Payroll Audit: How to Run One for Your Business
How to run a payroll audit for a small business, plus a checklist, the errors audits find, how often to audit, and what to do if the IRS or DOL audits you.
Payroll Audit
How to run one yourself with no HR team, the errors it will surface, how often to do it, and what to do the day the IRS or DOL audits you instead
The phrase payroll audit does two jobs at once, and that is the source of most of the anxiety around it. Half the time it means a careful check you choose to run on your own payroll. The other half it means the IRS or the Department of Labor showing up to run one on you. Same words, wildly different feelings.
Most guides blur the two, which leaves a small-business owner with no HR person more worried than informed. So this separates them cleanly. The bulk of this is the audit you run yourself, in plain steps, with a checklist, because doing that well is the single best thing you can do. Then the high-anxiety part: what to actually do the day a government notice lands.
Here is the reassuring truth up front: a payroll audit is a records review, not an accounting exam. You are checking that documents agree with each other. I build FirstHR, which is the records-and-documentation layer that makes this painless, so I will be honest about where that fits: FirstHR is not a payroll engine, and this pairs with whatever payroll provider you use. One caveat before we start: this is general information rather than tax or legal advice, and the numbers here change, so confirm current figures before you rely on them.
What a Payroll Audit Is
A payroll audit is a systematic review confirming that the right people are being paid the right amounts, that taxes are withheld and deposited correctly, and that the records to prove it exist.
The word audit sounds adversarial, but the internal version is the opposite. It is a maintenance task, closer to reconciling a bank statement than to being investigated. You are looking for the small discrepancies that creep into any payroll over time: the rate that never got updated, the person who left but stayed on the roster, the withholding that drifted out of line with a new W-4.
The reason it matters more than it sounds is that payroll errors do not announce themselves. They compound quietly, every pay period, until something forces a look. An audit is the deliberate look, done on your schedule instead of the government's. The broader context of what payroll involves is in the payroll guide, and the mechanics of a single run are in how to run payroll.
The Three Kinds of Audit People Confuse
Before anything else, untangle the three things the phrase describes, because they have almost nothing in common except the words.
The distinction is not academic. It changes what you should do. For the internal audit, the answer is simple: run it, on a schedule, and fix what you find. For the two external audits, the answer is preparation and calm response. And the connective tissue between them is that a business which audits itself well is a business that survives a government audit easily, because the records are already in order and the errors are already fixed.
This article spends most of its time on the internal audit, because it is the one you control and the one that protects you from the others. The government-audit response gets its own section near the end.
Why It Matters
Payroll errors are expensive in a way that is easy to underestimate, because each individual mistake is small and the damage is cumulative.
Consider the shape of it. A single misclassified worker does not cost much in any one pay period. But misclassification carries back-tax liability for every year it persisted, plus penalties and interest, and per the IRS the determination turns on a common-law control test across behavioral, financial, and relationship factors, not on what the contract says you agreed to call the relationship. A label does not protect you.
The other reason it matters is trust-fund liability. The income tax and FICA you withhold from employees is not your money; it is held on their behalf. If it goes unpaid, the IRS can pursue the individuals responsible personally, which means the corporate form does not shield you the way it does for ordinary business debts. An audit that catches a deposit problem early is catching it while it is still fixable. The wider compliance picture is in payroll compliance.
How to Run Your Own Payroll Audit
The whole thing is four passes, done in order, because each depends on the one before it. You cannot check the pay until you know the people are right, and you cannot check the filings until you know the pay is right.
If you have fewer than 20 employees, review every file. Sampling is for larger workforces; at your size the whole point is that you can actually check everything. The individual calculation details behind the pay pass are in gross pay versus net pay, and the classification question in the people pass is covered in employee versus contractor.
The Small-Business Payroll Audit Checklist
Here is the whole thing as a checklist you can work through top to bottom. Four blocks, matching the four passes.
The value of a checklist is that it turns an open-ended, anxiety-producing task into a finite list of yes-or-no questions. You are not auditing your payroll in some vague sense; you are answering sixteen specific questions, and when they are all answered, you are done. The withholding and W-4 items connect to federal withholding, and the overtime item to overtime rules.
A Worked Example: The Employee Who Left
Abstractions are easy to nod along with and hard to act on, so here is a concrete one that happens constantly.
A small business has an employee, call her a part-time bookkeeper, who resigns in March. The manager who received the resignation handled it like a person, not a process: warm goodbye, best wishes, done. Nobody deactivated her payroll record. Because she was salaried and on direct deposit, the payments simply continued. No one noticed, because nobody complains about money arriving, and the amount was small enough not to jump out of the monthly totals.
