UNIVERSITY OF JOHANNESBURG

DEPARTMENT OF ACCOUNTANCY

Auditing 300/BCTA

2024

Payroll cycle
Index:

A PRE-READING
B INTRODUCTION
C CHARACTERISTICS OF THE CYCLE
D CONTROLS IN THE CYCLE
E SUMMARY OF THE CYCLE
F QUESTIONS RELATING TO THIS TOPIC

PART A: PRE-READING

Nedbank paid its top execs over R200 million – here’s how much they each
banked BusinessTech 2023-04-14

Nkomazi Local Municipality

Nedbank published its annual report for 2022 in the second half of March 2023,
showing how much its executives were paid – including CEO Mike Brown.

The bank’s financial results for the year ended December 2022 showed strong
growth in headline earnings, which increased by 20% for the year to R14 billion.

Growth in earnings was driven by strong double-digit revenue growth, a slightly

higher credit loss ratio and a well-managed expense base, it said.

Return on equity (ROE) increased to 14%, above the prior period of 12.5%,
assisted by the group’s improved return on assets which increased from 0.98% to
1.14%.

On the back of strong earnings, growth and capital and liquidity positions, the
group declared a final dividend of 866 cents per share, up by 14% (December
2021: 758 cents per share), bringing the total dividend for 2022 to 1 649 cents
per share, up 38%, both at record levels for the group.

Brown said that the excellent progress in 2022 was enabled by strategic value
drivers of growth, productivity, and risk and capital management.

Given Nedbank’s strong 2022 performance, it has set revised medium-term

(2025) and long-term targets, he added.

“In 2025, we aim to achieve an ROE of 17% (around COE plus 2%) and a cost-to-
income ratio of 52%.

“Over the longer term, we aim to improve these to above 18% (around COE plus
3%) and below 50%, respectively. Achieving these targets should be value-
creating for shareholders,” said Brown.
He also thanked Nedbank’s dedicated employees for their commitment and hard
work in difficult conditions and extended his thanks to its more than 7 million
retail and wholesale clients, investment community, and other stakeholders for
choosing to bank with Nedbank every single day.

Executive pay

Nedbank paid its top seven executives a combined R203 million in 2022,
averaging R29 million per executive.

Brown was the best paid, taking home a total package of R43.6 million for t he
year.

This included a guaranteed salary of R9.6 million, a cash bonus of R17 million (of
which R9 million was delivered in shares), and a short-term incentive payout of
R17 million – giving a single-figure remuneration of R43.6 million.

Managing executive Anél Bosman took home just under R31.6 million, followed
by chief operating officer, Mfundo Nkuhlu, with R30 million and chief financial
officer, Mike Davis with R28.1 million.

A full breakdown of executive pay is below:

Per day comparison

Brown’s executive pay translates to around R119,452 a day (over 365 days).

However, it must be noted that Brown’s salary is below his remuneration received
in pre-Covid 2019, where he earned R53 million. This works out to a 21.5% cut in
his salary.

Based on Nedbank’s staff costs (R19.9 billion) and employee figures (25,924), the
average employee at the bank earns R769,171 a year, or R2,107 a day.

The table below outlines what Nedbank’s top executives earned and how that
translates per day.

Employee Total Remuneration Average per day

M Brown R43.6 million R119,452
A Bosman R31.5 million R86 438
M Nkuhlu R30.08 million R82 410
M Davis R28.1 million R76 986
C Thomas R28.4 million R77 808
I Ruggiero R20.7 million R56 712
T Sibiya R20.6 million R56 438
Nedbank average R769 171 R2 107
 PART B: INTRODUCTION

1. INTRODUCTION OF THE TOPIC

The payroll expense is the one of the major expenses of an organisation.

Inherently this is a high-risk cycle since cash is involved. Although many

businesses are trying to move away from using cash to pay wages by making
payments directly into bank accounts, extensive use of cash is still made as
many wage earners prefer cash and may not operate using bank accounts.

Salaries & wages are also usually internally generated, and, unlike the purchases
and payments supported by external documentation, (e.g. a supplier’s invoice) it
is reasonably easy to create fraudulent outflows if controls are not sound e.g. by
creating fictitious hours worked or fictitious employees.

In this module we will explore the activities surrounding the payroll cycle and the
controls that should be implemented to ensure that fraudulent activities do not
take place.

2. PRIOR KNOWLEDGE

You are not expected to have any prior knowledge of the topic.

