Question

Control Enviroment

1 Are all employees paid by check or direct deposit?
2 Is a special payroll bank account used?
3: Are payroll checks signed by persons who do not prepare check?? or keep cash funds or accounting
records?
4 lfa check-signing machine is used, are the signature plates controlled?
5.,' Is the payrnll l:lank accountreconcHed by someone who does not prepare, sign; or deliver paychecks?

6. Are payroll department personnel rotated in their duties? Required to take vacations? Bonded?

7. Is there a timekeeping department (function) independent of the payroll department?
8. Are authorizations for deductions signed by the employees on file?

Occurence

9. Are time cards or piecework reports prepared by the employee approved by her or his supervisor?
10. Is a time clock or other electromechanical or computerized system used?
11. Is the payroll register sheet signed by the employee preparing it and approved prior to payment?
12. Are names of terminated employees reported in writing to the payroll department?
13. Is the payroll periodically compared to personnel files?
14. Are checks distributed by someone other than the employee's immediate supervisor?
15. Are unclaimed wages deposited in a special bank account or otherwise controlled by a responsible officer?
16. Do internal auditors conduct occasional surprise distributions of paychecks?

Completeness

17. Are names of newly hired employees reported in writing to the payroll department?
18. Are blank payroll checks prenumbered and the numerical sequence checked for missing documents?

Accuracy

19. Are all wage rates determined by contract or approved by a personnel officer?
20. Are timekeeping and cost accounting records (such as hours, dollars) reconciled with payroll department calculations of hours and wages?
21. Are payrolls audited periodically by internal auditors?
22. Are individual payroll records reconciled with quarterly tax reports?

Classification

23. Do payroll accounting personnel have instructions for classifying payroll debit entries?

Cutoff

24. Are monthly, quarterly, and annual wage accruals reviewed by an accounting officer?

Required:

Refer to the internal control questionnaire on a payroll system (above)

a. Assume that the answer to each question is no. Choose one question from each section matching the questions to possible errors or frauds that could occur because of the absence of the control.

b. Of the six controls you chose above, which controls are preventive controls and which are detective? Explain how and why.

Answer 1

Today's computerized payroll systems make reporting time worked and handling other payroll functions easy and automatic. They provide dozens of payroll reports for auditing and documentation. They offer security through hand, fingerprint and even eye recognition time clock systems to prevent false work-time reporting. They can automatically accrue paid time off and other employee benefits based on time worked. They are also vulnerable in the hands of dishonest employees who have access to and administrative rights to those systems.

Entering Payroll Time Data

Payroll systems use individual employee codes or other methods of recognition to ensure that employees report their own hours worked. Since codes can be shared, one employee could still falsely clock in for another simply by using another employee's code. Employee handbooks should clearly state the proper procedure for clocking in and out and the consequences for falsely entering payroll information. Human resources should establish clear procedures for requesting time off and changes to employee pay rates. Signatures should be required for any transaction affecting an employee's rate of pay or payroll processing.

Division of Payroll Processing

Human resources is often responsible for setting up new employees in the payroll system, processing payroll data and distributing paychecks. Entering payroll data and processing paychecks should be split between human resources and accounting to ensure that one person or department cannot complete the payroll cycle without scrutiny. Without a separation of responsibility, a dishonest employees could set up a false employee, record time worked or vacation hours and divert the money to a personal account through direct deposit. There is less opportunity to divert funds when one department inputs data and the other processes the payroll data and receives paychecks.

Lack of a Payroll Preview

Prior to processing paychecks, payroll systems will produce a set of reports that can be reviewed for accuracy before "live" checks are printed and direct deposits activated. The payroll preview should be done by an employee or department other than those responsible for payroll processing. Terminated employees who are still receiving paychecks, inordinate amounts of hours worked or vacation hours posted can indicate processing errors or manipulation of data. While legitimate errors can occur, deliberate attempts to divert funds could go unnoticed without a "time out" for a quick audit.

Lack of Systematic Internal Audits

The accounting or finance department should train an employee to conduct an internal payroll audit at least quarterly. Most employees who successfully embezzle large amounts of money do so over time. Periodic, publicized audits of the payroll and accounting functions could help deter a dishonest employee from setting up a scheme to defraud his employer and reduce the financial loss.

Internal controls are either preventive or detective.Preventive controls are designed to prevent errors, inaccuracy or fraud before it occurs. Detective controls are intended to uncover the existence of errors, inaccuracies or fraud that has already occurred.

Preventive Controls

Many preventive controls are based on the concept of separating duties. Examples include prohibiting the same person from conducting related transactions such as initiating and recording transactions; making purchases and approving payments; ordering and accepting inventory; approving vendors and making payments; receiving bills and approving payments; and authorizing returns and issuing refunds. Payroll preparation and distribution duties and approving, writing and signing checks should also be done by different people. Examples of internal controls built around the concept of authorization, approval and verification include requiring supervisory review and approval of payroll information before disbursement, requiring interdepartmental dual authorization of payroll data by accounting and human resources departments and requiring prior approval of credit customers, vendors and purchases.

Detective Controls

Detective controls are internal controls designed to identify problems that already exist. Audits are an example of a detective control. Monthly reconciliation of bank accounts, review and verification of refunds, reconciliation of petty cash accounts, audits of payroll disbursements or conducting physical inventory are all examples of detective controls. Preventive and detective controls are often required in combination to provide sufficient protection. Computer systems require preventive controls through acceptable use and access control. Computer usage logs must be kept. Logs are a form of detective control to be reviewed and audited at regular intervals.