Control Objectives, Threats, and Procedures

Adequate internal controls are needed to meet the following objectives:

1. All payroll transactions are properly authorized.

2. All recorded payroll transactions are valid.

3. All valid, authorized payroll transactions are recorded.

4. All payroll transactions are accurately recorded.

5. Applicable government regulations regarding remittance of taxes and

filing of payroll and HRM reports are met.

6. Assets (both cash and data) are safeguarded from loss or theft.

7. HRM/payroll cycle activities are performed efficiently and effectively.

Simple, easy-to-complete documents with clear instructions facilitate the

accurate and efficient recording of payroll transactions.

Appropriate application controls, such as validity checks and field (format)

checks, further increase the accuracy of data entry when using electronic
documents.

Providing space on both paper and electronic documents to record who

completed and who reviewed the form gives evidence that the transaction was
properly authorized.

Prenumbering all documents facilitates checking that all transactions have

been recorded.

Restricting access to programs that create documents and, if paper documents

are still used, to blank documents reduces the risk of unauthorized
transactions.

Employment Practices

The objective of the HRM function is to efficiently hire, develop, retain,

and dismiss employees.

Threat 1Hiring Unqualified or Larcenous Employees

Hiring unqualified employees can increase production expenses, and hiring a

larcenous employee can result in theft of assets.

Skill qualifications for each open position should be stated explicitly in

the position control report.

It is especially important to verify a job applications skills and

references, including college degrees earned, because research shows that
approximately 30 percent of resumes contain false information.

Background checks should also be conducted.

Threat 2Violation of Employment Law

The government imposes stiff penalties on firms that violate provisions of

employment law.

The best control procedure is careful documentation of all actions relating

to advertising, recruiting, and hiring new employees and dismissal of
employees.

Payroll Processing

The objective of payroll processing is to efficiently and effectively

remunerate employees for the services they provide.

Threat 3Unauthorized Changes to the Payroll Master File

Unauthorized changes to the payroll master file can result in increased

expenses if wages, salaries, commission, or other base rates are falsified.

Proper segregation of duties is the key control procedure for dealing with
this threat.

Only the HRM department should be able to update the payroll master
file for hirings, firings, pay raises, and promotions.

Controlling access to the payroll system is also important. The system should
be programmed to compare user IDs and passwords with an access control matrix
that:

1. Defines what actions each employee is allowed to perform

2. Confirms what files each employee is allowed to access

Threat 4Inaccurate Time Data

Inaccuracies in time and attendance records can result in increased labor

expenses and erroneous labor expense reports.

Automation can reduce the risk of unintentional inaccuracies.

The data entry program should include the following edit checks:

1. Field checks for numeric data in the employee-number and hours

worked fields

2. Limit checks on the hours worked field

3. A validity check of the employee number

Proper segregation of duties can reduce the risk of intentional accuracies.

Time clock data, used for calculating payroll, also should be reconciled to
the job time ticket data.

Threat 5Inaccurate Processing of Payroll

The complexity of payroll processing makes it susceptible to errors.

Processing errors can lead to penalties if the errors result in failure to
remit the proper amount of payroll taxes due the government.

Three types of control procedures address the threat of payroll errors:

1. Batch totals should be calculated at the time of data entry and then
checked against comparable totals calculated during each stage of
processing.

Hash totals of employee numbers are particularly useful. If the

original and subsequent hash totals of employee numbers agree, it
means that:

All payroll records have been processed.

Data input was accurate.

No bogus time cards were entered during processing.

2. Cross-footing the payroll register

3. A payroll clearing account

The payroll clearing account is a general ledger account that is used

in a two-step process to check the accuracy and completeness of
recording payroll costs and their subsequent allocation to appropriate
cost centers.

The recordings for each pay period include:

Debit to payroll account

Credit to deductions payable
Credit to cash for net pay

Then when direct and indirect labor is used in manufacturing the

recording is:

Debit to work-in-process for direct labor

Debit to manufacturing overhead for indirect labor
Credit to payroll account

The amount credited to the payroll account should be equal to the

initial debit to the payroll account. This internal check is called a
zero-balance check.

Companies hire temporary employees or outside help to get around a

hiring freeze.

The IRS provides a check list of questions that can be used to

determine if a worker should be classified as an employee or an
independent contractor.

Threat 6Theft or Fraudulent Distribution of Paychecks

Another major threat is the theft of paychecks or the issuance of

paychecks to fictitious or terminated employees.
 The controls related to other cash disbursements, discussed in Chapter
11, also apply to payroll:

1. Access to blank payroll checks and to the check signature

machine should be restricted.

2. All payroll checks should be sequentially prenumbered and

periodically accounted for.

3. The cashier should sign all payroll checks only when supported
by proper documentation (the payroll register and disbursement
voucher).

4. Someone independent of the payroll process should reconcile

the payroll bank account.

A separate payroll bank account provides additional protection against

forgery or alteration.

It is also important that someone who does not authorize or record

payroll should distribute paychecks and control the transfer of funds
for direct deposit.

Special procedures should be used to handle unclaimed paychecks because

they indicate the possibility of a problem, such as a nonexistent or
terminated employee.

General Controls

As for other disbursements, there are two general threats: 1) the loss,
alteration, or unauthorized disclosure of data and 2) poor performance.

Threat 7Loss, Alteration, or Unauthorized Disclosure of Data

Backup and disaster-recovery procedures provide the best controls for

reducing the risk of payroll data loss.

Physical and logical access controls are important preventive measures to

mitigate this threat.

Access and processing integrity controls are also needed to ensure the
confidentiality and accuracy of payroll cycle data transmissions.

Finally, protecting the privacy of employee data also is important.

Threat 8Poor Performance

Preparing and reviewing performance reports is an effective means of

addressing the threat of poor performance.

Careful monitoring of employees productivity is necessary to determine if

the employee is working the hours in which they are getting paid for. Also,
that the employees are not conducting personal business during working hours,
such as using the companys computer to send personal e-mails or shopping on
the Internet.
Training is also important. It is estimated that training costs represent 2
percent of total labor costs for manufacturing companies.

Online classes provide a means to reduce training costs.