Ghost Employees – The Importance of Internal Controls in Payroll Processing

The Association of Certified Fraud Examiners (ACFE) reports that payroll fraud schemes account for some of the most frequent occupational fraud—contributing to the estimated 5% of annual revenue lost to fraud across organizations worldwide. Schemes, such as ghost employees, falsified hours and inflated salaries, are more common than many employers care to admit. Businesses with limited internal controls and resources are often more vulnerable to these types of fraud, too.

Take this example:

As is the case with most organizations, the payroll manager of a particular company was responsible for updating the payroll system, processing payments and ensuring everyone got paid on time. A few situations within the company overwhelmed the human resources department, so to help alleviate some of the burden, the payroll manager took on the responsibility of adding new employees to the HR system. The company was aggressively growing, and this streamlined the process of adding employees to the HR system and payroll, making sure they got paid correctly.

Months later, the payroll manager made a mistake entering a new employee’s bank information into the payroll system. The impacted employee raised the concern when they were not paid on the first pay period, and this simple mistake was easily remedied. No one within the company knew or ever found out about the mistake, except for the employee and the payroll manager.

The next mistake happened a few weeks later. The payroll manager misspelled a new employee’s name when entering it into the payroll system, transposing two letters. The employee noticed the error on his paystub and alerted the payroll manager. Another simple oversight that was easily resolved and, as was the case before, no one knew or ever found out about the mistake.

However, the payroll manager’s third incident wasn’t a mistake. They set up a fictitious employee with a direct deposit into a bank account controlled by the payroll manager. Much like the previous examples, no one knew or ever found out about it. And after 16 months, the fictitious employee was terminated. Another month later, the payroll manager retired.

***

Organizations of all sizes make similar decisions in order to streamline processes, placing trust in a singular employee to maintain full control and oversight of several functions. Ignoring the risks associated with poorly controlled procedures can be damaging—or even catastrophic—to a company. Key internal controls in payroll processing help ensure that payroll transactions are accurate, authorized, and compliant with laws and regulations. They also safeguard company resources and prevent fraud or errors.

Segregation of Duties

In the case above, the organization needed to implement internal controls on segregation of duties. The payroll manager was given too much responsibility and authority with little oversight. The important tasks of payroll preparation, authorization and payment processes must be handled by different individuals. Realize that the person responsible for inputting payroll data should not be able to approve payments—and they certainly shouldn’t also be permitted to add new employees to the HR system.

How Better Segregation of Duties Prevents Incidents of Fraud

The HR function of a business should be responsible for adding new employees to the payroll system, while payroll staff should only process payments for approved employees. Organizations should implement a step in which management or an independent reviewer approves payroll reports and investigate exceptions, such as payments to recently added employees. Lastly, bank account reconciliations should be performed by someone outside of the payroll department to ensure payments align with authorized payroll registers.

Internal Controls in Payroll Processing

Internal controls are part of any good checks and balances system in an organization and implementing them within the payroll process is just as important as any other area of the business. Internal controls safeguard assets by preventing fraudulent activities, such as embezzlement, misappropriation of assets or manipulation of financial records. Internal controls are indispensable for good corporate governance and management oversight, as they protect against theft, damage, mistakes or misuse.

Next Steps

An independent assessment of the internal control environment provides assurance that significant risks within a company are addressed and mitigated. At Sikich, our Internal Controls Assessment (ICA) evaluates the design of internal controls over your financial reporting cycles, information technology and other management functions. If your organization requires assistance with conducting an internal controls assessment, the team at Sikich specializes in providing tailored support to meet your needs. This small investment in prevention will provide the assurance that your organization isn’t losing 5% of its revenue to payroll fraud or errors.