Skip to content

Internal and Forensic Audit · Internal Audit of Specific Functions

Internal Audit of Human Resources and Payroll

Updated 11 October 2026 · Fact-checked

Internal audit of HR and payroll checks that people are hired, recorded, paid and benefited as per policy and law. You identify risks, test controls over recruitment, employee master data, payroll processing, statutory compliance and benefits, then report gaps with recommendations.

Understand Internal Audit of Human Resources and Payroll

The HR function brings people into the company, records their details, pays them and manages their benefits. Payroll is usually one of the largest costs in a company. It is also an easy place for fraud and error, because it runs every month on stored data.

Internal audit of HR and payroll asks one question: are the controls enough to make sure that only real employees are hired properly, paid correctly and on time, and that all deductions and dues reach the right authorities? You look at the whole cycle, not just the salary sheet.

The main areas are:
- Recruitment and onboarding: approved manpower plan, selection process, offer letters, verification of documents and background, signed appointment terms.
- Employee records: the personnel file and the employee master data in the payroll system. Changes must be authorised and traceable.
- Payroll processing: attendance and leave inputs, salary computation, approval, bank payment and accounting entries.
- Statutory compliance: provident fund, ESI, TDS on salaries, professional tax, bonus, gratuity and labour law returns, paid and filed on time.
- Employee benefits: reimbursements, loans and advances, leave encashment, gratuity and exit settlement.

The typical risks are ghost employees (people paid who do not work), unauthorised changes to pay, wrong deductions, delayed or missed statutory payments, and benefits paid without approval. Good control rests on segregation of duties: the person who hires should not approve pay, and the person who prepares payroll should not release payment.

For statutory points, follow the law currently in force. Labour law has been consolidated into the labour codes, so check the current code provisions and rates in your study material instead of quoting old Act details from memory.

Key rules to remember

Payroll reconciliation
Gross salary − Statutory deductions − Other deductions = Net pay
Net pay as per payroll must agree with the bank payment file and the salary payable in the books.
Headcount reconciliation
Opening headcount + Joiners − Leavers = Closing headcount
Closing headcount must match payroll employee count. A difference points to ghost employees or missed exits.
Payroll cost reconciliation
Payroll register total = Salary expense booked + Related accruals
Differences between register and ledger need explanation.
Segregation of duties rule
Hiring ≠ Master data change ≠ Payroll approval ≠ Payment release
These duties should sit with different people or approval levels.

How to solve Internal Audit of Human Resources and Payroll questions

Use this order for any question on auditing HR or payroll. It gives you a structured answer even when the facts are unfamiliar.

  1. 1Read the facts and note the area in question: recruitment, records, payroll, statutory compliance or benefits.
  2. 2State the objective of the audit for that area in one line, such as ensuring only valid employees are paid correctly.
  3. 3List the key risks from the facts, for example ghost employees, unauthorised changes, late deposits.
  4. 4Name the controls expected, including approvals, segregation of duties, system access and reconciliations.
  5. 5Set out the audit procedures: documents to inspect, data to compare, samples to test and persons to enquire from.
  6. 6Apply them to the facts and point out the gap or non-compliance.
  7. 7Conclude with the finding, its impact and a practical recommendation.
  8. 8Mention reporting to management or the audit committee if the issue is serious.

Quickest way: Risk-Control-Test-Recommend

When to use it: Use it when time is short or the question says 'list the audit checks' or 'prepare a checklist'.

  1. Write the five areas as headings: recruitment, records, payroll, statutory, benefits.
  2. Under each, give two risks and two tests.
  3. Always include three core tests: headcount reconciliation, master data change review and statutory payment versus payroll deduction check.
  4. Close with a one-line recommendation on segregation of duties and system access.

Common mistakes in Internal Audit of Human Resources and Payroll

  • Treating payroll audit as only a recalculation of salaries.

    Students focus on arithmetic because it feels concrete.

    Fix: Cover the full cycle: hiring, master data, inputs, processing, payment, statutory dues and exit.