The year-end audit is what surfaces it. The people pass asks a simple question: is everyone on payroll a current, active employee? The answer, for this one record, is no. She left in March. By the time the audit runs in December, nine months of payments have gone to someone no longer employed.
The point of the example is what it reveals about the whole subject. The error was not an arithmetic mistake. It was a records mistake, an accurate record that stopped being accurate the day she left. And that is true of most of what a payroll audit finds, which is why the records themselves are the real subject.
What Audits Actually Find
The specific errors recur across almost every small business, and they cluster into a short, predictable list.
Read down that list and a pattern emerges: most of these are records problems, not math problems. The misclassification is a wrong classification recorded at hire. The ghost employee is a record that was never updated. The stale W-4 is a document that fell out of date. Even the 941-to-W-2 mismatch is really two sets of records that stopped agreeing. Which is the whole thesis of this article: payroll accuracy is downstream of records accuracy, and an audit is how you catch the drift.
How Often to Audit
Annually is the baseline, and for most small businesses the natural time is year end, when you are already reconciling everything to issue W-2s. Fold the audit into that work and it costs almost nothing extra.
Audit more often in three situations. If you are new to running payroll, quarterly for the first year builds the habit and catches beginner errors while they are small. If you are growing fast or hiring frequently, more moving parts means more chances for a record to drift. And certain events should trigger an audit no matter where you are in the calendar.
| Situation | Audit frequency | Why |
|---|---|---|
| Established, stable, few hires | Annually at year end | Folded into your W-2 reconciliation. Enough to catch drift before it compounds |
| New to running payroll | Quarterly for the first year | Builds the habit and catches beginner errors while they are still cheap to fix |
| Growing fast or hiring often | Quarterly | More moving parts, more chances for a record to fall out of date between checks |
| Switching payroll providers | Before and after the switch | Migrations drop or garble data. Audit both sides so nothing falls through the transition |
| Merger or acquisition | As part of the deal | You are inheriting someone else's payroll records, and their errors become yours |
The unifying principle is that the right frequency is however often your payroll changes enough to drift. A stable five-person shop can audit once a year. A company adding people every month should look more often, because the thing an audit checks, whether the records still match reality, changes every time reality does.
The Records That Save You
Everything so far points at the same conclusion: a payroll audit is really a records review, and the records are what determine whether a government audit is an inconvenience or a catastrophe. So it is worth knowing exactly what to keep and for how long.
Per the IRS, you must keep employment tax records for at least four years after the tax becomes due or is paid, whichever is later. Per the Department of Labor, payroll records must be preserved for at least three years and the wage-computation records behind them for at least two. These are federal floors; states can and do require longer.
This is where a records system earns its place. The documents an auditor asks for, offer letters, I-9s, W-4s, timesheets, tax forms, are exactly the documents that should live in an organized personnel file, and keeping them current is what an HRIS is for.
The specific retention timelines by document type are laid out in the records retention guide, and the practical mechanics of keeping everything findable are in how to organize employee files.
What to Do If the IRS or DOL Audits You
This is the section people actually came for, so here it is plainly. A government audit is frightening mostly because it is unfamiliar. The response is more procedural than dramatic.
Understand which audit it is
An IRS employment-tax audit is about your taxes: withholding, deposits, filings, and worker classification. A DOL wage-and-hour audit is about how you paid people: minimum wage, overtime, and exempt-versus-non-exempt classification. They ask for different things, and the notice will tell you which one you are dealing with. The classification question straddles both, which is why exempt versus non-exempt and the Fair Labor Standards Act are worth understanding before you ever get a notice.
The response, step by step
The single most important thing is the one you do before any notice ever arrives: keep your records complete and current. Everything about surviving a government audit reduces to whether the records exist and are organized. An owner who has been running annual internal audits walks into a government one with the work already done. That is not luck. It is the whole reason to audit yourself in the first place, and it is the same records discipline that underlies the rest of small-business employment law compliance.
Frequently Asked Questions
What is a payroll audit?
A payroll audit is a systematic review of your payroll to confirm that the right people are being paid the right amounts, that taxes are withheld and deposited correctly, and that the supporting records exist. The term covers three different things people conflate: the internal self-audit you choose to run, an IRS employment-tax audit that happens to you, and a Department of Labor wage-and-hour audit. The first is a proactive tool you control. The other two are external examinations you respond to. For a small business, the most useful version is the one you run yourself, because doing it well is what makes the external ones survivable.
How do you conduct a payroll audit?
Work in four passes. First, verify the people: everyone on payroll is a current active employee, everyone active is on payroll, and each is classified correctly as employee or contractor, exempt or non-exempt. Second, verify the pay: rates match offer letters, overtime is on the regular rate, hours match timesheets. Third, verify the taxes: withholding matches each W-4, your quarterly 941 totals reconcile to your W-2s, and deposits were on time. Fourth, verify the records: a W-4 and I-9 on file for everyone, and payroll records retained for the legal minimums. Each pass depends on the one before it, so do them in order.
