The recent interest on the ALGA listserv about payroll check-off audits made me think about a similar audit I was involved in, how that project was handled, and that maybe that experience could help other auditors. Some of the recent listserv information I saw or discussions I had with other auditors revolved around physically handing employees their paychecks. I think this is a case of “that’s the way it’s always been done” for many decades and that we don’t necessarily have to conduct this type of audit work the same way. Opportunities for different methodologies have become available to us with improvements to technology or a different mind set.
A few years ago I was on an audit team conducting an audit of the city’s payroll system and a payroll check-off to determine if there were any payroll “ghosts” was part of the audit plan. We had decided to use a statistically valid sample, rather than a 100 percent review, to determine if (or the likelihood) there were any “ghost” employees in the payroll system. During the planning meeting in which we were trying to come to grips with the logistics of how to pull the paychecks and pass them out to employees in the selected sample, a team member questioned why we even needed the paychecks. They said it seemed that the objective for this part of the audit was to verify that employees existed, not to give them their paychecks. The team member suggested that we only needed to verify the selected employees’ identification through a short interview at their job site. Another team member said that was not how payroll check-off audits should be conducted; this type of audit had to be 100 percent and you had to give employees their checks because that was how they had conducted a similar audit in another organization.
The consensus of the audit team was that the purpose of this part of the audit was not to hand out paychecks, but to determine if employees receiving paychecks actually worked for the city and that we did not need to insert ourselves into the process of distributing paychecks to employees. Not passing out the checks to employees had several benefits for the audit team; we would not have to go through the city’s payroll checks to pull our sample checks, we would not run the risk of losing any checks, and we would not cause any employees to get their checks late. This audit can be found on the Kansas City, Missouri, City Auditor’s website (http://www.kcmo.org/auditor).
A more recent thought I had related to conducting a payroll check-off audit could even further reduce the need to interview employees. If an organization issues identification badges to its employees, auditors could use this data to cross-reference to payroll and personnel data and then conduct further reviews of any resulting anomalies. The rationale behind using this methodology is that a “ghost” employee is not likely to have an employee identification badge because they often do no exist or they do not work for the organization. Obtaining an identification badge for a non-existent employee would be difficult and require the involvement of more individuals.
Data needs:
• A recent payroll listing in an electronic format. The data should at least include employee name and SSN or another unique identifying number that is also used in the HR and badging systems. Other data fields; direct deposit account numbers and address.
• A current employee listing from Human Resources in an electronic format. The data should at least include employee name and SSN or another unique identifying number that is also used in the badging and payroll systems. This data should include all active and inactive employees. Other data fields; address.
• A current ID badge list in an electronic format. The data should at least include employee name and SSN or another unique identifying number that is also used in the HR and payroll systems. This data should include all active and inactive badges.
Audit tests to identify anomalies in the data that could be fraud indicators or data errors:
• Identify duplicate names.
• Identify duplicate addresses.
• Determine if there are any duplicate Social Security Numbers.
• Review the payroll data for multiple Social Security Numbers associated with the same direct deposit account.
• Determine if all employees receiving pay are noted as active employees in the personnel records.
• Identify personnel records listing only a PO Box and no physical address.
• Identify payroll records with few deductions.
• Cross-reference payroll records, personnel records, and identification badge records.
The bottom line is that there may be more efficient and effective methods to conduct a payroll check-off audit and obtain the same level of reasonable assurance that payroll fraud is not occurring.
Douglas Jones is an Internal Auditor with the Aviation Department in Kansas City, Missouri
|
Quarterly Articles