Quick answer: A payroll audit is a structured review of payroll for a period: that the right people were paid the right amounts, that PF, ESI, professional tax, LWF and TDS were deducted and deposited correctly and on time, that payroll agrees with the books, and that controls prevent errors and fraud. The process is: plan the scope, collect records, test samples, reconcile totals, review compliance and controls, report findings, and follow up on corrections.
Monthly checks catch most payroll mistakes before they leave the bank. A payroll audit looks back over a longer period with fresh eyes, testing whether the process actually works and finding the errors, compliance gaps and control weaknesses that routine checks miss. It is also the best rehearsal for an EPFO, ESIC or labour inspection. This guide explains the types of payroll audit in India, who carries them out, a step-by-step process, a detailed checklist, the findings auditors most often report, and how to write up and act on the results. It is part of our payroll compliance guide.
What is a payroll audit?
A payroll audit, also called a salary audit, means checking whether salaries were calculated, paid, recorded and reported correctly. It examines payroll records, calculations, payments and compliance for a chosen period, usually a financial year, and reports on whether they are accurate, lawful and well controlled. It differs from the monthly reconciliation in our payroll reconciliation guide: reconciliation checks that this month's numbers agree; an audit tests a sample of transactions back to source documents and checks the design and operation of the whole process.
Types of payroll audit
| Type | Carried out by | Focus |
|---|---|---|
| Internal payroll audit | Internal audit team or an outside firm engaged by management | Accuracy, controls, efficiency and fraud risk |
| Statutory audit (payroll area) | Company's statutory auditor | Employee benefit expense, provisions and payables in the financial statements |
| Tax audit (payroll items) | Tax auditor, where a tax audit applies | TDS compliance, and timing of PF and ESI deposits for income-tax purposes |
| Labour-law compliance audit | Compliance consultant or internal compliance team | Minimum wages, registers, returns, PF, ESI, PT, LWF, bonus and gratuity |
| Outsourced payroll review | Company, of its payroll vendor | Whether the vendor follows instructions, rules and service levels |
| Inspections | EPFO, ESIC, State and central labour inspectors | Compliance with the relevant law and records |
Who audits payroll?
In practice, payroll is reviewed from several directions. Inside the company, an internal auditor or finance controller runs the payroll audit, often with HR and compliance input. Outside it, the statutory auditor examines payroll as part of the audit of a company's financial statements, the tax auditor reports on payroll-related tax items where a tax audit applies, and consultants carry out labour-law compliance audits. EPFO, ESIC and labour inspectors (inspector-cum-facilitators under the Labour Codes) can examine records during inspections. Whoever does it, the payroll auditor should be independent of the people who run payroll.
How to do a payroll audit: step by step
- Plan: set the period, scope (entities, locations, payroll types), risk areas and sample sizes; agree access to systems and records.
- Understand the process: walk through how inputs reach payroll, how it is processed, reviewed, approved and paid, and who can change what.
- Collect records: employee master, appointment and revision letters, attendance, payroll registers, payslips, bank files and statements, PF ECRs and challans, ESI contribution details, PT and LWF returns, TDS challans and Form 138 returns, the payroll ledger and the payroll policy.
- Reconcile totals: annual payroll register totals with the books, bank payments, PF and ESI filings and Form 138.
- Test samples: pick employees and months, including joiners, leavers, revisions and high earners, and recalculate their pay and deductions from source documents.
- Review compliance: deposit dates and amounts, minimum wages, registers, returns, bonus and gratuity.
- Test controls: approvals, segregation of duties, bank-detail changes, access rights and exception reports.
- Report and follow up: rate each finding, agree actions and dates with management, and check later that they were done.
Payroll audit checklist
Employee master data
- Every employee on payroll exists, has a signed appointment letter and is active in HR records; no duplicates.
- PAN, Aadhaar, UAN, ESI number and bank details are complete and verified.
- Leavers were removed from payroll from their last working day.
Inputs and calculations
- Salary in payroll matches the latest approved letter; revisions and arrears applied from the right date.
- Paid days and loss of pay agree with attendance and approved leave; the divisor follows the payroll policy.
- Pay is not below the applicable minimum wage for the State and skill category.
- Overtime is approved and paid at no less than twice the ordinary rate.
- PF is calculated on wages as defined under the Labour Codes, with the ceiling applied consistently; ESI coverage and contributions are correct.
- Professional tax and LWF follow the State slabs for the employee's place of work.
- TDS follows the employee's regime, declarations and proofs; annual tax agrees with Form 130.
Statutory compliance
- PF and ESI paid by the 15th, TDS by the 7th (30 April for March), PT and LWF by State dates; interest paid on any delay.
- Amounts in ECRs, ESI filings and Form 138 agree with the payroll register.
- Registers under the Labour Codes maintained; annual returns filed where applicable.
- Statutory bonus paid to eligible employees within eight months of the close of the accounting year; gratuity paid within 30 days of becoming payable, with interest if late.
Payments
- Bank payments agree with net pay for each employee; salary paid before the end of the 7th day of the next month.
- No payments to accounts not in the employee's name; changes to bank details verified.
- Off-cycle and manual payments approved and recorded.
Accounting
- Payroll journal agrees with the register; payables clear to nil after payment.
- Provisions for bonus, gratuity and leave are supported by calculations or actuarial reports.
- Salary in the books reconciles with Form 138 and PF records for the year.
Controls and access
- Preparer, reviewer, approver and payer are different people.
- Access to payroll systems and files is limited and reviewed.
- Changes to master data are logged and approved; exception reports are reviewed every month.
The routine monthly version of these checks is in our monthly payroll checklist.
How to choose samples
An audit cannot recheck every payslip, so it tests a sample chosen to cover the risks. A practical approach for a small or mid-sized payroll is:
- All high-risk items: every joiner, leaver, salary revision, off-cycle payment and bank-detail change in the period, or a large share of them if there are many.