3. RESOURCES

In order to master this topic, you should make use of the following resources:

3.1. Pre-reading;
3.2. Lectures;
3.3. Module;
3.4. Question Bank.

4. STUDY OUTCOMES

After you have completed your studies of this topic you must be able to:

4.1. Understand the functions/activities/processes within the cycle;

4.2. Understand the source documentations related to the functions/activities
and processes.
4.3. Identify risks in the cycle;
4.4. Recommend controls to be implemented to mitigate risks.
4.5. Gather audit evidence in relation to the affected account balances and or
transactions.

5. EXAMINATION POSSIBILITIES

The topic can be tested in any one of the following ways:

• Scenario based application.
 PART C: CHARACTERISTICS OF THE CYCLE

The payroll cycle consists of five functions which will be explored throughout this
module. These functions are:

1) The human resources function;

2) The timekeeping function;
3) The payroll preparation function;
4) The payment preparation and payout function;
5) The deductions: payments and recording function.

Accounts affected by this cycle:

1) Within the Statement of Comprehensive Income

o Gross salaries;
o Wages;
o Commissions;
o Bonuses;
o Manufacturing wages;
o Directors’ emoluments;
o Employer contributions.

2) Within the Statement of Financial Position

o Employees for remuneration accrued;
o Accounts payable (Payroll deductions, eg: Medical aid, SARS,
Pension funds);
o Accounts payable (Employer contributions);
o Various bank accounts.

A typical journal entry to be processed every month at month end will look as
follows:
DR. Salaries and wages
CR. Bank (Payables?)

Tax (PAYE) and other contributions by the employer on behalf of the employee
are also recorded at each month end (better known as deductions). A liability will
initially be raised. A typical journal that will be passed will look as follows:
DR. PAYE / medical aid / pension fund
CR. SARS / Discovery Health

When payment is made to the payable, the liability is then reversed as follows:
DR. SARS / Discovery Health
CR. Bank

Having identified the affected accounts, we will commence with the exploration of
the functions mentioned earlier on an individual basis starting with the human
resource function. It is important to explore the relevant documentation within
each function. Following the above, we will look at the risks that exist within each
function, as well as the controls that should be in place to ensure that the
associated risk is reduced.

It is important to note that the following system description is for a company with
the necessary staff & capacity to ensure the necessary levels of segregation of
duties between each function.
 1) HUMAN RESOURCES

Description of the function

The objective of this function is to ensure that all matters relating to the personnel
department are properly maintained. This department deals with all aspects of
the human capital of the company and therefore, should be skilled in recruiting,
counseling, negotiating and labour law. They will be responsible for keeping all
employee records (i.e. employee permanent file), focus on the hiring and
dismissal of staff, and ensuring that pay rates and changes thereto are
implemented promptly. It is important that accurate and complete records for all
valid employees are maintained by this department as this facilitates the
provision of information necessary to produce valid clock cards or timesheets for
record keeping purposes.

Documentation used

o Employee’s file;
o Payroll amendment forms;
o Updated list of employee details.

Risks in this function

o Unsatisfactory or unnecessary employees may be recruited or

retained;
o Dismissal of employees for which the correct procedures were not
followed;
o There may be staff that are not necessarily needed, but are retained
because of inefficiencies in the human resources department;
o Employee details could be fraudulently amended to include fictitious
employees, or to change the rates of pay applicable to an employee.

The controls that should be implemented within this function to mitigate

risks to an acceptable level should include:

o Interviews should be conducted with all applicants & the head of the
department in which the applicant is going to work should be present.
o All appointments and dismissals/resignations should be authorised and
approved by a senior official on supporting documentation.
o Changes to pay rates, promotions to higher employment grades and
any other changes in service conditions should be decided upon by the
human resource department after consultation with all interested
parties (e.g. unions) and consideration of relevant laws and regulations
(e.g. minimum wage regulations).
o All changes should be documented and approved by the authorising
body (e.g. wage committee)
o All these amendments should be recorded on sequentially pre-
numbered payroll amendment forms and supported by further
documentation. These documents should also be authorised and
signed by senior management.
 o All of the above documents should be maintained in each employee
file. This will include documents such as application form, personal
details of each employee, letter of appointment, IRP5, authorisation in
respect of deductions, employment contracts and payroll amendment
forms.

