Although it’s impossible to accurately quantify, payroll fraud is more common than you might think. With the recent prosecution of a payroll officer at Woolworths, it’s timely to take a look at the topic of payroll fraud again, and what you can do to avoid it.
With most cases remaining unprosecuted due to the minimal chance of recovering the funds, the fraud is often not reported in the press and is managed by internal HR processes.
Payroll processes and governance in relation to fraud need to be front of mind, always. They should be so tightly governed and tested that those working in the payroll function should be above suspicion.
So what are the seven most common areas that give rise to suspected fraudulent payroll activity?
- Payroll audit trail
If your payroll system doesn’t have a robust audit trail, or even if it does but you aren’t using it to audit critical fields, this should now be your number one priority. The payroll audit trail will often point directly to fraudulent activity and show up the areas that need to be investigated.
The activity that you might be looking for is varied, but if there is fraudulent activity in your payroll it is often quite obvious to someone who understands the process. I can’t stress enough how important it is to ensure the auditing feature of your payroll system is working so it’s available if and when you need it.
- Regular master file changes
If there are regular changes in employee bank details or leave balances this is something that should be investigated. There could be simple explanations for these changes, but it is a common red flag in payroll fraud.
- Duplications of data and ghost employees
Although I have come across cases of twins that share a bank account and live at home with their parents being on the same payroll, this is rare indeed! If you identify duplicate names, addresses, dates of birth, tax file numbers or other master file details you should investigate further to eliminate the risk of ghost employees.
- Out-of-hours access
Much fraudulent activity occurs out of normal office hours and often by remote access to the payroll system. If people in your organisation are regularly accessing the payroll outside business hours, the need for this access may be something that should be investigated.
- Loose security
I’m a firm believer that the only people that should have write access to a payroll system are those that are in the business of paying people. Anyone else, including senior management, should have restricted or read only access. Not only does this reduce the possibility of payroll fraud, it protects those who only need read only access from suspicion.
- Sharing logins or using obsolete logins
Sharing logins is an absolute no-no and concerns should be raised about anyone who does this. If you have a genuine reason to access a payroll system, you need to have your own login and password. Likewise, with turnover of payroll staff you should ensure that old logins are deleted so third party users cannot use them.
- High percentage of casual employees
Although not cause for suspicion in itself, much payroll fraud is committed using a casual workforce. If you have a high percentage of casual employees, more attention needs to be given to processes that minimise or eliminate the opportunity for payroll fraud.