Internal Controls for Payroll

Risks: Fictitious employees, overpayments, excessive leave, unauthorized hours


Payroll transactions should be properly recorded and authorized. Paychecks should be appropriately distributed and employees validated. With the decentralization of the payroll process, many responsibilities have shifted from the central payroll office to the department level.

  • Payroll timekeeping, input, and authorization functions should be segregated
  • Specifically, duties should be adequately segregated; meaning, payroll should be approved by someone other than the person responsible for inputting the information. Also, someone other than the person who inputs or authorizes payroll should distribute the payroll checks. A person independent of input and authorization responsibilities should review labor distribution reports monthly. This review should be documented via initials.
  • Timesheets should be used for all non-exempt employees to record the time worked and be approved by a supervisor
  • Exempt and non-exempt employees need to document and report sick and vacation time, as unworked time must be recorded in PeopleSoft
  • All unclaimed paychecks should be returned to the Payroll Office if not picked up within 30 days
  • Physical checks should be locked in a secure area until distributed
  • Use a distribution log to provide accountability of the whereabouts of a check
  • Encourage direct deposit of checks
  • Terminated employees should be reported to HR/Payroll immediately
  • Payroll reimbursements from other institutions should be processed to account 569914 – Expense Reimbursements in order to not impact fringe benefit calculations

Related SU Policies:

Payroll Information for Department Administrators
Payroll Authorization and Payroll Records