Preventing and Detecting Payroll Fraud

Why This Topic Matters

Payroll fraud sits within the Fraudulent Disbursements branch of the ACFE Fraud Tree, under Asset Misappropriation. It is one of the most tested areas in the Financial Transactions and Fraud Schemes section of the CFE Exam because it is common, costly, and long-lasting. ACFE Report to the Nations data consistently shows payroll schemes with a median loss well above many other asset misappropriation schemes and a median duration of roughly two years or more before detection. Small organizations are disproportionately victimized because a single person often controls hiring, timekeeping, payroll preparation, and distribution. For a Certified Fraud Examiner, understanding how payroll fraud is prevented and detected is essential both for passing the exam and for real-world engagements, where payroll is frequently the first area examined when a disbursement fraud is suspected.

What Payroll Fraud Is

A payroll scheme occurs when an employee causes the organization to issue a payment by making false claims for compensation. Unlike billing schemes (which involve fictitious vendors) or expense reimbursement schemes (which involve falsified business expenses), payroll schemes attack the compensation system itself. The ACFE identifies four principal categories:

1. Ghost employee schemes - A fictitious person, a terminated employee, or a real person who does not work for the organization is kept on the payroll and paid. The fraudster must accomplish four steps: add the ghost to the payroll, collect or falsify timekeeping information, have the paycheck issued, and convert the check or direct deposit.

2. Falsified hours and salary schemes - The most common payroll scheme. Hourly employees inflate hours worked, forge supervisor approval, alter timecards after approval, or collude with a supervisor. Salaried employees may improperly increase their rate of pay in the payroll master file.

3. Commission schemes - Employees paid on commission create fictitious sales, overstate sales amounts, or improperly increase their commission rate. These are sometimes described as a hybrid between payroll fraud and fraudulent sales reporting.

4. Workers compensation schemes - Employees fake injuries or exaggerate the extent of injuries to collect benefits, sometimes in collusion with a doctor or lawyer. Although payment usually comes from an insurer, the organization bears the cost through higher premiums.

How Payroll Fraud Works and Where Controls Break Down

Every payroll scheme exploits a weakness in one of the five payroll functions: hiring and personnel records, timekeeping and approval, payroll preparation, payroll distribution, and reconciliation. When one person controls more than one of these functions, fraud becomes easy. For example, a payroll clerk who can add employees to the master file and also distributes paychecks can create a ghost and keep the check. A supervisor who approves timecards and also hands out checks can leave a terminated worker on the payroll and pocket the pay. A sales manager who records sales and calculates commissions can book fake orders and collect the commission before the sales are reversed.

Preventive Controls (What the Exam Expects You to Know)

Segregation of duties - The single most important preventive control. The following functions should be performed by different people: authorizing new hires and pay rates (Human Resources), recording hours worked (department supervisors), preparing payroll (payroll department), distributing pay (treasury or an independent party), and reconciling the payroll bank account (accounting). No one person should be able to both add an employee and issue a payment.

Independent personnel files - Human Resources should maintain personnel records separately from the payroll department. Additions, terminations, and pay-rate changes should originate in HR with documented authorization. Payroll should process only what HR has approved, and HR should receive confirmation of every change made.

Controlled access to the payroll master file - Access should be restricted, password-protected, and logged. Any change to pay rates, bank account numbers, addresses, or employee status should generate an exception report reviewed by someone outside payroll.

Timekeeping controls - Supervisors must review and approve time records before submission, and they should sign or electronically approve them in a way that cannot be altered afterward. Time clocks, biometric systems, or badge systems reduce buddy punching. Overtime should require advance authorization. Supervisors who approve time should not have access to the payroll master file.

Distribution controls - Direct deposit reduces check theft and forgery but does not eliminate ghost employees. Where paper checks are used, someone independent of both HR and payroll should distribute them, and employees should be required to show identification. Unclaimed checks should be returned to accounting rather than to payroll.

Prompt termination processing - Terminated employees should be removed from the payroll immediately. HR should send termination notices directly to payroll and follow up to verify removal. Final paychecks should be handled with extra scrutiny.

Commission controls - Commissions should be calculated by someone independent of the sales function and paid only after sales are verified, shipped, or collected. Sales returns and cancellations should be tracked and charged back against commissions.

Other general controls - Mandatory vacations, job rotation, surprise payroll audits, a payroll budget that is compared to actual results each period, and a well-publicized fraud hotline all deter payroll fraud.

Detective Procedures (Testing and Red Flags)

Surprise payroll distribution (payroll payoff) - An independent auditor or investigator physically hands out paychecks and requires each employee to show identification. Any unclaimed check is a potential ghost. This is a classic exam answer for detecting ghost employees in an organization still using paper checks.

Comparison of payroll records to personnel records - Every person on the payroll register should match an authorized personnel file with a hire date, approved pay rate, and completed tax and benefit forms. Employees on payroll with no personnel file are strong ghost candidates.

Analysis of withholding and deductions - Ghost employees frequently have no taxes withheld, no insurance deductions, no retirement contributions, and no vacation or sick leave taken, because the fraudster wants to maximize the cash received. Lists of employees with zero deductions should be investigated.

