Payroll audit checklist: tests, reports and employee files to pull

By Arthur Teboul, DokuTrak · Published

In brief

A payroll audit checklist sets out the tests that prove each paycheck went to a real employee, at the right rate, with the right taxes, and that the returns match the registers. Pull the reports and employee files first, then run each test on a sample and log every exception.

Request these documents with DokuTrak14-day free trial, no card. Add one only to keep going.

The checklist: Payroll audit checklist

Send the second group to the client or provider as one request. Run the tests on the sample, then record each exception with its fix and owner.

Scope

  • Audit period, entities, states and pay groups written down
  • Preparer and reviewer named
  • Sample chosen from the registerAll hires and terminations, plus a random set.

Request from the client or payroll provider

  • Payroll registers for every pay dateExported from the provider for the full period.
  • Employee master file and change logRates, bank accounts, addresses, status changes.
  • Forms 941, Form 940 and state returns for the period
  • Forms W-2 and W-3 for the year audited
  • EFTPS deposit confirmations and tax notices
  • Timesheets for sampled hourly employees
  • Pay statements for the sampled checks
  • Payroll bank account statementsEvery month in the period.

Employee file tests, per sampled employee

  • Signed Form W-4 on file
  • Form I-9 completed and kept for the required period
  • Social Security number matches the W-4, the payroll record and the W-2
  • Exempt roles: salary basis and duties documented
  • Signed rate letter matches the register rate
  • Direct deposit form matches the account paid

Payroll tests

  • Roster test: no one paid after termination
  • Duplicate test: bank accounts, addresses, SSNs
  • Hours test: paid hours equal timesheet hours
  • Overtime recomputed by workweek
  • Withholding consistent with each W-4
  • Social security stopped at the wage base
  • Minimum wage: regular pay divided by hours meets the highest applicable rate
  • Voluntary deductions remittedRetirement plan deferrals, garnishments and benefit premiums match the register.
  • Each deposit made by its due date

Tie-outs and exceptions

  • Each Form 941 equals the quarter’s registers
  • Form W-3 agrees with the four Forms 941Any difference reconciled and documented.
  • Form 940 FUTA wages compared with state unemployment wages
  • Payroll expense and liabilities in the books equal the registers
  • Exceptions logged with dollar effect, fix and ownerForm W-2c or Form 941-X where a filing changes.

What an internal payroll audit tests

Here, a payroll audit is a review that tests payroll records against the documents behind them: the employee file, the timesheet, the tax return and the bank. It is not the external audit of financial statements. It is the check a bookkeeper, controller or HR lead runs on the client’s own payroll.

The classic finding is a ghost employee: a ghost employee is a name on the register with no real worker behind it, often a former employee left active. Finding one takes a roster test, not a spot check of totals.

TestWhat you compareWhat a failure looks like
RosterRegister names against the HR roster and termination datesSomeone paid after leaving, or paid with no hire record
DuplicatesBank accounts, addresses and SSNs across employeesTwo employees sharing one deposit account
RateRegister rate against the signed rate letterA raise in the system with no paper behind it
HoursHours paid against signed-off timesheetsOvertime paid but not worked, or worked but not paid
WithholdingFederal withholding against the Form W-4 on fileWithholding with no W-4, or from an outdated one
ReturnsRegisters against Forms 941 and W-3Wages on the return that no register supports

Reports and files to pull before testing

Ask for everything at once, at the start. An audit waiting on one export from the payroll provider can sit for weeks.

Set how far back you look by the retention rules. The IRS asks employers to keep employment tax records for at least 4 years (IRS Publication 15 (2026), Circular E, Employer’s Tax Guide), and wage and hour payroll records must be kept for at least three years (U.S. Department of Labor, Fact Sheet #21: Recordkeeping Requirements under the FLSA).

  • Payroll registers for every pay date in the audit period.
  • Employee master file export and the change log from the payroll software.
  • Forms 941 for each quarter, Form 940, Forms W-2 and W-3.
  • State withholding and unemployment returns.
  • EFTPS deposit confirmations and any IRS or state notices.
  • Timesheets or time-clock reports for the hourly staff in your sample.
  • Payroll bank account statements, to match net pay to real transfers.

Test a sample of employee files

Pick the sample from the register, not from the HR folders, so a person who exists only in payroll can be drawn. Include every new hire and every termination in the period, plus a random set of the rest.

