Auditing payroll bank account activity means proving that every debit belongs to an approved pay run and reached the right person. Tie each direct deposit batch, manual check and tax payment to the payroll register, test changes to employees' bank details, search for anyone paid twice, and question off-cycle checks. Then explain any balance left behind.
Tying payroll bank account debits to the payroll register
Every debit in a payroll bank account should trace to a line in a payroll register: the report the payroll system produces for each pay run, listing gross pay, deductions and net pay per employee. The tie-out compares register totals with the bank lines, pay run by pay run. A debit that matches no register comes first.
A typical pay run produces several bank lines, not one. The direct deposit batch leaves as a single ACH debit. Manual or live checks clear one at a time over the following days. Tax deposits go separately, and some providers debit their fee on its own line. So the tie-out works from the register outward: split net pay into its payment methods, then find each piece on the statement.
The table below ties one example pay run. All values are made up for illustration.
| Item | Register | Bank line | Bank date | Difference |
|---|---|---|---|---|
| Funding transfer in from operating account | 82,275.70 | Mar 13 | ||
| Direct deposit batch, 46 employees | 58,910.40 | 58,910.40 | Mar 14 | 0.00 |
| Manual check 2201, final pay | 1,480.00 | 1,480.00 | Mar 18 | 0.00 |
| Manual check 2202, correction | 840.00 | 840.00 | Mar 22 | 0.00 |
| Net pay subtotal | 61,230.40 | 61,230.40 | 0.00 | |
| Federal tax deposit, withholding and both shares of FICA | 21,045.30 | 21,045.30 | Mar 19 | 0.00 |
| Total debits for the pay run | 82,275.70 | 82,275.70 | 0.00 |
Example values only. A real tie-out adds the pay date, the register reference and the preparer's initials.
Run this for every pay run in the period if the population is small, or for a sample if it is not. Then do the reverse: list every debit on the payroll account statements and confirm each one was ticked to a register. Debits that were never ticked are the unexplained items, and payroll accounts should have very few.
The register itself needs testing, too. Agree register totals to the general ledger payroll expense and to the quarterly returns. A register that ties to the bank but not to the ledger points to a posting error, while one that ties to neither is a register you should not rely on.
How do you test direct deposit changes for payroll fraud?
Test direct deposit changes by pulling the system's change log for employee bank details over the period and checking each change against a request from the employee. A change made without a request, made by payroll staff to their own account, or reversed soon after a single pay date is the pattern of diversion fraud.
What to pull
Ask for a report of every change to employee bank account fields, with the date, the user who made the change and the old and new values. Most payroll systems can produce one. If the system cannot, that is a control weakness to report on its own.
What to compare
For each change in your sample:
- Find the employee's request, in writing or through a self-service portal.
- Confirm the request was verified with the employee through a known channel, not just the email that asked for the change.
- Check that the new account is not already used by another employee.
- Look for changes that were reversed after one or two pay runs.
- Compare the new account details with the bank details of payroll and HR staff.
The fourth item is the one most often missed. A fraudster who redirects one pay date and switches the details back leaves a single unusual payment and a quiet log entry. The employee who missed a paycheck may have complained to HR, so ask whether any pay-related complaints came in during the year.
Finding duplicate pay in the payroll bank account
Duplicate pay is the same person, or the same bank account, receiving pay twice for the same period. It arises from a pay run processed twice, a manual check issued for pay that also went by direct deposit, or a ghost employee sharing an account with a real one. Matching on account number, amount and period finds most cases.
Three matching rules cover the common causes:
- Same receiving account, same pay period, more than one payment. Catches a manual check plus a direct deposit, and two employee records pointing to one account.
- Same employee, same gross amount, two pay runs a few days apart. Catches a batch that was resubmitted.
- Two employees with different names and the same bank account or address. Catches shared accounts, which are sometimes innocent, such as spouses, and sometimes a ghost.
Expect some false positives and clear them with evidence rather than judgment. A bonus paid on the same day as regular salary produces two payments to one account in one period, and so does an expense reimbursement run through payroll. Each should have its own approval and its own line in the register. Keep the cleared items in the workpaper with the reason, so the next year's test can skip them quickly.
These tests need the direct deposit detail file, not just the bank statement, because the bank shows only the batch total. Ask for the file the payroll system sends to the bank for each run. The post on audit data analytics for bank transactions covers running matching tests like these over a full year of data.
Manual payroll checks that need investigation
Manual payroll checks are those written outside the regular run: final pay, corrections, advances and bonuses. Most are legitimate, but they bypass some of the controls that apply to the normal run. Investigate checks to people not on the register, checks endorsed to a third party, checks with no approval and checks that clear long after their date.
Pull the cleared check images for a sample of manual checks. Look at the payee, the endorsement and where it was deposited. A payroll check endorsed by someone other than the payee, or deposited to the same account as another employee's check, is a strong lead.
Also look at timing and sequence. Manual checks clustered just before a payroll manager's holiday, issued out of number order, or voided and reissued for the same amount deserve questions. Compare manual check numbers on the statement with the check register to find gaps; a missing number in the sequence should be a voided check with the void in hand.
Payroll tax debits in the payroll bank account
Payroll tax debits should equal the tax liabilities in the register for the same period. The IRS guide to depositing and reporting employment taxes states that federal tax deposits must be made by electronic funds transfer, on a monthly or semiweekly schedule, and that withholding is reported on Form 941 each quarter.
That gives three sources to tie. The register shows the tax withheld and the employer share for each pay run. The bank statement shows the deposits. The quarterly return shows the totals reported. All three should agree for each quarter, allowing for deposits that fall just after a quarter end.
When a payroll provider handles taxes, the bank usually shows one debit by the provider covering net pay, taxes and fees, or a separate tax debit by the provider rather than a direct government payment. In that case the provider's tax filing reports are your evidence that the money reached the authorities. A provider that collects tax money from the account but cannot produce proof of payment is a serious finding.
Why does an imprest payroll account balance drift from zero?
An imprest payroll account is funded with exactly the amount each pay run needs, so after all checks clear its balance should return to zero or to a small fixed float. A balance that drifts means something was funded and not paid out, paid out and not funded, or recorded in the wrong account.
Common, harmless causes:
- Outstanding checks. Manual checks not yet cashed keep money in the account. List them on the reconciliation.
- Bank fees. Small monthly fees build up if nobody tops them up.
- Timing of funding. A transfer that arrives the day before the pay run creates a balance at month end that clears the next morning.
Causes that need follow-up:
- Old uncashed checks. Checks months old should be investigated and, if never claimed, may become unclaimed property.
- Returned direct deposits. A deposit to a closed account comes back to the payroll account. If it is not reissued to the employee, find out where it went next.
- Shared payroll accounts across entities. When one account pays staff for several companies in a group, each entity's funding must match its own register. The intercompany reconciliation template shows how to keep those balances in agreement.
Reconcile the payroll account every month like any other account; the audit procedures for bank reconciliation apply in full. For grant-funded staff at nonprofits, also check that payroll charged to each grant agrees with the hours and pay actually disbursed, as covered in the nonprofit cash audit.
Matching a year of payroll statements against registers is repetitive work. PreciseBankFlow is built to extract every statement line, foot each statement and flag possible duplicates, so the tie-out starts from a complete list of debits.