Conflicting Timekeeping Evidence and a Ten-Day Deadline
During a payroll audit at a municipal transit authority, the auditor finds 43 employees with overtime payments exceeding 35% of base salary in a six-month period. The payroll system report shows supervisor approvals, but the timekeeping system has no record for 11 of those employees for three pay periods. The HR director says the timekeeping system is 'unreliable after the upgrade' and provides an email from IT confirming an outage, but the email is undated and refers to 'last month.' A sample of 25 timesheets shows four with signatures that appear to be in the same handwriting. The payroll manager offers a verbal explanation that supervisors sometimes sign for absent staff. The auditor has 10 days left and no data analytics specialist. The audit objective is to determine whether overtime was authorized and paid in accordance with policy.
1. Assess the reliability and sufficiency of the evidence gathered so far.
Read the worked answer
The evidence is not yet sufficient. The payroll system report is reliable for payments but its approvals may be after-the-fact and do not prove hours were worked. The timekeeping system has missing records for 11 employees over three pay periods, which undermines completeness. The IT email is weak: it is undated, refers vaguely to 'last month,' and does not identify the affected employees or periods.
The four signatures in the same handwriting raise a red flag, but handwriting comparison is not a reliable audit conclusion without expert examination; it is an indicator, not proof. The payroll manager's verbal explanation is the least reliable evidence and may itself indicate a control breakdown.
The auditor should not conclude that overtime was unauthorized or that fraud occurred. The objective requires evidence that authorization was valid and payment complied with policy. The auditor needs corroboration from independent sources, a larger and better-targeted sample, and system logs. Document the reliability of each source and the unresolved gap.
2. Design additional procedures to resolve the conflicting evidence within the remaining time.
Read the worked answer
Additional procedures should triangulate time, approval, and payment. Obtain system outage tickets and logs with dates and affected modules, and ask IT to identify the 11 employees and the three periods. Pull approval timestamps and user IDs from the payroll workflow, then compare them with shift schedules, badge or access logs, and supervisor rosters.
Interview the supervisors for the 11 employees separately, using open questions, and ask them to explain the four signatures. Recompute overtime from timekeeping and payroll data, test the full population for payments without matching time records, and review whether policy permits retrospective approval. Examine whether supervisors can approve their own or each other's time.
If handwriting concerns persist, refer to a qualified forensic examiner rather than making a finding. Use data analytics if available, or a simple spreadsheet matching exercise if not. Keep a chain of custody for extracted reports and document queries, dates, and results.
3. If the evidence remains insufficient, how should the auditor report and document the conclusion?
Read the worked answer
If the procedures still do not produce sufficient evidence, the auditor must not issue a clean conclusion. Report a scope limitation caused by unreliable timekeeping records and missing documentation, state what was tested, what could not be concluded, and what management needs to fix. Distinguish control deficiencies that are supported, such as missing records, retrospective approvals, and unclear signatures, from unproven allegations. Do not name employees as fraudulent.
Document the work performed, evidence reliability, management explanations, and the reviewer's concurrence. The engagement report can conclude that authorization controls were not consistently evidenced, while noting that the dollar effect is unknown. If fraud indicators remain, refer them through the CAE under the fraud policy rather than resolving them in the audit report.
The workpapers should show the 10-day constraint, the requests made, and management's response, so the limitation is attributable to conditions rather than inadequate audit effort.