RISKS AND CONTROLS IN THE PAYROLL PROCESSES (STUDY OBJECTIVE 3)
Because payroll usually involves large sums of cash, it is especially important that sufficient internal controls are included in the related business processes. In terms of the five internal control activities introduced in Chapter 3, following are some procedures to be considered for implementation in this process.
AUTHORIZATION OF TRANSACTIONS
Management plays an especially important role in carrying out payroll transactions correctly. If management takes its responsibilities seriously by carefully reviewing the payroll documents, then most employee errors and fraud should be prevented. Departmental supervisors must be certain that all time sheets represent actual time worked by currently active employees. The supervisors are expected to be familiar enough with their respective departments that they will recognize unusual data. In particular, they should be on the lookout for fraud schemes such as overstated hours (including unapproved overtime) and time sheets or paychecks of former employees who are no longer entitled to receive compensation.
In addition to the authorization procedures covering time reports, employee personnel files should contain evidence of proper authorization for various payroll amounts. Included in the files should be approval for pay rate adjustments, hiring, promotion, and termination (authorized by management), as well as approval for all deductions (authorized by individual employees).
Like the cash disbursements discussed in Chapter 9, payroll disbursements should be authorized by the accounts payable department on the basis of the company's need to satisfy its obligation to its employees. In addition, designated members of management should be given authority for the approval of the paychecks, noted by their signatures on the faces of the checks. The bank will keep records of those members of management with authority to sign checks drawn on the payroll account, and it should not pay a check that does not include such a designated signature.
SEGREGATION OF DUTIES
The goal of segregation of duties within the payroll process is to prevent the preparation and payment of a fraudulent or erroneous paycheck. In order to accomplish this, certain payroll accounting functions such as authorizing, timekeeping, record keeping, and custody of the paychecks should all be separated. Namely, the human resources department, which is responsible for authorizing new employee hiring and maintaining personnel files, should be separate from the payroll time-reporting and record-keeping functions, performed primarily by the payroll, cash disbursements, and general ledger departments. In addition, employees in each of these departments should not have check-signing authority and should not have access to the signed checks or cash account. The person who distributes paychecks to employees, often referred to as a paymaster, should not have responsibility for any of the related payroll accounting functions and should not have custody of cash. The paymaster should also be independent of the departmental supervision responsibilities, so that a determination can be made that paychecks are being distributed to active employees. Finally, information systems operations and programming related to the payroll processing should be separate from custody of payroll cash and record keeping for these processes.
ADEQUATE RECORDS AND DOCUMENTS
Personnel files and the payroll register are the fundamental records in the payroll process. In addition, there are numerous forms and reports that are required to be filed at designated times throughout the year. These documents must be filed with various taxing authorities and other organizations to summarize and remit amounts withheld from employees' paychecks. Due to the number of inputs required for accurate payroll processing and reporting, the care with which these records are prepared and maintained is crucial to the internal control environment.
The practice of issuing paychecks on prenumbered checks from a separate bank account is another control that helps to create clear records of the payroll transactions. When checks are issued numerically, a sequence can be verified to determine whether all payroll transactions have been recorded. A separate bank account clarifies the accounting process by isolating the payroll transactions in their own account. This makes it easier and quicker to reconcile the account and to identify any unusual transactions that may require investigation.
SECURITY OF ASSETS AND DOCUMENTS
Payroll information is very sensitive. Because it includes personal information about employees, their pay, and their performance, it must be kept confidential. Accordingly, access to personnel files and payroll records should be limited to designated persons within the human resource and payroll departments. Electronic controls and physical controls should be in place to ensure the confidentiality of payroll information.
Similarly, access to payroll cash should be limited to the authorized paycheck signers. Blank payroll checks should be protected by the use of physical controls so that no one has an opportunity to create a fake paycheck. Similarly, any unclaimed paychecks should not be maintained by employees working in human resources or payroll functions, so that they do not have an opportunity to alter the records and cash the checks for their personal use.
INDEPENDENT CHECKS AND RECONCILIATION
There are several payroll-related reconciliation procedures that should be performed regularly. For example, the number of hours reported on time sheets should be reconciled to the payroll register, and time sheets may be reconciled with production reports. Each of these reconciliations should be performed before paychecks are signed in order to ensure the accuracy of the underlying payroll information. In addition, the payroll register should be reconciled to the general ledger on a regular basis. Moreover, someone separate from the payroll processing functions should reconcile the bank statement for the payroll cash account on a monthly basis. This bank reconciliation should follow the same procedures as required for the company's general checking account, as discussed in the cash disbursements section of Chapter 9.
Exhibit 10-7 Payroll Controls and Risks
COST–BENEFIT CONSIDERATIONS
The more employees a company has and the more frequently it pays its employees, the more important it becomes to implement strong internal controls surrounding these processes. Other conditions that may warrant the need for strong controls include the existence of irregular pay schedules, complex with-holding arrangements, frequent changes in pay rates, and a decentralized payroll function. Many companies implement thorough controls covering the payroll processes because of the confidential nature of the underlying data. In order to protect the privacy of its employees and promote high morale, a company may choose to incur significant costs related to its efforts to protect the accuracy and security of payroll records.
Exhibit 10-7 summarizes examples of internal controls in the payroll process and the related business risks that are minimized as a result of the implementation of these controls. This exhibit does not include all the possible controls and risks that may be encountered in the payroll process, but provides some common situations.