How often should you do a payroll audit?
Once a year is the baseline for most small businesses, typically at year end when you are already reconciling for W-2s. Audit more often if you are new to running payroll, growing fast, or hiring frequently, in which case quarterly is sensible for the first year until the process is routine. Certain events should trigger an audit regardless of schedule: switching payroll providers, an acquisition or merger, a significant change in headcount, or any sign that something is off. The goal is to catch errors while they are small, because payroll errors compound quietly every pay period until someone looks.
What is the difference between an internal and an external payroll audit?
An internal audit is one you run yourself, or have someone in your business run, to catch problems proactively. You control the timing, the scope, and the outcome, and nothing is at stake beyond the work of fixing what you find. An external audit is conducted by an outside party. That could be an accountant you hire, but more often when people worry about external audits they mean a government one: an IRS employment-tax examination or a Department of Labor wage-and-hour investigation. The internal audit is the audit you run. The external one is the audit that happens to you, and the former is your best preparation for the latter.
What triggers an IRS payroll audit?
Several patterns. A mismatch between your quarterly Form 941 totals and the W-2s you issued, which the IRS matches automatically. A worker misclassification signal, often a former contractor filing Form SS-8 to ask the IRS to determine their status, which can open an examination of your whole contractor workforce. A pattern of late or incorrect tax deposits. And random selection or industry-based screening. Many triggers come down to inconsistencies in your own filings, which is exactly why an internal audit that reconciles 941s to W-2s before you file is such effective prevention.
What is the most common error a payroll audit finds?
Worker misclassification is the most expensive, and terminated employees still on payroll is the most common. Misclassification means treating someone as a 1099 contractor who is really a W-2 employee under the IRS control test, which creates back-tax liability for every affected year. The terminated-employee error, sometimes called a ghost employee, means someone who left is still being paid or is still on a benefits roster because their record was never deactivated. Both are records failures rather than math failures, which is why keeping accurate, current employee records is the foundation of payroll accuracy.
How do I prepare for an IRS or DOL audit?
Have your records in order before you ever get a notice, because the preparation window is short. Keep employment tax records for at least four years and payroll records for at least three, with a signed W-4 and completed I-9 for every employee. When a notice arrives, read it carefully to understand the exact scope and period, do not volunteer records outside that scope, gather what is requested and organize it clearly, and consider involving a tax professional or employment attorney early. Stay calm and factual. An audit is a records request, and if your records are complete and organized, it is an inconvenience rather than a crisis.
How long do I need to keep payroll records?
The federal minimums come from two agencies. Per the IRS, keep employment tax records, including W-2s, W-4s, and Forms 941, for at least four years after the tax becomes due or is paid, whichever is later. Per the Department of Labor under the FLSA, keep payroll records for at least three years and the wage-computation records behind them, such as timecards and schedules, for at least two. Form I-9 has its own rule: three years from hire or one year from termination, whichever is later. When rules overlap, the longer period controls, and some states require longer than the federal floor.
Can I run a payroll audit myself without an accountant?
Yes. A small business owner can run a payroll audit without an accountant or an HR person, and for a 5-to-50-employee company it is entirely reasonable to do so. The work is a structured comparison, not advanced accounting: you are checking that records agree with each other. Pull your employee list, your pay records, your tax filings, and your W-4s and I-9s, then work through the four verification passes. If you have fewer than 20 employees you can review every file. The one time to bring in a professional is if your self-audit surfaces something serious, like a likely misclassification, where the fix has tax consequences.
What is a payroll audit checklist?
It is a structured list of what to verify, usually grouped into people, pay, taxes, and records. Under people: confirm everyone paid is a current active employee, no terminated workers remain, and classifications are correct. Under pay: rates match offer letters, overtime uses the regular rate, hours match timesheets. Under taxes: withholding matches each W-4, quarterly 941s reconcile to W-2s, deposits were timely. Under records: a W-4 and I-9 on file for each employee and records retained for the legal minimums. A good checklist turns a vague, anxiety-inducing task into a finite sequence of yes-or-no checks you can actually complete.
Does using a payroll provider mean I do not need to audit?
No. A payroll provider processes what you tell it, and it does not know that an employee left, that a W-4 changed, or that a contractor should have been classified as an employee. Those inputs come from you. The provider also does not assume your legal liability: if it fails to deposit your taxes, the IRS pursues you, not the provider. An audit checks the inputs and the outcomes the provider cannot verify on its own. So a provider reduces arithmetic errors but does not remove the need to periodically confirm that the underlying records are accurate and current.