Fraud scenarios occur in payroll for a variety of reasons. First, employees are motivated to increase their net payroll. A supervisor is motivated to increase the net payroll of a good employee or the supervisor is motivated by receiving a kickback from the employee. Human resources payroll grades are unreasonable. Senior management is motivated for personal enrichment or to disguise a bribe, which is an FCPA issue. Whatever the internal person's motivation for committing the fraud scenario, payroll systems are vulnerable to internal employees committing fraud scenarios through the payroll system.
On first appearance, internal controls in most payroll systems seem sound. Separation of duties between payroll and human resources functions are deemed adequate. The company has a form for every step of the process. Approval controls are abundant throughout the entire system. However, fraud auditors should not be fooled by the evidence of an internal form, the appearance of separation of duties, and approval signatures in planning their fraud data analytics plan.
The predictability or vulnerability of the payroll system to a specific fraud scenario is how the internal control works in the real world. I refer to this as the difference between control theory and control reality.
In the legal system, there is a phrase, “form over substance or substance over form.” Payroll systems definitely have a “form over substance” from an internal control ...