For each person, look for a signed Form W-4, a completed Form I-9, the signed rate letter and the direct deposit form. The I-9 has its own retention clock: three years after hire or one year after employment ends, whichever is later (USCIS, Handbook for Employers M-274, 10.0 Retaining Form I-9).

For hourly staff, check that the records the FLSA lists are there, such as hours worked each day, total hours each workweek and the regular hourly rate (U.S. Department of Labor, Fact Sheet #21: Recordkeeping Requirements under the FLSA).

Hours, overtime and withholding tests

Recompute overtime for the sample. Non-exempt employees earn at least one and one-half times the regular rate for hours past 40 in a workweek (U.S. Department of Labor, Wage and Hour Division: Overtime Pay). A workweek that splits across two pay periods is where the math usually breaks.

Then test the taxes. For 2026, social security tax is 6.2% each for employer and employee, up to a wage base of $184,500, while Medicare has no wage limit (IRS Publication 15 (2026), Circular E, Employer’s Tax Guide). Any employee with year-to-date wages above the base should show no further social security withholding.

Next, test pay against the floors. Regular pay divided by hours worked should reach the higher of the federal minimum wage of $7.25 an hour and the state or local rate (U.S. Department of Labor, Wage and Hour Division: Minimum Wage). For each exempt role, check that the file documents the salary basis and the duties, since a salary alone does not remove the overtime duty.

Then test the deductions taken from pay, such as retirement plan deferrals, wage garnishments and benefit premiums. Each one withheld on the register should match what was sent to the plan, the court-ordered payee or the insurer, for the same pay dates.

Last, test the deposits. A shortfall escapes penalty only when it is no more than the greater of $100 or 2% of the required deposit and is made up by the makeup date (IRS Publication 15 (2026), Circular E, Employer’s Tax Guide).

  1. Recompute gross pay from rate and hours for each sampled check.
  2. Recompute overtime by workweek, not by pay period.
  3. Check federal withholding against the W-4 on file for that date.
  4. Confirm social security stopped at the wage base for high earners.
  5. Check hourly pay against the federal, state and local minimum wage.
  6. Tie each voluntary deduction to the payment sent to the plan or payee.
  7. Match each deposit date to its schedule deadline.

Tie the registers to the returns and the books

The IRS instructions say the amounts on Forms 941 should agree with Form W-3, and that differences can lead the IRS and the SSA to contact the employer (IRS, General Instructions for Forms W-2 and W-3 (2026)). So the year test is that Form W-3 agrees with the four quarterly returns, and any difference is reconciled and documented.

In the books, payroll expense should equal gross wages plus the employer taxes from the registers. Payroll liability accounts should hold only what is still owed at the cut-off date, such as a deposit due next week.

Contractors paid through accounts payable are worth a look too. The IRS weighs behavioral control, financial control and the type of relationship to tell an employee from a contractor (IRS, Independent contractor (self-employed) or employee?).

Log the exceptions and the fixes

In this log, an exception is any test result you cannot explain from the documents. Record it with the employee, the pay date, the dollar effect and who owns the fix.

Some fixes need a corrected filing, such as Form W-2c for an employee’s wages or Form 941-X for a quarter (IRS, General Instructions for Forms W-2 and W-3 (2026)). Others need only a document, such as a missing W-4 the employee signs now. The payroll checklist lists the rules each test checks.

Questions people ask

What is a payroll audit?

It is a review that tests payroll records against their support: the roster, rates, hours, tax withholding, deposits and returns. An internal one is run by the bookkeeper, controller or HR, separate from any audit of the financial statements.

Which reports do I need for a payroll audit?

You need the payroll registers for the period, the employee master file and change log, the quarterly and annual tax returns, the deposit confirmations, timesheets for hourly staff and the payroll bank statements.

How do I spot a ghost employee?

Match every name on the register to the HR roster and to a hire date. Then look for shared bank accounts or addresses, and for employees with pay but no timesheets, no deductions and no W-4.

How often should payroll be audited?

Pick a rhythm that fits the risk. A small client can be tested once a year before Forms W-2 go out. A client with many hourly staff or frequent changes benefits from a lighter check each quarter.

Sources

About the author

Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. Arthur Teboul.

Editorial standards

How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? Contact us.

Ask once. DokuTrak does the chasing.

  • Your client uploads from one link, with no account and no password.
  • Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives.
  • With AI review switched on in your workspace (it is off by default), each upload gets a first pass that flags a file that is not the requested document or an unreadable or blurry scan. It says so when it is not sure.
  • You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file.
Request these documents with DokuTrak14-day free trial, no card. Add one only to keep going.