2) TIMEKEEPING

Description of the function

This function is necessary to keep an accurate and complete record of valid

hours worked for which the company must remunerate employees, i.e. the
company needs to ensure that all employees are paid for only the hours that they
worked. This relates mainly to wage earners, as salary earners usually get paid
at the end of the month, and it is usually a fixed amount. Wage earners, on the
other hand, get paid weekly and their remuneration will vary depending on the
hours that they have worked during that specific week. Keeping a record of wage
earners’ hours can be achieved by requiring the employee to pass a clock card
or swipe through a time clocking device which will automatically record the time
of either entry or exit. On a weekly basis, daily hours clocked will be calculated
and totaled before being sent to the next function – the payroll preparation
function.

Documentation used

o Blank clock cards;

o Hours recorded on clock;
o Batch control sheet and batch register.

Risks in this function

o Fellow employees can clock in for an absent employee, therefore

resulting in recording of invalid hours;
o Clock cards could be made out and clocked for a fictitious/ghost
employee, thereby facilitating the payment of wages to fictitious/ghost
employees;
o Errors could be made by the payroll department in calculating and
collating information on the clock card for recording, e.g. hours worked,
and rates used etc.

The controls that should be implemented within this function to reduce

risks to an acceptable level should include:

1. Clock cards should:

o be numerically accounted for (sequence check);
o be issued by the personnel department and prepared from personnel
records/master file;
o be stored at clock machine, under supervision, not with the
employees).
 2. Entry and exit points to the work area should:
o be limited to one access point;
o protected by a “turnstyle” type mechanism;
o be supervised during clocking periods.

3. Clock procedures:
o the clocking machine should be situated at the entrance/exit to ensure
that personnel may not leave premises without clocking in/out;
o supervision over the clocking of employees (prevent employees from
clocking in for absentees).

4. The foreman should:

o keep a record of personnel present and time worked;
o sign clock cards as evidence of approval of hours worked by the
employee.
o the foreman’s clock card should be approved by a senior official (eg.
factory manager).

5. Overtime should:
o be authorised according to the company policy by the factory manager
or foreman.
o the foreman’s overtime is authorised by the factory manager.

3) PAYROLL PREPARATION

Description of the function

The aim of this function is to calculate gross wages, deductions from employees
(which must be paid over to the relevant authorities) and net wages.

As mentioned earlier during the analysis of the timekeeping function, at the end
of each week the details on the clock cards need to be calculated and collated so
that the payroll can be drawn up. This involves calculation of all the hours worked
and must be split between overtime and normal hours as the rates per hour for
these two categories are different. Total hours worked by an employee, multiplied
by the corresponding rate per hour as per the employee’s permanent file, would
equal to the amount that the employee is to be paid for the week. It is very
important to remember that in this function appropriate deductions (e.g. PAYE)
must be extracted from authorised, up to date tables or, in the case of other
deductions, (eg Pension Fund) must be deducted in terms of the authorisation
form completed by the employee. This information is then recorded on the
payroll, also referred to as the wages journal.

Documentation used

o Clock cards;
o Updated list of employees;
o Payroll (wage journal);
o Week to week reconciliation.
Risks in this function

o Errors may be made due to incorrect calculations and casting thereof;

o The company may use incorrect or unauthorised pay rates, hours or
deduction tables during recording;
o Fictitious employees may be included fraudulently.

The controls that should be implemented within this function to reduce

risks to an acceptable level should include:

o The hours recorded on the payroll should be obtained directly from the
clock card or computer-transaction file;
o The wage rates, deductions should be obtained from personnel
records or master files;
o The calculations and castings should be reviewed by an independent
person (e.g. one wage clerk checks another clerk work/edit checks);
o Before payments can be authorised, the senior personnel should
inspect the payroll and the week to week reconciliations performed;
o All personnel should sign payroll as proof of functions performed.

4) PAYMENT PREPARATION AND PAYOUT

Description of the function

The objective of the function is to ensure that employees are paid their wages for
only the hours which they have worked. As wages are paid out weekly, it is done
either on a cash basis, or paid electronically by means if EFT, or instant
payments such as eWallet, cash send geo-payments etc. The employee must
sign a wage collection register after the collection of his/her wages. Employees
will also receive a pay slip, indicating how much they have earned, and the
amount of money that should be included in their pay packets. The pay packets
should be distributed at the respective paypoints of the employees. The
employees should count their cash immediately upon collection and compare it to
the pay slips. Any discrepancies should be queried immediately. Where an
employee is absent during the pay out of wages, the wages remaining are known
as “unclaimed wages”. Unclaimed wages must also be recorded and stored in
the company safe until it is collected by the employee
Documentation used

o Authorised payroll;
o Payroll;
o Payslips;
o Paypackets;
o Unclaimed wages register.