Duplicate testing - Data analysis should search for duplicate Social Security or tax identification numbers, duplicate addresses, duplicate bank account numbers, P.O. box addresses, and addresses or accounts that match those of current employees, especially payroll staff.

Analytical review - Compare payroll expense to budget and to prior periods by department. Compare total hours paid to hours reported by production systems or to units produced. Compare headcount per payroll to headcount per HR. Compare overtime by employee and by department and look for individuals consistently at the top. Compare sales commissions to recorded and collected sales.

Review of payroll master file changes - Examine logs of additions, pay-rate changes, and bank account changes. Pay particular attention to changes made shortly before a pay run and reversed shortly after, or to rate increases without a corresponding HR authorization.

Examination of canceled checks and deposits - Look for checks endorsed by the same person, dual endorsements, deposits into the same account for multiple employees, and checks cashed rather than deposited.

Timecard review - Look for alterations, approvals by someone other than the direct supervisor, hours recorded on days the facility was closed, overtime that does not match production schedules, and employees who never record absences.

Red flags of payroll fraud include: employees with no deductions; payroll expense exceeding budget without explanation; overtime concentrated in a few individuals; employees who never take vacation; multiple employees sharing an address or bank account; terminated employees still appearing on the payroll; supervisors who insist on distributing checks personally; commission payments on sales that later are reversed; and a payroll department that resists independent review.

How to Answer Exam Questions on This Topic

The CFE Exam uses multiple-choice and true-false questions that test your ability to identify the correct control for a specific scheme, recognize red flags, and choose the best or most effective procedure. Read every question carefully to determine which of the four payroll scheme types is involved, then match it to the control or test that attacks that scheme directly.

Exam Tips: Answering Questions on Preventing and Detecting Payroll Fraud

1. Identify the scheme type first. Ghost employee questions point toward controls over adding employees (HR authorization, personnel file comparison) and distribution (surprise payoffs, identification). Falsified hours questions point toward timekeeping controls (supervisor approval, time clocks, overtime authorization). Commission questions point toward verifying sales independently and tracking returns.

2. Segregation of duties is almost always the strongest preventive control. If a question asks for the most effective way to prevent payroll fraud, look for the answer that separates hiring, timekeeping, payroll preparation, distribution, and reconciliation.

3. Distinguish prevention from detection. Prevention means stopping the fraud before it occurs (authorization, segregation, access restriction). Detection means finding fraud after it has occurred (surprise payoffs, analytics, comparison of records). If the question asks how to detect, do not pick a preventive control, and vice versa.

4. Know the signature test for ghost employees. Expect questions on employees with no withholding or deductions, employees with no personnel file, duplicate addresses or bank accounts, and the surprise payroll distribution. Any of these may be the correct answer depending on how the question is worded.

5. Remember what direct deposit does and does not do. Direct deposit reduces check theft and forgery, but a ghost employee can have a direct deposit account controlled by the fraudster. Do not select direct deposit as a complete solution to ghost employees.

6. Know that falsified hours is the most common payroll scheme. Questions about frequency or the typical scheme usually point to falsified hours and salary rather than ghost employees.

7. HR should be independent of payroll. If an answer choice places personnel records or the authority to add employees within the payroll department, it is almost certainly wrong.

8. Supervisor collusion changes the answer. If the scenario says the supervisor approves fraudulent timecards, supervisor approval cannot be the control. Look instead for independent review, analytics comparing departments, or rotation of duties.

9. Watch for keywords. Terms such as independent, separately maintained, authorized by HR, reconciled by someone outside payroll, and surprise often signal the correct answer. Terms that concentrate authority in one person signal a wrong answer.

10. Think like the fraudster. Ask what the fraudster needs to accomplish the scheme and what control blocks that step. For a ghost, the fraudster must add a name, generate time, get a check issued, and convert it. The best control or test is the one that interrupts the specific step described in the question.

11. For commission schemes, link payroll to sales. The correct answer will usually involve verifying that sales actually occurred, were shipped, or were collected, and that commission rates match approved rates, rather than a generic timekeeping control.

12. Eliminate distractors that belong to other scheme categories. Vendor master file reviews belong to billing schemes; receipt matching belongs to expense reimbursement; check tampering tests belong to check tampering. If an answer choice addresses a different disbursement scheme, rule it out.

Quick Review Summary

Payroll fraud is a fraudulent disbursement scheme with four types: ghost employees, falsified hours and salary (most common), commission schemes, and workers compensation schemes. Prevention relies on segregating hiring, timekeeping, preparation, distribution, and reconciliation; keeping HR independent of payroll; restricting and logging master file access; requiring supervisor approval of time; and promptly removing terminated employees. Detection relies on surprise payroll distributions, comparing payroll to personnel records, analyzing employees with no deductions, searching for duplicate identifiers and addresses, analytical review of payroll expense and overtime, and reviewing master file changes. On the exam, identify the scheme type, decide whether the question asks about prevention or detection, and choose the answer that most directly interrupts the fraudster at the specific step described.