Payroll Audit Checklist for Indian Companies: Employee Master, Salary TDS, EPF and Payment Controls

Payroll audit work becomes weak when it starts and ends with a salary register. The stronger approach is to follow the transaction cycle from an employee’s existence, approved pay and monthly inputs through tax and provident-fund deductions, accounting entries and the final bank payment. That lets the auditor answer four different questions: was the person valid, was the amount authorised, were statutory deductions handled under the rules that applied to that period, and did the correct net amount reach the correct bank account?

This payroll audit checklist is designed for Indian companies and for internal-audit, statutory-audit and control-testing work. It is not a substitute for entity-specific legal advice. Payroll design differs by workforce, state, benefits, systems and outsourcing model, so the procedures below should be scaled to the risks actually present.

Payroll audit risk-to-test matrix

Use this matrix as a planning and review aid, not as a substitute for understanding the entity’s payroll process. The useful link is between the risk, the control that should address it, the audit procedure and the evidence that proves what actually happened.

For fieldwork, download the Excel-ready payroll audit working-paper template. It includes a risk-control-test-evidence register, sample-testing sheet and exceptions log. Keep sensitive employee data to the minimum needed for the audit and tailor the workbook to the entity’s systems and scope.

Map the payroll cycle before choosing samples

Start with the process, not with a random voucher sample. Document who owns the employee master, who approves compensation, where attendance and variable-pay inputs come from, who runs payroll, who can change tax or provident-fund configuration, who prepares the bank file and who finally releases payment. This risk-to-response approach is consistent with the logic explained in CA Samaaj’s SA 315 and SA 330 risk-response guide and with ICAI’s current Standards on Auditing repository.

For each significant payroll risk, write down four items before testing: what can go wrong, the control that should prevent or detect it, the evidence that control leaves behind, and the audit procedure that would identify a failure. For example, an unauthorised bank-account change may be addressed by maker-checker approval; the evidence may be a system audit trail or approval ticket; the audit test is then to select bank changes and inspect both the request and independent approval. This is more useful than a generic tick-mark against “bank details checked”.

If payroll is part of the company’s internal financial controls framework, the same mapping can be carried into a process-level RCM. The practical distinction between a control description, its evidence and operating-effectiveness testing is covered in the IFC and RCM testing guide.

Build a complete employee universe before testing pay

Obtain the employee master directly from the authoritative HR or payroll system for the audit period, with employee ID, date of joining, exit date or status, department, grade, PAN where maintained, UAN where applicable, bank account and the key fields that drive fixed pay. Reconcile opening employees plus joiners minus exits to the closing population. Investigate records that do not fit that movement.

Then compare the payroll population with HR records and, where useful, access-control or attendance populations. The purpose is not merely to agree headcount. It is to identify employees who should not be paid, employees who may have been omitted and duplicate or suspicious master records. CA Samaaj’s internal-controls explainer gives the broader control context, but payroll testing should remain transaction-specific.

• Test new joiners back to approved offer or appointment terms and the first payroll month.
• Test exits through the last working date, final settlement and the month in which recurring payroll stopped.
• Scan for duplicate PAN, UAN or bank-account values where the entity lawfully maintains those fields and the analysis is relevant.
• Identify employees with missing joining dates, inactive status but current payments, or multiple active employee IDs.
• Separate contractors and non-payroll workers so that the employee universe is not mixed with vendor payments.

Treat master-data changes as their own high-risk population

Salary revisions, bank-account changes, tax-regime selections and one-time manual overrides deserve their own population because they can change the result without changing the underlying attendance record. Extract the change log for the period if the system supports it. Select changes close to payroll cut-off, changes made by privileged users, repeated changes to the same employee and changes without a normal HR workflow.

For salary revisions, agree the effective date and components to the approved compensation record. For bank changes, inspect the employee request or approved source document, the independent approval and the system audit trail. Where payroll is integrated with HRMS, check whether the payroll team can bypass the controlled HR workflow by editing fields directly.

Reperform gross-to-net payroll, not just the total salary expense

For selected employees, start with approved fixed pay and rebuild the month. Trace attendance, leave without pay, incentives, overtime where applicable, bonus, arrears, reimbursements and deductions to their source and approval. Separate recurring components from monthly variable inputs so manual adjustments do not disappear inside a large gross-pay number.

