Step-by-Step Audit Checklist
- Run the payroll register against the staff list. Export the full payroll file and match every name against HR's active employee list. Every unmatched name is a ghost until proven otherwise — no exceptions, including "they left last month."
- Verify new hires before their first paycheck. Every new hire in the audit period must have completed identity verification and right-to-work checks. A hire who reached payroll without verification is the highest-risk finding the audit can produce.
- Confirm bank details. Flag payroll accounts that differ from the employee's verified identity, and flag any employee whose pay goes to an account in a different name. This is where insider ghost schemes are usually caught.
- Review terminations. Check that every terminated employee was removed from payroll on the correct date and that no final payouts went to unverified records.
- Reconcile tax and filing records. The counts on quarterly filings should match the verified headcount; persistent mismatches indicate records that were never real.
- Inspect the access log. Who added, changed, or removed payroll records during the period? Unexplained changes outside normal cycles are a red flag, especially at night or after hours.
Risk Factors to Weight Heavily
| Risk factor | Why it matters |
|---|---|
| Recent payroll administrator turnover | The classic ghost-employee window: schemes start or stop when payroll access changes hands. |
| No identity verification at hire | Any hire who reached payroll unverified is a candidate for fabrication or synthetic identity. |
| Remote or seasonal workforces | Less physical presence means fewer natural checks on whether a person exists and shows up. |
| Manual payroll processes | Spreadsheet payroll means no system of record, no audit trail, and easier manipulation. |
| Small, repeated payments | Ghost schemes keep amounts small per check to stay under the review threshold. |
How Often to Audit
Minimum: quarterly. Trigger-based audits are just as important — run a full audit whenever a payroll administrator leaves, when payroll moves to a new system, and after any discovered fraud in the business.
What a Clean Audit Should Prove
- Every payroll name matches a verified, current employee.
- Every new hire has a completed verification record on file.
- Terminations left payroll on their effective date.
- No bank details diverge from verified identity.
- The audit trail shows only authorized, explained changes.
If the audit finds a ghost employee: freeze the payment immediately, preserve the records, and follow your internal fraud procedure — in most cases this means involving counsel before terminating anyone, because the scheme is usually an insider with access to the very records you are reviewing.
Verify every new hire before the first paycheck.
Verify with EmployerChecks