Relevant to Paper FAU and ACCA Qualification Paper F8 (INT) and (UK)
This article focuses on the audit of wages but many of the points made also apply to salaries (the term payroll covers both). The distinction between the two is that wages are normally paid weekly in cash to employees working in departments such as production.
Salaries, on the other hand, are paid monthly to employees normally working in administrative departments, via electronic transfers to their bank accounts. Changes in technology and less reliance on cash have blurred this traditional distinction and many hourly paid employees are now paid via bank transfer. However, in some small companies or in parts of the world where few people have bank accounts, employees are still paid in cash based on hours in attendance or work completed.
COMMON PAYROLL FRAUDS
Even companies that appear to have good internal controls can suffer from instances of fraud. The most common payroll frauds include:
The inclusion of fictitious (ghost) employees on the payroll - this can happen in circumstances where blank clock-cards are kept by factory supervisors who also distribute wage packets to employees. There is also a risk of this type of fraud if staff who update the master file for changes are also involved in the preparation or distribution of wage packets.
Deliberate timing errors - a variation on the above fraud is to include new employees on the payroll before they actually commence work or to leave them on the payroll after they have left.
Requesting a cheque for net wages in excess of the required amount. This type of fraud is generally easier to perpetrate in manual wages systems. Alternatively, if employees are paid by bank transfer a lack of controls could provide staff with the opportunity to make changes to the list before it is sent to the bank.
Payment of unauthorised/invalid overtime - this can happen in circumstances where the authorisation of overtime is not properly controlled or details of overtime input during the preparation of the payroll are not independently reconciled to authorised totals for the week.
The common feature that often facilitates these frauds is inadequate segregation of duties. Frauds can be difficult to prevent where there is collusion among staff. Historically organisations have lost significant sums when large numbers of staff came to expect the routine inclusion of unauthorised overtime in their pay.
AUDIT WORK ON WAGES
Most of the audit work on the wages system should be performed during the interim audit but some substantive procedures to confirm payroll costs and wage accruals should normally form part of the final audit.
Interim audit work on wages should involve the normal stages of recording, *uating and testing internal controls.
WAGES CONTROL OBJECTIVES
Typical control objectives for wages include the following:
1. To ensure that employees are only paid for work done.
2. To ensure that wages are only paid to valid employees.
3. To ensure that all wages are authorised
4. To ensure that wages are paid at the correct rates of pay
5. To ensure that wages are correctly calculated.
6. To ensure all wages transactions are correctly recorded in the books of account.
7. To ensure that all payroll deductions are paid over to appropriate third parties (for example, tax authorities)
EVALUATION OF THE INTERNAL CONTROL SYSTEM
The *uation should be performed by considering if controls exist to ensure specified control objectives are met.
Auditors often complete questionnaires to assist in system *uation. Internal Control Questionnaires (ICQs) ask specific questions about controls relevant to each control objective. The alternative is an Internal Control Evaluation Questionnaire (ICEQs), sometimes referred to as key or control questions which focus on risks rather than objectives. They cover the same areas as control objectives and typical examples include:
· Can employees be paid for work not done?
· Can wages be paid to fictitious employees?
· Can unauthorised wages be paid?
· Can errors occur in wage calculations?
· Can wage costs be incorrectly recorded?
If the *uation indicates that controls exist a test of controls (compliance test) will be performed but if controls are weak or absent then a substantive procedure will be appropriate, to determine if material misstatement has occurred.