The sample should deliberately include more than “normal” employees. Include at least some joiners, exits, employees with salary changes, large variable pay, arrears, unusual deductions, negative or unusually low net pay and employees whose bank details changed. Reperform the arithmetic from gross earnings to taxable items, deductions and net pay. If the system calculation cannot be independently explained, capture that as a control or evidence gap rather than accepting a payroll-system screenshot as proof.

Audit salary TDS for Tax Year 2026-27 using the new Act references

Salary TDS is especially sensitive in 2026 because the governing law changed from 1 April 2026. The Income Tax Department’s TDS Compliance FAQs state that salary relating to FY 2025-26 and paid up to March 2026 is governed by section 192 of the Income-tax Act, 1961, while salary paid from April 2026 for Tax Year 2026-27 is governed by section 392(1) of the Income Tax Act, 2025. The Department also says employers should reset the salary-TDS computation from 1 April 2026 using projected income, deductions and the employee’s tax regime.

That transition creates a real payroll-audit procedure: inspect the configuration change made around 1 April 2026. Check that payroll master data, section references, tax-year settings and reporting forms moved to the new framework without carrying old references blindly into the new tax year. The same official FAQ says payroll and ERP systems need to reflect the new section numbering and reporting requirements.

For selected employees, inspect the annual taxable-income projection, regime used, declarations or proofs considered, taxable perquisites where applicable, tax already deducted and remaining-month deduction logic. Where employee declarations feed payroll, the related evidence process can be cross-checked against the Form 12BB payroll guide. For a basic refresher on the deduction mechanism itself, see how TDS works.

Do not stop with employee-level recalculation. Reconcile payroll TDS to the tax payable ledger, challan or payment evidence and the quarterly salary statement. Under the Income-tax Rules, 2026, the Department’s official Form 138 note identifies Form 138 as the quarterly statement for salary TDS under the new Act and lists the quarterly filing dates. Where the audit team needs an independent reasonableness check, the Department also provides an official TDS calculator for the current framework. A calculator is a corroborative tool, not a substitute for validating the employee facts and payroll configuration.

EPF testing should connect eligibility, wage base, ECR and payment

Provident-fund testing is stronger when it follows the same employee through the full chain. First determine whether the employee and establishment are within the applicable framework. Then identify the wage base actually used by payroll, recompute the employee and employer components under the rule applicable to that employee, trace the amount into the ECR and finally trace the liability to payment.

EPFO’s present contribution-rate reference sets out the 12%/10% structure, the ₹15,000 wage-ceiling note and the allocation of the employer share between EPF and EPS subject to the stated conditions. Do not convert that reference into a universal “12% of gross salary” rule. The correct audit conclusion depends on membership, the wage base, higher-wage arrangements, establishment category and other facts.

The Employees’ Provident Funds Scheme, 1952 remains the core scheme text for contribution mechanics. For operational filing, EPFO’s Revamped ECR FAQs explain that the redesigned ECR system applies from wage month September 2025, separates return filing from payment generation, applies system validations and supports revised or supplementary returns in specified situations.

For audit evidence, reconcile employee-wise payroll deductions and employer contributions to the ECR data, the payable ledger and the bank payment. Investigate employees present in payroll but absent from the return, employees appearing in the return but not payroll, wage-base differences, duplicate UAN situations, late additions and manual corrections. When the ECR was revised or supplemented, retain both the reason and the audit trail of the correction.

Reconcile payroll to the ledger and then to the bank

A useful monthly reconciliation has three legs. First, payroll earnings and employer costs reconcile to the expense and provision accounts. Second, employee deductions and statutory amounts reconcile to the relevant liabilities and subsequent payments. Third, net payroll reconciles to the bank-payment file and bank statement.

Do not force every difference to zero by inserting an unexplained “timing” line. Rejected salary payments, final-settlement adjustments, recoveries, off-cycle payrolls, manual journals and reclassifications should each be identifiable. Old credit balances in payroll liabilities deserve ageing and explanation because they can represent rejected payments, stale deductions, unclaimed amounts or posting errors.

Bank-file controls also need separate attention. Identify who generates the file, whether it can be edited outside the payroll system, who verifies the total and beneficiary count, and who authorises release. A company can have a perfectly reconciled salary expense and still have a serious control failure if the payment file can be altered after payroll approval.

