Payroll Fraud & Ghost Employee Risk Audit in India: Duplicate Bank Accounts, Salary Overrides, Attendance, F&F, Contractors & HRMS Controls 2026
A CFO, HR and audit-committee framework for testing whether payroll reflects genuine employees, approved compensation, accurate attendance and controlled employee-master changes.
Payroll leakage can arise from ghost employees, delayed deactivation of leavers, duplicate bank accounts, unauthorised salary changes, inflated overtime, manipulated attendance, duplicate incentives or contractor headcount that cannot be independently verified. Because payroll is recurring, a small monthly exception can accumulate into material loss.
A robust audit links HR master data, appointment records, attendance, payroll configuration, bank files, statutory records and exit documentation rather than testing only the final payroll register.
1. Build the employee population
Reconcile HRMS active employees to payroll, attendance, email or system access, organisational charts and joining records. Identify employees paid without a complete onboarding file, staff marked active after exit and records with no recent attendance or manager confirmation.
For wider workforce controls, see HR & Labour Risk Audit in India.
2. Employee-master integrity
Review employee ID, legal name, joining date, role, department, manager, location, bank details, tax identifiers where relevant, employment status and compensation history. Changes to bank account, grade, salary or status should have traceable approval.
Search for duplicate bank accounts, phone numbers, addresses or emergency contacts where lawful and proportionate. Shared bank accounts may be legitimate in some cases and require factual verification.
3. Joining and first-pay controls
New employees should enter payroll only after authorised joining evidence and compensation approval. Review employees added after payroll cut-off, backdated joining dates, manual arrears in the first month and new employees with immediate high allowances or advances.
4. Salary and allowance overrides
Compare payroll configuration with appointment letters, increment letters, compensation approvals and incentive schemes. Identify manual salary overrides, one-time allowances, arrears, bonuses and off-cycle payments entered outside ordinary workflow.
Repeated senior-management exceptions should be assessed with the Management Override & Fraud-Control Review.
5. Attendance, overtime and shift payments
Reconcile paid days, overtime, shift allowance and leave to attendance source data. High-risk patterns include impossible hours, overtime on leave days, repeated manual attendance regularisation, one manager approving unusually high overtime and attendance records added after payroll preparation.
6. Payroll bank file and payment release
Payroll payment files should be reconciled to approved payroll totals and released through controlled banking access. Test whether employee bank details can be altered after payroll approval or whether one user can both change bank data and release payroll.
Treasury-side controls should align with the Treasury & Banking Control Audit.
7. Exits and full-and-final settlement
Reconcile resignation/termination date, attendance, leave, notice pay, recoveries, incentive eligibility, expense advances, assets, loans and final settlement. Test whether salary continues after last working day and whether access is revoked promptly.
8. Contractor and manpower payroll
Where workers are supplied by manpower agencies, compare billed headcount with attendance, gate access, deployment rosters and supervisor confirmation. Test duplicate workers across vendors, inactive workers, unsupported overtime and invoices based only on vendor spreadsheets.
Contractor arrangements may also create employment and statutory-compliance risks depending on the facts and applicable law.
9. Payroll analytics
- multiple employees sharing one bank account;
- salary paid after exit date;
- employees without attendance or manager assignment;
- round-value manual allowances;
- off-cycle payments concentrated around one user;
- overtime above normal physical limits;
- new employee followed by immediate arrears or bonus;
- duplicate tax or identity details where available;
- contractor headcount above gate/attendance records; and
- bank-detail change immediately before payroll release.
10. Payroll risk matrix
| Area | Red flag | Control response |
|---|---|---|
| Identity | Employee record without credible onboarding | Independent employee verification |
| Compensation | Manual salary/allowance override | Approval evidence and access restriction |
| Exit | Payment after last working day | Payroll/HR exit reconciliation |
| Contractor | Billed headcount above verified deployment | Attendance/gate reconciliation |
11. Evidence required
HR master, appointment and increment letters, attendance, leave, payroll registers, bank files, employee-master change logs, bonus/allowance approvals, exit records, F&F calculations, contractor invoices, gate data and system-access reports should be reviewed.
12. Management deliverables
- ghost-employee exception report;
- duplicate bank-account analysis;
- salary/allowance override schedule;
- attendance and overtime exceptions;
- post-exit payment review;
- contractor headcount reconciliation;
- estimated leakage/recovery matrix; and
- 30/60/90-day payroll control plan.
13. 30/60/90-day remediation
0–30 days: verify suspect employees, stop post-exit payments, lock high-risk master changes and reconcile bank accounts.
31–60 days: automate HR-payroll reconciliation, strengthen compensation approvals and verify contractor populations.
61–90 days: establish monthly exception analytics, periodic access review and independent payroll certification.
14. Frequently asked questions
Does a shared bank account prove a ghost employee?
No. It is a red flag that requires employee and relationship verification.
Should payroll be reviewed outside HR?
Material payroll should have finance/control review in addition to HR ownership, with appropriate segregation.
Can contractor invoices be accepted on vendor attendance alone?
High-risk or material manpower bills should be independently reconciled to company-controlled evidence where available.
What is a common hidden payroll leak?
Delayed deactivation of leavers, manual allowances and inaccurate contractor headcount are recurring examples.
Authoritative references
Author: Adv. Govind Bali, Fastrack Legal Solutions LLP.