TESTING THE RELEVANT CONTROLS FOR PAYROLL CYCLE

Auditor’s Documentation of Testing the Design and Implementation (D&I) and/or Operating Effectiveness of
Payroll Controls

Significant accounts affected: Payroll expense, Accrued payroll liabilities, Cash

Assertions addressed: The assertions to be addressed are cutoff, completeness, and occurrence.

Step 1: Perform Audit Walkthroughs

As part of testing the relevant controls, Auditor has to conduct an audit walkthrough of the whole payroll
process, which encompasses the departments of the Human Resource, Payroll department, and the
Cashier/Accounting department.

Specific procedures for the walkthrough involve inquiry, inspection, and observation. Auditor has to
exercise professional skepticism to all information that may lead to mistakes or fraud by askin g “What Can
Go Wrong whether intentionally or by mistake?” Throughout the walkthrough, important questions to be
asked involve (but are not limited to) the following:

a. Is there proper segregation of duties throughout the payroll process (i.e. authorization, processing, and
disbursement)?
Note: If auditor relies on such control, perform observation of the process and inquire regarding the
necessary authority and competence of personnel involved. Matching of documents may also be done
as part of the TOE.

b. How often does the personnel perform the relevant control (e.g. reviews, approvals)?

c. Who are the personnel involved in the following transactions:

i. Update of master files

ii. Records hours worked by employees
iii. Monitors fixed-salary employees
iv. Sorts payroll transactions by employee number
v. Computes for employees’ pay
vi. Reviews the payroll register
vii. Prepares the disbursement voucher
viii. Reviews payroll register and disbursement voucher (Cashier)
ix. Signs the checks
x. Remits to BIR for withholding taxes

d. Based on auditor’s understanding, how did significant changes (e.g. TRAIN law, Board of Directors
revision of rate, etc.) in payroll affect the system or process?
Note: If possible, obtain documents like minutes of board meetings to support claims that changes have
been really made in the payroll system. In case of TRAIN, obtain sample Withholding Taxes on
Compensation Returns filed by the company. Perform a separate Tax Compliance Testing.

e. Who does the bank reconciliation of the payroll check account? How often is it done? Who reviews the
bank reconciliation?
 Note: Auditor may refer to a separate substantive testing of bank reconciliation for cash. Observe a
personnel reperform the reconciliation process and inquire about his/her threshold for investigation,
criteria for evaluating items which do not reconcile, etc.

f. What control does the company use to ensure that payroll transactions are recorded in the proper
period?

g. Where is the location of the important documents or departments processing payroll? Are they
conducive to theft or fraud?

Step 2: Assessing the Design and Implementation (D&I) Effectiveness and Operating Effectiveness of
Relevant Controls

In assessing the design effectiveness, Auditor shall consider whether the relevant controls, if operated by
persons who possess the necessary authority and competence, satisfy the company’s control objective and
can effectively prevent or detect fraud or error leading to a material misstatement.

In assessing the operating effectiveness, Auditor shall determine if controls are operating as designed and if
persons operating them have necessary authority and competence to do so.

In performing the D&I, procedures to be conducted by auditor may include the following:

a. Obtain latest samples of source documents based on the determined relevant controls; assess whether
based on the document, controls have been designed and implemented effectively to attain control
objective
b. Inquire regarding the authority and competence of personnel assigned; inquiry can also be made as to
important considerations by personnel doing the control
c. Observe personnel do the control. If possible, obtain an information regarding recent accounting issues
about payroll and make the personnel reperform the steps on how he/she resolved the issue, utilizing
the relevant control.

If the auditor plans to rely on the controls, a Test of Operating Effectiveness (TOE) shall be done. In TOE,
procedures to be done may include the following:

a. Inquire regarding the control;

b. Observe someone reperform the control;
c. Inspect source documents which are relevant to the control and can be used to assessed its
effectiveness (e.g. matching of documents by looking at amount, looking at signatories, checking the
dates for cutoff, etc.)
d. Re-perform the control which may involve recalculation of net pay, deductions, taxes, no. of hours, etc.

Directional Risk: The directional risk for payroll is understatement. Companies tend to inflate their profits
through understatement of expenses. The completeness assertion can be verified through vouching of
samples.
Fraud risk: Completeness assertion is affected. Obtain master list of employees (active and terminated) to
provide attention to areas which may indicate fraud (e.g. provision for “ghost” employees, fraud by payroll
employee who both processes and disburses payroll). If necessary, perform substantive procedures to
assessed fraud risk.

In assisting the auditor in determining WCGW, risks typically associated with payroll are:

Primary Risks for Payroll:

a. Understatement of payroll
b. Inappropriate parties receive payment
c. Employees receive payments more than the amount they are entitled to.

These risks may primarily arise due to common payroll control deficiencies, which may include:

a. No proper segregation of duties;

b. Appropriate controls are not in place to document the addition and removal of employees;
c. Absence of a control to compare payroll to budget;
d. No proper reviews and approvals of controls

Documented by: Cristopherson A. Perez

References:

Auditing Payroll: The Why and How Guide. (n.d.). Retrieved February 6, 2018 from http://cpa-
scribo.com/auditing-payroll/

Le, Kim. (2016). #24 | Part 8 – Controls Testing, Design Effectiveness and Operating Effectiveness in
Demystifying SOX 404 – Auditing Standard 5. Retrieved February 6, 2018 from
https://www.a2q2.com/blog/sox/part-8-controls-testing-design-effectiveness-and-operating-effectiveness-
demystifying-sox-404-auditing-standard-5/

Payroll Cycle Activities. (n.d.). Retrieved February 6, 2018 from

http://tutor.nmmu.ac.za/norma/FIS2212/Payroll-1.pdf