I haven’t looked at payroll very often; at least not as often as I think I should or would have liked. Payroll can be a significant cost to an organization – easily representing 50% of a company’s total expenditures in some industries – but senior management seems to think that the controls over payroll are good and therefore it is low risk. This belief is often transferred to audit even though studies, and the analysis I have performed over the years, have indicated that this may not be the case. The ACFE Report to the Nations (2016) stated that payroll fraud occurred in 8.5% of the fraudulent disbursement fraud and had a median loss of $90,000. It also stated that payroll schemes were twice as common in small organizations as in larger organizations. This may add some credence to the belief that the controls are better in larger organizations but it may be simply that auditors in larger organizations are not looking at payroll; however, larger organization can sometimes have larger frauds. When I did perform analysis on payroll I typically found errors and occasionally fraud.
As part of an audit at a large US city, I was asked to examine payroll. The audit objective sought to ensure that the controls contributed to a payroll function that was efficient and effective and that pay was accurate. I performed a number of common tests to support the audit objective.
In my post for Year 21 – 2008, I described an analysis which looked at the pay rates for different categories of employees. This same analysis identified two employees who were being paid more than 25% over the pay rate for other employees in the same job category/position. A second, simple, analysis identified eight missing check numbers. The manager asked for more information and I replied, “I can’t tell you much more than you have eight checks that were not issued”. I provided the missing check number and encouraged the manager, and the auditors, to look into the matter. Missing checks could be checks that were accidentally destroyed when the check were being printed or (my concern) stolen blank checks. The controls over the blank check stock needed to be reviewed as well as determining the procedures when checks were being printed (what do you do to damaged, misprinted, or otherwise unusable checks?).
Note: to perform the analysis by job category to identify employees being paid more than the usual rate for the category, I ran a Min/Max ratio analysis. For each job category (rows in the output file), it calculates the Total amount and gives the minimum, maximum and average amount for each job category. Starting in version 11, ACL provides a checkbox which will includes this information when you Classify or Summarize on a field. In version 12, the option to include the standard deviation for each row was also added.
Another analysis looked at the length of time it took to get new employees on the payroll. Using data from the HR system which gave the employee start date, I ran an analysis to determine how long it took before they received their first paycheck. Management expectations that it would be the next pay period or certainly the second pay period, however the analysis showed that in 31% of the cases, employees did not receive their first pay for more than 28 days (almost four pay periods after their start date). Drilling down by pay office revealed problem with the HR on-boarding process in two regions which contributed to the late paychecks.
I also did an analysis to determine if employees were being paid before their “start date” or after their “termination date”. There was no evidence of control weaknesses in these areas.
ACL Commands – STATISTICS, GAPS, AGE, CLASSIFY, RELATE, and SCRIPT (Min/Max).
Lessons-Learned – Similar problems occur all the time. It is worth looking at what types of controls weakness have occurred elsewhere when planning an audit. Look at the ACFE and other reports produced by the big accounting firms, perform a simple Internet search, and check the ACL forum to see what others have found. I find the same types of problem are happening in different industries around the world.
Secondly, there is a reason why the standard set of commands were developed by ACL: they are useful. I have used the basic commands thousands of times to perform useful analysis. In this case GAPS, a standard ACL command, identified missing checks. The results of the standard commands can be extremely useful – you need to understand when to use them and, importantly, how to interpret the analysis.
Lastly, even large payroll system can have errors; and when they do they can be even more significant. I recently learned about a hospital payroll system which was being run on SAP that was overpaying employees (more than $1M in overpayments in a year). It was a systemic problem tied to interfaces, pay tables, and complex hourly schedules, work days, and numerous employee classifications. In another case, employees agreed to be on-call during the Australia Day public holiday, and were subsequently recalled for duty. However, the payroll system did not identify this as a holiday and incorrectly calculated entitlements, resulting in significant underpayments. These examples highlight the fact that auditors cannot rely on the controls – in fact the Statement on Auditing Standards (SAS) #94 states that substantive testing alone is not sufficient when the data is gathered, processed, and reported via IT systems. It requires auditors to test the IT controls and recommends the use of analytics to do so. This includes any IT system, not just payroll.
I have only discussed errors in employee pay, but there are also errors that can impact on income tax. In Accounting Today Brian Cumberland, a managing director with Alvarez & Marsal Taxand, LLC in Dallas, offer his list of the top ten payroll errors: 1. Classification of Employees as Independent Contractors; 2. Failure to Subject Vendor Payments to Backup Withholding; 3. Failure to Issue Appropriate Tax Forms; 4. Not Including the Fair Market Value of Gift Cards, Prizes and Awards in Employees’ Income; 5. Failing to Timely Deposit Withheld Taxes; 6. Failure to Timely Deposit Withholding Taxes on Vested Restricted Stock and Exercise of Stock Options; 7. Incorrectly Excluding Expense Reimbursements from Reportable Wages; 8. Failure to Include Nonqualified Deferred Compensation in Executives’ Incomes; 9. Not Including the Appropriate Value of Taxable Fringe Benefits in Employees’ Income; and 10. Excluding Travel and Commuting Expense Reimbursements from Employees’ Income. (Source: http://www.accountingtoday.com/gallery/Top-10-Payroll-Mistakes-Companies-Make-62641-1.html)