  • Ignoring employee master data changes.

    The master file looks like a static record.

    Fix: Test that changes in pay, bank account and status are authorised, documented and reviewed through a change log.

  • Quoting old labour law names and rates as current.

    Older notes still circulate.

    Fix: Describe obligations in plain words and follow the law currently in force as given in your study material.

  • Listing procedures without linking them to risks.

    Students memorise checklists.

    Fix: For each test, say which risk it addresses, such as ghost employees or late deposit.

  • Forgetting segregation of duties and system access.

    It seems theoretical.

    Fix: Always state who should do what and test user access rights in the payroll system.

  • Ending without a recommendation.

    Time runs out after the procedures.

    Fix: Reserve the last two lines for finding, impact and action.

Worked examples

Example 1

Opening headcount of Sundaram Textiles Ltd was 480. During the year 60 employees joined and 45 left. The payroll for March shows 500 employees paid. As internal auditor, what do you conclude and what will you do?

Show the solution
  1. Closing headcount = 480 + 60 − 45 = 495.
  2. Payroll count is 500, so 5 employees are paid without being in HR records.
  3. This is a risk of ghost employees or leavers not removed from payroll.
  4. Obtain the list of the 5 extra names and compare it with HR records, attendance and appointment or exit documents.
  5. Check the bank account details and whether salary was credited to accounts that are duplicate or unusual.
  6. Review who changed the employee status in the system and whether it was approved.
  7. Recommend removing invalid records, recovering any wrong payment and requiring HR exit intimation before payroll closes.

Answer: Closing headcount should be 495. The excess of 5 in payroll is an exception to be investigated as possible ghost employees or missed exits, and controls over exit intimation and master data changes should be tightened.

Example 2

Draft the audit programme for statutory compliance in payroll of a company, Bharat Components Pvt Ltd.

Show the solution
  1. Objective: confirm that deductions and employer contributions are computed correctly, paid on time and returns are filed.
  2. Obtain the payroll register and statutory payment challans for the period.
  3. Compare amounts deducted in payroll for provident fund, ESI, professional tax and TDS on salaries with the amounts deposited.
  4. Check the dates of deposit and filing against due dates, and note delays, interest or penalty.
  5. Test a sample of employees for correct coverage and computation, including new joiners and leavers.
  6. Verify that TDS on salary is based on declarations and proper computation, and that certificates are issued.
  7. Check bonus, gratuity and other applicable dues are provided for and paid as the law in force requires.
  8. Report non-compliance with its financial exposure and recommend a compliance calendar and review by a senior person.

Answer: The programme compares payroll deductions with deposits, verifies timeliness and returns, tests a sample for correct computation, checks other dues and ends with a report and a compliance calendar recommendation.

Exam tips

  • Answers are written and case-based, so structure them as risk, control, test and recommendation.
  • Use the facts given, such as names, numbers and dates, in your answer instead of generic points.
  • If asked for a checklist, write short action phrases like 'verify', 'reconcile', 'compare' and 'inspect'.
  • Do not state specific rates or due dates unless you are sure they are current. Describe the obligation in words.
  • Always mention segregation of duties and access control in payroll answers.

Practice questions from Internal Audit of Specific Functions

Internal Audit of Human Resources and Payroll in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit of Human Resources and Payroll: frequently asked questions

What is covered in internal audit of HR and payroll?

It covers recruitment, employee records, payroll processing, statutory compliances and employee benefits. The aim is to confirm that controls work and the company follows its policies and the law.

What are the main risks in payroll?

The main risks are ghost employees, unauthorised pay changes, wrong calculations, delayed statutory payments and benefits paid without approval. Weak segregation of duties increases all of these.

How do I check payroll statutory compliance?

Compare deductions in the payroll register with the amounts deposited and returns filed. Check timing against due dates and test a sample of employees for correct computation.

Is a payroll checklist enough for the exam?

A checklist helps, but you should link each check to a risk and finish with a finding and recommendation. That is how case-based answers earn marks.