor wants to see that the system flags gross pay above ₦2 million.
- Input a dummy employee with gross pay of ₦3 million.
- Check that the system produces an exception report entry and that management follows it up.
How to score full marks
- Divide by the four parts of the cycle.
- Give phantom employees and authorisation first.
- Link each test to the control it checks.
- In weakness questions state the risk and the recommended control.
Common mistakes in the exam
- Forgetting segregation between preparing and paying the payroll.
- Ignoring leavers.
- Giving controls without tests.
- Forgetting payment of deductions to the authorities.
Quick revision
- Gross pay, deductions, recording, payment.
- Phantom employees; authorised lists; time records.
- Control accounts; reconciliations; bank statements.
- Weaknesses: clocking on, overtime, junior payers, passwords, e-mail leaver notices.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. A phantom employee is:
- A person on the payroll who does not exist or has left
- A new starter
- A manager
- A director
Show the answer
A. A fraud risk.
Question 2. Time sheets for time-paid staff should be:
- Authorised by a supervisor
- Destroyed
- Kept by the employee
- Left blank
Show the answer
A. To pay only for work done.
Question 3. Voluntary deductions need:
- Written authority of the employee
- Verbal consent only
- No approval
- Approval by the auditor
Show the answer
A. Kept in the payroll file.
Question 4. A control to reconcile payroll to the accounts is the:
- Control account reconciliation
- Bank statement of sales
- Customer statement
- Stock count
Show the answer
A. Between records and ledger.
Question 5. Clocking on for a colleague is prevented by:
- Observing the clocking-on process
- Higher pay
- More overtime
- Annual leave
Show the answer
A. Daily observation.
Question 6. Payment lists for bank transfers should be:
- Authorised by an appropriate manager
- Prepared by anyone
- Unsigned
- Emailed to staff
Show the answer
A. Authorised lists.
Question 7. A risk of leaver e-mails is that:
- Former employees continue to be paid
- Staff are paid early
- Tax is cut
- Passwords are shared
Show the answer
A. Not acted upon.
Question 8. Exception reports in IT payroll show:
- Gross pay above set limits
- Sales
- Purchases
- Stock
Show the answer
A. For follow-up.
Question 9. Deductions paid to the authorities should follow:
- A formal timetable
- Whatever is convenient
- Staff requests
- Year end only
Show the answer
A. Procedures and timetable.
Question 10. Weak passwords in payroll are those:
- Easy to guess such as names of pets
- With letters and numbers
- Changed regularly
- Long and random
Show the answer
A. They should be hard to guess.
Question 11 (10 marks). Describe the risks and controls over gross pay and the tests of controls the auditor would carry out. (8 marks)
Question 12 (10 marks). Identify five control weaknesses that may exist in a payroll system and recommend how to correct them. (7 marks)
Question 13 (10 marks). Explain controls over the payment of wages and the recording of payroll in the accounts. (5 marks)
Model answers
Show the model answer to Question 11
Risks: payment to non-employees; pay for work not done; wrong gross pay. (2) Controls: segregation; authorised starters and lists; time sheets and clock cards; senior review of totals; exception reports; authorised bonuses. (3) Tests: check segregation and authorisations; check time sheets; observe clocking; check manager initials; test data for exception reports; sample of bonuses. (3)
Show the model answer to Question 12
Any five with remedy:
- clocking on for others, observe
- unauthorised overtime, authorise
- junior staff paying, authorise payment lists
- unauthorised departmental lists, authorise
- weak passwords, strong and changed
- leaver e-mails, number and confirm
(1.4 each)
Show the model answer to Question 13
Payment: authorised payment lists; timetable and procedures for paying deductions; bank statements checked to records; reconciliation of payable to paid. (3) Recording: approved payroll data; strict timescale; control accounts with regular reconciliation. (2)
Spotted a mistake? Tell us and we will check it.
