Payroll is a risky business. Think about it: when you run payroll, you pay out thousands, if not hundreds of thousands, of dollars to your employees. There are lots of payroll laws to follow—and plenty of things that can go wrong during that exchange. And most of us run payroll at least once a month, usually more.
So what are the risks you should be looking out for?
There’s innocent yet costly human error, like missing a deadline or overpaying an employee.
And then there’s fraud, like when hourly employees lie about how many hours they work. Or when your company pays a salary to a ghost employee—an employee who doesn’t exist or who left the company years ago. Or buddy punching, which happens when an employee clocks in a friend who isn’t actually at work that day.
You might think these risks only apply to large companies, but small businesses can be just as susceptible, if not more so.
That’s why payroll risk is such an important piece of a quality payroll management plan.
Here are five internal controls that help mitigate these payroll risks.
1. Check Signing Authority Policy
Implementing a check signing authority policy is one of the simplest ways to prevent fraud or catch it right away. It also helps with things like accidental overpayment and mixed-up paychecks.
So what is it? A check signing authority policy is when an organization requires specific people to approve checks before they’re paid out.
There are two key components of any good check signing authority policy:
- Signature requirements: Authorize certain people in the company to sign checks—and make sure everyone is aware of who they are. Usually, managers and other department and company leaders will have this authority.
- Levels of authorization: Consider requiring multiple people to sign if the check or payment is over a certain amount. For example, Managers A, B, and C can sign checks if they are under $10,000. If the checks are higher than that, Managers A, B, or C and the Chief Financial Officer (CFO) must sign. For checks over $50,000, Managers A, B, or C, the CFO, and the Chief Executive Officer (CEO) have to sign off.
Make sure you document your check signing authority policy and share it with everyone on your payroll team. Each team member should know the process they must follow when it comes to payroll.
2. Secure Payroll Software
If you’re still using Excel or Google Sheets to manage your payroll—or, even worse, paper ledgers—it’s time to launch your payroll into the present. There’s just no good reason to use these outdated technologies for something as complex and sensitive as payroll.
Spreadsheet technology was a game-changer back in the late ‘90s. But it essentially just takes your basic paper spreadsheet and puts it on a screen. Sure, you can create formulas in the cells, but that’s about the extent of the difference.
Here’s why using payroll software is so important.
First, good payroll software services are incredibly secure. They use features like data encryption, cloud-based storage, two-factor authentication, and access controls to keep your information out of the wrong hands.
No security system is 100% failsafe, but payroll software is eons better than Excel—which isn’t designed to protect sensitive information.
Second, payroll software automates a lot of your payroll tasks for you, including making tax payments and creating reports. This saves you a ton of time and reduces the risk of human error.
Yes, you have to pay to use the best payroll software services. But the huge decrease in risk is 100% worth the price.
3. Routine Payroll Reconciliations and Audits
Even though payroll software takes the bulk of payroll tasks off your plate, regular reconciliations and audits are key.
What do those terms mean, exactly?
Payroll reconciliation means making sure the money you’ve set aside for payroll matches the actual amount paid out. It involves comparing your payroll records with bank statements, tax records, and pay stubs to make sure everything matches up.
It’s important to reconcile your payroll after each pay cycle or once a month at the very least. This helps you catch payroll errors or suspicious activity early. This, in turn, decreases your risk of losing tons of time and money trying to fix everything and make it right again.
A payroll audit is like a reconciliation but on a larger scale. During an audit, a third-party auditor comes in and reviews your entire payroll system. They take a close look at all your forms and procedures, from your payroll processes to your employment contracts, to make sure everything lines up.
Think of payroll audits as the IRS coming in to audit your company, only with lower stakes. Your organization, not the IRS, is in control of a payroll audit. You can make any changes necessary to comply with all the relevant laws and regulations.
Imagine how much better it would feel if you get picked for an IRS audit right after doing your own audit and making sure your payroll is crisp and clean. I mean, no one wants to get audited, but that’s definitely the best-case scenario.
You should audit your payroll once a year at least. Twice-yearly or quarterly audits are even better.
4. Separate Duties
When one person is in charge of everything, from calculating payroll to signing off on checks to reconciling payroll, there’s a higher risk of fraud.
That’s why many organizations make sure there’s a clear separation of duties when it comes to payroll processing. One set of employees might be in charge of calculating all the pay and deductions. Or, if you’re using payroll software, making sure everything looks correct before it goes to the check signer.
A different set of people should have the authority to sign and disburse the check. Yet another set of people should be in charge of reconciling the accounts each pay cycle.
Notice I said a set of people should be responsible for each task. This is so that if one person is absent, the other can still perform the necessary payroll duty.
Some smaller businesses may not have enough people to divide responsibilities like this. If this is your scenario, split the duties as best you can and consider getting audits more frequently.
Separating duties doesn’t mean you don’t trust your employees. It just means you acknowledge that sometimes, people may knowingly do the wrong thing. Or they make innocent mistakes that multiple layers of authorization can catch. If that happens, they’ll be relieved there was someone behind them to catch their error before it became a full-blown fire.
5. Encourage Employee Communication
The final ingredient in a payroll risk management plan is solid communication with employees. Make sure that you communicate every payroll policy and role within the company. Better still if you have a knowledge hub where this information is easily searchable and kept updated as policies and laws change.
Employees should also know all the rules and regulations that relate to payroll. Again, you can store these in a knowledge hub where everyone can access them. But make sure you talk to your employees about them, too—even the ones who aren’t involved in the payroll processing cycle.
For example, let’s say your employees have a habit of clocking in before they’re supposed to. To help curb this problem, explain overtime rules to your team. Express why sticking to correct punch-in and punch-out times is important to the company’s finances.
You’ll almost certainly notice an improvement in compliance with this rule. When people understand the reasoning behind policies, they’re more likely to follow them.
You should also let your team know about the latest scams, frauds, and phishing schemes and tell them to alert you immediately if they notice any of them.
By practicing open communication about rules, best practices, and more, you create a culture of compliance and clarity. This can be a powerful safeguard against payroll risks.
