Payroll audit checklist for Philippine companies

A payroll audit checks that the right people were paid the right amounts, with the right deductions, approved by the right people, and that statutory obligations were met. For a large Philippine employer, an internal payroll audit at least once a year, plus monthly spot checks, catches errors and fraud long before an external auditor, a government agency or an employee complaint does.

Use this checklist as a starting point and adapt it to your policies.

1. Employee master data

• Every active employee on the payroll has an approved hiring record, contract and complete 201 file (digital 201 file guide)
• No ghost employees: compare payroll with the HRIS active list, timekeeping records and a sample of physical verification at branches
• Separated employees were removed effective their last day, with no payments after
• Salary rates match the latest approved salary change documents
• Government numbers (SSS, PhilHealth, Pag-IBIG, TIN) are present and valid
• Bank accounts are unique per employee; investigate any account shared by two employees
• Changes to rates and bank details were approved by someone other than the person who entered them

2. Time and attendance

• Paid days and hours match timekeeping records for a sample of employees
• Overtime paid was approved before or promptly after the work, and matches logs
• Leave paid matches approved leave and available balances
• Manual time overrides are approved and explained
• Night differential and holiday premiums follow the rules (overtime, holiday pay)

3. Computation

• Recompute a sample of payslips end to end, including allowances, deductions and net pay
• Daily and hourly rate factors match policy
• De minimis items are within the current ceilings (de minimis guide)
• 13th month pay used basic salary earned during the year
• Final pay for separated employees is complete and was released within 30 days

4. Statutory contributions and tax

• SSS, PhilHealth and Pag-IBIG tables are current and effective-dated
• Employer shares, including SSS EC, were recorded and remitted
• Remittances were paid on time; collect proof of payment for each month
• Monthly withholding tax per payroll registers equals the 1601-C filed
• Year-end annualization was done; refunds released and shortfalls collected
• 2316 and the alphalist reconcile with the monthly returns

5. Approvals and segregation of duties

• Each payroll register was approved by an authorized signatory before release
• The preparer and approver are different people
• People who maintain employee master data cannot approve payroll
• Off-cycle payrolls have documented reasons and approvals

6. Payment and accounting

• Bank file totals equal the approved register's net pay
• No manual edits to bank files after approval
• Payroll journal entries agree with the register; payable accounts clear after remittance
• Unclaimed salaries are tracked and resolved

7. Systems and access

• User access reflects current roles; former employees' accounts are disabled
• Access to salary data is limited by company and branch
• Change logs exist for rates, tables and bank details, and were reviewed
• Backups and record retention meet your policy and legal requirements

Analytics that find problems quickly

Simple data tests over a full year of payroll catch most issues:

• Employees paid with no attendance records
• Duplicate bank accounts, TINs or names with the same birthdate
• Net pay changes above a threshold between cutoffs
• Overtime above a set number of hours per cutoff, by branch
• Payments dated after the separation date

Making audits easier

Audits go faster when payroll, timekeeping and HR records live in connected systems with logs, approvals and role-based access. Cirquolus Payroll works with timekeeping and HRIS, and activity logs help reviewers see who did what. For broader controls, read internal controls and segregation of duties.

Frequently asked questions

How often should payroll be audited?

Run a full internal payroll audit at least annually, with monthly spot checks and variance reviews every cutoff.

What is a ghost employee?

A person on the payroll who does not actually work for the company, often a former employee or a fictitious record. Matching payroll against HR, attendance and bank data detects them.

Who should perform the payroll audit?

Internal audit or a reviewer independent of payroll processing. The payroll team should support the audit but not audit itself.

What documents does a payroll auditor need?

Payroll registers, attendance records, approval records, master data change logs, statutory remittance proofs, BIR returns and bank files.