Access Control Failure in a Payroll System and the Reliability of Reports
At Northgate Manufacturing, the payroll system is administered by a single IT officer, Mr. Reyes, who has 'super user' rights to create users, change pay rates, and process the pay run. The HR manager maintains employee master data in a spreadsheet that is emailed to Mr. Reyes each fortnight; Mr. Reyes then keys changes into the payroll system. There is no independent review of the pay run before funds are released, and the bank file is uploaded by Mr. Reyes using a token he alone holds. During the year, two ghost employees were allegedly added and paid $38,000 before being detected by a bank reconciliation query. Management wants to rely on the payroll system for the financial report and has asked the auditor to 'just test the totals.' The auditor observes that the system produces a payroll exception report, but no one has ever reviewed it.
1. Assess the control deficiencies in the payroll process and their effect on the auditor's ability to rely on the system.
Read the worked answer
Key deficiencies: (1) segregation of duties - Mr. Reyes can create users, change rates, process pay, and release the bank file, so one person controls the entire cycle; (2) no independent review or approval of master-data changes; (3) HR data passes through an uncontrolled spreadsheet and manual re-keying, creating error and fraud risk; (4) no review of the pay run before payment; (5) the exception report exists but is never used, so it provides no control assurance.
These are pervasive weaknesses over a significant transaction cycle. The ghost-employee incident confirms the risk materialised. The auditor cannot rely on the system's internal controls as designed; the control environment is weak. 'Testing the totals' alone is insufficient because the totals can be internally consistent while containing fictitious payees.
The auditor should document the deficiencies, assess control risk as high, and plan substantive procedures: detailed payroll testing to employment records, confirmation of existence of employees, review of the exception report, analysis of pay-rate changes, and bank-file reconciliation.
2. Recommend the control improvements Northgate should implement, and explain how the auditor should respond in the current audit.
Read the worked answer
Recommended improvements: separate the duties of user administration, master-data maintenance, pay-run processing, and bank-file release; require dual authorisation for pay-rate and new-employee changes; replace the emailed spreadsheet with a controlled interface or approved change form with HR and payroll sign-off; institute independent review and sign-off of the pay run and exception report before release; restrict and log super-user access; and reconcile the bank file to the approved pay run.
Auditor response this year: treat the payroll cycle as high risk; perform substantive tests of details over the full year, including matching employees to tax and identity records, testing new employees and rate changes, recalculating a sample of pays, reviewing the exception report and bank reconciliations, and investigating the $38,000 ghost-employee loss. The auditor should communicate the deficiencies to those charged with governance in writing (management letter) and consider whether the fraud indicates a risk of material misstatement requiring extended procedures, including journal-entry testing and management-override inquiries.
3. Management argues the ghost-employee loss is immaterial and the auditor should not raise it with the board. How should the auditor respond?
Read the worked answer
Materiality is not the only test. A fraud involving fictitious employees is qualitatively significant regardless of the $38,000 amount: it indicates management override or collusion, undermines the reliability of payroll data, and may signal a wider scheme. Professional standards require the auditor to communicate fraud and significant deficiencies in internal control to those charged with governance on a timely basis.
The auditor should not agree to suppress the matter. The auditor should report the deficiency and the fraud to the board or audit committee, document management's request and the auditor's response, and consider the implications for the audit opinion if the financial report is materially misstated or if management lacks integrity. The auditor should also assess whether the matter affects other areas (e.g., related-party transactions, expense claims) and whether the fraud is required to be reported to a regulator. Suppressing a known fraud would breach the auditor's ethical and professional obligations.