When payroll is outsourced, audit the company’s controls as well as the provider

Outsourcing calculation to a payroll bureau does not remove management’s responsibility for the accuracy of payroll or the auditor’s need for evidence. If the provider is relevant to financial reporting, the audit approach may also involve SA 402. CA Samaaj’s SA 402 guide uses an outsourced-payroll example and explains why the auditor still needs to understand user-entity controls, interfaces and relevant service-organisation evidence.

In practice, obtain the data hand-off and output flow. Test who approves employee master changes before they are sent to the provider, how input totals are controlled, how the company reviews the returned payroll, how exceptions are resolved and whether the final payment file can differ from the reviewed payroll. A service provider report may be useful, but it does not replace testing complementary user controls that the company itself must operate.

Year-end payroll work needs cut-off, accrual and subsequent-payment evidence

At year-end, compare the payroll calendar, service period, ledger posting and actual payment date. March salary, annual or performance bonus accruals, leave-related provisions, variable-pay estimates and final settlements can create cut-off or estimation risk. For each material accrual, understand the basis and compare it with subsequent settlement where that evidence is available.

Statutory and payroll liabilities should be aged and agreed to later payments or a supported explanation. If an amount remains outstanding for several months, do not treat the opening balance as self-proving merely because it rolled forward from the prior year.

High-yield payroll analytics that often find exceptions faster

Data analytics do not prove an error, but they help direct testing to records that deserve explanation. Run tests that fit the entity’s data rather than a fixed template. Useful examples include:

• employees sharing the same bank account, PAN or UAN where duplicates are not expected;
• salary paid after recorded exit date;
• bank-account changes in the last few days before payroll release;
• large month-on-month changes in net pay without a corresponding salary revision or variable-pay approval;
• round-number incentives, bonuses or arrears outside the normal approval pattern;
• employees with repeated manual payroll overrides;
• negative net pay or deductions exceeding normal thresholds;
• payroll records with missing department, manager, joining date or other mandatory control fields;
• employees in the payroll register but absent from the statutory return population, and the reverse;
• multiple off-cycle payments to the same employee in one month.

Every flagged item needs a disposition. Record the source evidence, explanation, whether the exception is valid, and whether it points to a broader control issue. Repeated exceptions can change the risk assessment and therefore the nature or extent of further audit work.

Worked example: follow one employee from master data to cash

Assume an employee has approved fixed monthly pay of ₹90,000 and an approved ₹10,000 performance incentive in September 2026. The payroll register shows gross pay of ₹1,00,000 before deductions. A weak test simply checks ₹90,000 + ₹10,000 and agrees the net salary to the bank statement.

A stronger test starts with the employee’s active status and approved compensation, confirms the incentive approval and effective period, rechecks the tax projection and payroll deduction logic for Tax Year 2026-27, verifies the applicable EPF treatment from the employee’s facts, agrees the final net pay to the approved bank account and then traces that beneficiary and amount into the released payment file and bank statement.

Now assume the bank account was changed two days before payroll. The salary expense can still be arithmetically correct. The audit question changes: was the bank change genuine, independently approved and reflected in the system audit trail before the payment file was generated? If that control failed, the issue is not repaired merely because the employee later confirmed receipt.

What a strong payroll working paper should let another reviewer prove

• The employee population is complete and reconciled from opening to closing headcount.
• Joiners, exits and master-data changes were tested from authorised evidence.
• Gross-to-net calculations were reperformed for a risk-based sample, including unusual employees rather than only routine cases.
• Salary TDS was tested under the law and reporting framework applicable to the payment period, including the April 2026 transition where relevant.
• EPF testing connected the employee facts, wage base, contribution logic, ECR and payment evidence.
• Payroll expenses and liabilities reconciled to the general ledger without unsupported plug differences.
• Net payroll reconciled to the approved payment file and bank statement, with rejected or returned items separately resolved.
• Outsourced payroll interfaces and company-side controls were understood and tested where relevant.
• Year-end cut-off and material accruals were supported by the service period, calculation basis and subsequent evidence.
• Analytics exceptions were investigated and linked back to the risk assessment instead of being closed with generic explanations.

Keep the official source date or access date in the audit file for tax and provident-fund rules that can change. When a payroll configuration changes mid-year, retain evidence of the old setting, the approved change and the first payroll processed under the new setting; that makes later re-performance far easier than trying to reconstruct the change from year-end reports.