As we head into 2023, the urgent need for cyber security seems more pressing every day. From the FBI, to luxury car manufacturers, to social media platforms, no organization (or individual) is safe from being targeted by online hackers and others with malicious intent, and so stepping up security on networks and platforms is essential.
Cyber-crime is a lucrative business for hackers and incredibly damaging for the victims. It is estimated that the cost per data breach in the US in 2022 was in the region of $5 million.
The reasons behind hacks vary, as do the levels of skill, know-how and organization of the hackers. In some cases, a hack can be relatively benign, i.e., individual hackers simply want to prove that they can breach security protocols to gain kudos with others.
However, in most cases there are much more nefarious motives, e.g., identity theft, data ransom, stealing infrastructure, etc These hackers tend to be highly organised and have access to international networks through which they can exploit stolen personal and financial information.
For organizations and enterprises, HR and payroll data is one of their most valuable assets, and as such is highly susceptible to cyber-attack. The value of this data (in real, organizational and personal terms) means that Chief Information Security Officers (CISOs), CFOs, payroll and HR managers need to work in close unison to ensure that effective protocols are in place to keep this information secure.
One of the most effective ways in which enterprises can safeguard the security of the HR and financial data of its employees and contractors is through conducting a regular payroll audit.
What is the function of a payroll audit?
A payroll audit is a review that is designed specifically to examine payroll records and processes, in order to ensure that the system is functioning correctly, i.e., that employees are classified correctly, being paid appropriately and on time, and that all processes follow labor and tax laws. This can be especially important in the management of global payroll for organizations with workers in multiple countries and jurisdictions.
That these processes are carried out accurately and in accordance with the law is essential not only for organizations, but for employees and contractors too, who want to feel confident that they will be paid on time at the end of every pay cycle.
A payroll audit is also an effective means of identifying cyber security weak spots or breaches, as well as potential payroll fraud committed from within an organisation, e.g., creating fake identities for employees who don’t exist, etc.
Major payroll breaches
The importance of regular payroll auditing becomes more apparent when we see how many recent breaches in payroll security there have been worldwide in both public and private enterprises.
These include Parasol (UK, 2022), Brookson Group (UK, 2022), Kronos (US, 2021) and Frontier Software (Australia, 2021), to name but a few of the biggest and most recent victims. As a result of these security breaches, personal and company data was stolen, while payments and other processes were also interrupted.
What was further significant about a number of these breaches is that they weren’t discovered until some time after the event — a scenario that could perhaps have been avoided had more regular payroll audits been conducted.
What is the process of payroll auditing?
In addition to helping promote and foster security, a payroll audit also supports organisational efficiency and effectiveness in the delivery of two key areas associated with payroll, namely accuracy and compliance.
Regardless of whether payroll audits are conducted by an in-house team or an external third party, there is a process that should be followed in order to ensure that payroll records are organised and accurate, and that employees are being paid property and on time.
The first step in a payroll audit should be to determine its time frame, which could be over the course of the entire fiscal year, or for shorter periods, e.g., a single pay cycle.
During the audit, all employee data should be reviewed for its accuracy and whether it is up to date. Areas to examine will include names, job titles, dates of employment, etc. It is crucial also to look at rates of pay, to ensure that the current rate is accurate and that changes (due to promotions or changing roles, etc.) have been duly recorded.
A payroll audit should also aim to reconcile employee records with payroll, to ensure that people who have moved on are not still being paid, or that fake records have not been created in order to receive fraudulent payments.
Employee’s working hours should also be cross-referenced to ensure they are being paid in accordance with the hours worked, and that the system is properly recording and reporting additional payments beyond base rates, e.g., overtime, bonuses, commissions, etc.
It is also not uncommon for tax laws to change, so a payroll audit should be used to determine whether tax and other deductions are being made at the appropriate rates.
The importance of payroll auditing to avoid security breaches
Payroll auditing should ideally be integral to any organisation’s payroll processes. Regardless of the size of your organisation, how many employees you have, or where they are based, regular payroll auditing helps to ensure you are compliant with local labor laws and tax legislation, and are making the appropriate deductions and withholdings.
Regular audits also enables payroll and HR staff to check that the data they hold on employees is in sync, and that records are accurate. Being proactive in this regard also helps to identify fraud.
Importantly, when auditing is a regular and recurrent part of payroll processes, potential cyber security attacks can be identified earlier or, in the worst case scenario, successful breaches can be discovered more quickly, and response measures activated in a timely manner.
Why it is essential to ensure your payroll process has annual payroll auditing
At the very minimum, your organisation should be conducting a comprehensive payroll audit every year.
However, for companies with disparate workforces, located in multiple countries and jurisdictions, and where workers are paid at different rates and are subject to different tax laws, quarterly or half-yearly payroll audits should be considered.
So doing will also mean that any external data security breaches will be discovered and rectified more quickly, while the potential for internal fraud is likewise reduced.
There is also the added benefit of ensuring that all the data you hold on employees is both clean and up to date, and that conditions that can impact on a company’s bottom line — such as sick leave, paid time off, and unauthorised absences — are being recorded and accounted for. Regular audits also help to reduce time theft, the process by which employees falsify timesheets in order to be paid for more hours than they actually worked.
These and other issues affecting the accuracy and efficiency of your payroll services can be addressed, and rectified when necessary, if regular payroll auditing is place as part of your ongoing processes.