Risks of this function

o Since the payment function is performed by mostly working with cash,

there is a risk that clerical errors could occur, as well as theft when
 cash is actually being paid to employees, or when the pay packets are
being made up.
o There is also a risk that there could be a misappropriation of the
unclaimed wage packets.

The controls that should be implemented within this function to reduce

risks to an acceptable level should include:

1. The EFT schedule should be signed by two signatories, one of whom

must be senior management:
o The EFT schedule together with the current and previous payroll and
supporting documentation in respect of appointments, dismissals and
increases should be presented to the signatories for authorisation;
o A senior employee should compare the payroll to the EFT schedule;
o The current payroll should be compared with the previous payroll and
the validity of all changes to supporting documentation must be
ascertained;
o The payroll and documentation should be signed/stamped as
cancelled after approval.

2. The withdrawal of cash from an ATM to pay salaries/wages:

o by two or more persons;
o not at regular times;
o not travelling on the same route.
o It is preferable to make use of a security company to do wage payouts.

3. The make-up of wage packets should:

o be done by two wage department members and physical security over
all aspects of cash handling should be extremely tight;
o preferably be done by independent persons not involved with the
preparation of the payroll;
o the wage details should appear on the wage-packet (gross wage,
deductions);
o the money in the wage-packet should be independently reviewed.

4. The payout:
o should be done by personnel not involved with the compilation of
wages;
o The foreman must identify all employees; however, the payout must
not be done by himself;
o the employees should sign payroll as proof of receipt;
o the foreman should sign payroll after payout as proof of supervision
and identification of employees.

5. Unclaimed wages:
o at the end of the payout: the paymaster and the foreman who
conducted the payout should agree all unclaimed pay packets to the
payroll (i.e unsigned entries). Once all employees who have not
claimed the pay packets have been identified, details of unclaimed
 wages should be entered in an unclaimed wage register. The payroll
should be signed as evidence of performing the control procedure;
o unclaimed wages and payroll should be retained by the paymaster who
should lock them away;
o regular, independent reconciliations of unclaimed wages on hand and
the register should be performed and the register should be reviewed
for unusual occurrences;
o unclaimed wages remaining uncollected after two weeks should be
banked and a copy of the deposit slip attached to the register.

6. Online payments
o A separate checking account should be opened, that is used
exclusively for processing electronic payments for salaries and
wages;
o Log-in to the bank account should be protected by two-factor
authentication;
o Senior management must review and approve all electronic
transfers processed;
o Employees bank details should be saved as beneficiaries;
o Senior management must review online bank statement activity on
a continual basis to quickly detect unauthorized electronic transfers

5) DEDUCTIONS: PAYMENTS AND RECORDING

Description of this function

It is the responsibility of the company to hold back certain portions of the wages
earned, due to statutory requirements, such as PAYE. The portion held by the
company does not belong to the company and the company has a responsibility
not only to pay the correct amount over the relevant authorities, but also to do so
within the correct period. The objective of this function is to ensure that these
amounts owed to the relevant authorities are correct, paid over within the
required period, and are supported by the relevant supporting documentation or
return.

Documentation used

o General ledger;
o Payroll (wage journal);
o Cash payments journal;
o Return form.

Risks in this function

o Non-compliance with laws and regulations.

o Fraud (cash involved).

The controls that should be implemented within this function to reduce

risks to an acceptable level should include:
 o Appointing risk compliance officers.
o Risk management policies.

PART D: CONTROLS WITHIN THE CYCLE

Now that you are familiar with the functions and risks inherent in this cycle, you
need to gain an understanding of the controls that need to be implemented to
mitigate the evident risks. This section will also take it a step further and test the
implementation of the control. The table below also explains the objective of each
control.

GENERAL CONTROLS

• Supervision and review by management;

• Segregation of duties;
• Rotation of duties;
• Personnel take leave regularly;
• Internal audit function;
• Sufficient stationery control;
• Scrutinise all records and documents for extraordinary/unusual items;
• Test castings and calculations on all selected items, documents and
ledger accounts.

NB: Always remember your general controls. These controls are

applicable to all the cycles. The marks are however not merely for listing
these controls, but in making them applicable to the specific cycle.