- A spread of regular employees: a few employees from each location, department and pay level, across different months.
- Targeted analytics: scans of the full data for duplicates (same bank account or PAN for two employees), pay above approved levels, and net pay above gross.
- Statutory months: all 12 months' PF, ESI, PT and TDS deposit dates and amounts, because these are quick to check in full.
Record how each sample was chosen, so the results can be relied on and repeated next year.
Payroll fraud red flags
- Ghost employees: people on payroll with no attendance, no manager, no PAN or no PF and ESI records.
- Shared bank accounts: two or more employees paid into the same account.
- Unusual pay changes: one-off increases, repeated arrears or overtime with no approval trail.
- Leavers paid after exit, especially when the bank account was changed shortly before.
- Manual payments outside payroll without supporting documents.
Any of these should be investigated, not just corrected.
Auditing an outsourced payroll
When payroll is run by a vendor, the employer remains responsible for paying correctly and depositing statutory dues. The audit should check that the inputs the company sent were complete and approved, that the vendor's outputs (register, payslips, challans) match them, that statutory deposits were made from the company's own registrations on time, and that the vendor's access to employee data is controlled. Ask for copies of challans and acknowledgements, not just the vendor's summary.
Payroll audit for small businesses
A small business does not need a formal audit team. Once a year, the owner or an outside accountant can: list everyone paid in the year and confirm each person worked for the business; recalculate a few months' pay for a handful of employees; check all PF, ESI and TDS payment dates; and confirm salary in the books agrees with the TDS return. This takes a few hours and catches most of the problems a larger audit would find.
Common payroll audit findings
| Finding | Risk | Typical recommendation |
|---|---|---|
| Ex-employees paid after exit | Financial loss; fraud | Exit data to payroll by cut-off; monthly headcount check |
| PF wages below the Labour Codes wage definition (up to the ₹25,000 ceiling) | Short PF; arrears, interest and possible damages | Recalculate and pay; fix the formula |
| Late PF, ESI or TDS deposits | Interest, damages and tax disallowance | Fixed statutory calendar; funding planned before due dates |
| Pay below revised minimum wages | Claims and penalties | Track State revisions (often April and October) |
| Bank details changed without verification | Fraud | Independent verification and change log |
| Same person prepares, approves and pays | Undetected errors and fraud | Segregate duties |
| Payables not reconciled | Misstated books; missed deposits | Monthly reconciliation |
| Registers not maintained | Penalties on inspection | Generate registers from payroll each month |
Our guides to common payroll errors and payroll penalties explain the fixes and consequences in more detail.
Payroll audit report format
- Scope and period: entities, locations, months and payroll types covered.
- Approach: records reviewed, sample sizes and how samples were chosen.
- Summary: overall conclusion and the number of findings by risk rating.
- Detailed findings: for each, the observation, impact (with amounts where possible), root cause, risk rating and recommendation.
- Management response: action agreed, owner and target date.
- Follow-up: status of findings from the previous audit.
Sample payroll audit finding (template)
| Observation | Impact | Root cause | Risk | Recommendation | Owner / date |
|---|---|---|---|---|---|
| 3 leavers paid for one month after exit | ₹1.42 lakh overpaid | Exit data sent after cut-off | High | Exit feed by cut-off; monthly headcount check | HR Head, 31 Dec 2026 |
Use one row per finding, rate each as high, medium or low, and keep the same format every year so progress can be tracked. A complete report with these rows is the payroll audit report; the checklist above can serve as the audit form or template for the fieldwork.
Preparing for an EPFO, ESIC or labour inspection
An internal payroll audit is the best preparation for an inspection. Keep for each month the payroll register, attendance, ECR and PF challans, ESI contribution details and challans, PT and LWF returns, registers under the Labour Codes, and appointment letters. Make sure the figures in each agree. Know who will respond to the inspector, keep a record of what was provided, and correct any gap found in your own audit before an inspector finds it. Official guidance is on the EPFO and ESIC websites, and our statutory registers guide lists the registers to keep.
Learn to audit HR and payroll. The HR Audit Fundamentals course covers how to plan and carry out HR and payroll audits, test compliance and report findings. Test yourself first with the free HR audit quiz.
Frequently asked questions
What is a payroll audit?
A payroll audit is a structured review of a company's payroll records, calculations, payments, statutory compliance and controls for a period, to check that employees were paid correctly, statutory dues were deducted and deposited on time, and payroll is properly recorded in the books.
Who audits payroll in India?
Payroll can be reviewed by an internal auditor or internal audit team, by the statutory auditor as part of the audit of the financial statements, by a tax auditor where a tax audit applies, by an external compliance consultant engaged for a payroll or labour-law audit, and by EPFO, ESIC or labour inspectors during inspections.
Is a payroll audit mandatory in India?
There is no separate law that requires a standalone payroll audit. However, payroll is examined in statutory audits (companies, and other entities required to be audited), in internal audits where they apply, and in tax audits, and employers must keep records ready for EPFO, ESIC and labour inspections. A periodic payroll audit is good practice for any employer.
How often should a payroll audit be done?
Most businesses benefit from a full payroll audit once a year, with quarterly reviews of high-risk areas such as joiners and leavers, bank-detail changes and statutory deposits. Monthly reconciliation and review are separate routine controls, not an audit.
What does a payroll audit report contain?
A payroll audit report usually contains the scope and period, the method and sample sizes, findings with their impact and root cause, risk ratings, recommendations, management's responses and agreed dates for corrective action.
Position as of 15 November 2026. Due dates as they apply to private-sector employers. Audit requirements depend on the type of entity and the laws that apply; this guide does not replace professional audit standards or advice.