Validity and Authorisation:

All recorded wages are valid and supported by proper documentation

1) The total wages, deductions 1) Inspect the payroll for signature of the
and payroll are reviewed by senior official evidencing for proof of review
senior employee, and signed as and approval
evidence of this check.

2) There should be complete 2) Select a sample of employee files and:

records kept for every employee, -Inspect the documentation in the
in the employee file. Further, the employee’s personnel file, employee
foreman should be aware of the contract, identity details, tax form etc.
number of employees working Ensure that documentation is complete.
under him. -By observation, physically verify employees
-Enquire of the foreman to vouch for the
validity of staff whom you have not physically
verified.

Completeness:
All valid payroll transactions are recorded and nothing is left out

1) During the wage payout, every 1) Attend on a surprise basis the wages
employee should collect only his payout in order to verify the validity of
own pay packet, and should sign employees on the payroll, and
once payment has been collected. observe compliance with the listed
Employees should not be allowed procedures.
to collect payments on behalf of -Observe whether each
other employees. employee collects their own
payment and signs for it.

2) There should be sufficient 2) Enquire of personnel regarding the

segregation of duties in the following:
payroll cycle, and sufficiently a. The level of segregation of
documented procedures with duties in the payroll cycle.
regard to granting of staff loans. b. The procedures regarding staff
loans and compliance to laid
down procedures.
c. Inspect policy on granting of
staff loans.

3) There should be strict and tight 3) Inspect policy regarding clocking in of

controls over the clocking in of employees, the preparation of the
employees, the preparation of the payroll and the payment of wages.
payroll and the payment of the 4) Observe the procedures i.r.o.:
wages, as described above in the i. clocking in of
module. employees;
ii. preparation of the pay-
roll;
iii. the make-up and payout
of wages.
b. Through enquiry and
observation, confirm that the
procedures are complied with,
and that sufficient controls and
segregation of duties exist.

Accuracy:
Payroll transaction are shown at the correct amounts

1) The Human Resources 1) Select a sample of payroll runs and:

manager should review and -Compare the payroll totals with the wage
authorisation (via signature) the EFT schedule and EFTs iro other
payroll after performing the deductions
following: -Follow through to EFT / any proof of
-the total per the payroll agrees payment and ensure that two signatories
to the sum of the EFT paid over to have signed as evidence of review and
the employee and the EFT paid authorisation for payment.
over to the relevant authorities.

Recording:
All purchase transactions are correctly recorded
1) The hours recorded on the 1) From a payroll run, select a sample of
payroll should be obtained recorded hours. Match these hours to a
directly from the clock card clock-card machine report or computer-
machine report or computer- transaction file. Follow any deviations
transaction file. with management.

2) The wage rates, deductions 2) From a payroll run select a sample of

should be obtained from employees. For these employees match
personnel records or master the wage rates used and other
files. deductions to their respective personnel
records. Follow any deviations with
management.

3) The calculations and castings 3) Re-perform all castings and calculations.

should be reviewed by an Agree your calculations with those
independent person (e.g. one recorded in a sample of payroll. Follow
wage clerk checks another any deviations with management.
clerks work/edit checks). The 4) Inspect a sample of payroll runs for
reviewer needs to sign as evidence of review. Follow any deviations
evidence of review. with management.

4) Before payments can be 5) Inspect management’s payroll

authorised, senior personnel, reconciliations. Follow any deviations
should inspect the payroll and with management.
week-to-week reconciliations
need to be performed.

5) All personnel should sign 6) Through enquiry of management, gain an

payroll as proof of functions understand of different functions
performed. performed and by whom they are
performed.
7) Select a sample of payroll runs and
inspect for different functions performed
by verifying various signatures.
8) Follow any deviations with management.

Cut off:
All payroll transactions are recorded in the correct reporting period

1) A strict monthly schedule 1) Request and inspect the policy on

should be developed for: how and when liabilities are raised
a) Posting the entries to raise and then paid.
the liabilities for the 2) Select a few months and inspect that
deductions, entries are raised on time.
b) Making the necessary 3) For the same sample confirm through
payments on a timeous inspection that liabilities are settled
basis, and timeously.
c) Supervisory checks on the 4) Follow any deviations with
above activities management.
 PART E: QUESTIONS RELATING TO THIS TOPIC

QUESTION BANK

Please find attached the questions relating to this cycle as well as solutions in the
question bank.