Payroll Process Steps and Internal Controls

2026-09-17 · Tommaso Maria Ricci

Before you can fix payroll you have to see it clearly, and the payroll process steps and internal controls behind it are almost never written down anywhere. Here is what that costs. The average company runs an eighty percent payroll accuracy rate and makes fifteen corrections every single pay period, at an average cost of two hundred eighty one dollars in direct costs plus ten dollars in indirect costs per incident. Those are EY numbers, reported in detail by HR Dive, along with a figure that should stop any operations leader cold: missing or incorrect time punches alone cost around seventy eight thousand seven hundred dollars per thousand employees per year. Run the arithmetic on a biweekly cycle and a mid sized employer is spending six figures annually correcting a process everybody assumes is already solved.

That is the real subject of this guide. The payroll process steps and internal controls that separate a payroll function that runs quietly from one that eats finance hours, generates penalties, and erodes trust with the people it pays. This is not a software comparison. It is the operating model, the control layer underneath it, and the compliance floor that decides how much room you actually have to design things your own way.

Payroll is not a task, it is a four phase cycle

Most companies describe payroll as the thing that happens on Thursday before a Friday pay date. That framing is the root of the problem, because it hides three quarters of the work.

Payroll is a cycle with four phases, and each phase has a different owner, a different failure mode, and a different cost when it breaks.

Phase one is capture. Hours, absences, overtime, shift differentials, commissions, bonuses, expense reimbursements, benefit elections, garnishments, new hires, terminations. This phase happens continuously across the pay period, mostly outside the finance function, and it is where roughly eighty percent of errors are born.

Phase two is calculation. Gross to net. Taxable wages, pre tax deductions, employer and employee tax withholding, post tax deductions, net pay. This phase is largely automated and is the phase people worry about most, which is exactly backwards.

Phase three is disbursement and filing. Funding the account, transmitting the payment file, depositing employment taxes on the correct schedule, remitting garnishments and benefit contributions, filing the returns.

Phase four is reconciliation and control. Payroll register against the general ledger, tax liability against deposits made, headcount against the roster, accruals against balances. This phase is the one companies skip when they are busy, and skipping it is how a small error survives for four quarters and turns into an amended return.

The useful consequence of this framing is a diagnostic. When something goes wrong in your payroll, ask which phase it came from. Nearly every recurring problem traces back to phase one or phase four, almost never to phase two. Companies that respond to payroll pain by shopping for new calculation software are treating the one phase that was already working.

The twelve steps of the payroll process, end to end

Here is the full sequence, written the way it actually runs rather than the way vendors diagram it. If your documented process has fewer than these twelve steps, the missing ones are happening anyway, just without an owner.

Maintain the employee master. New hires, terminations, status changes, pay rate changes, tax withholding elections, direct deposit details. Every downstream error has a decent chance of starting here.
Collect and approve time. Hours worked, exempt and non exempt classification applied correctly, overtime computed on the right base, meal and rest breaks where state law requires them.
Collect variable pay. Commissions, bonuses, tips, piece rates, shift and on call differentials, retro pay from a late rate change.
Apply absences and accruals. Paid time off taken, sick leave under state and local mandates, leave of absence status, accrual earned during the period.
Import third party inputs. Benefit deductions from the carrier or broker file, retirement contributions, garnishment orders, expense reimbursements approved under your policy.
Run a preliminary calculation. This is a draft, not the payroll. Its only job is to be reviewed.
Review the exception report. Not the whole register. The exceptions: negative net pay, gross change beyond a threshold you set, new bank details, terminated employees still being paid, hours above a ceiling, zero hour actives.
Obtain approval from someone who cannot change the data. This is the single most important control in the entire process, and it is covered in detail below.
Fund and transmit. Confirm the account has cleared funds, transmit the payment file, confirm receipt rather than assuming it.
Deposit employment taxes on schedule. Federal on your assigned schedule, state and local on theirs, which will not match.
Remit third party payments. Retirement contributions, garnishments, benefit premiums, union dues. Each has its own deadline and its own penalty regime.
Reconcile and close. Register to general ledger, liabilities to deposits, quarterly wage totals to what you will file on Form 941.

Steps seven, eight and twelve are the ones that get skipped under time pressure, and they are precisely the three that exist to catch the errors created by steps one through six.

Where the money actually leaks

In every payroll review I have run, the losses cluster in the same six places. None of them are calculation errors.

Classification. Exempt versus non exempt applied out of habit rather than duties tests, and independent contractors who function as employees. This is the most expensive single error category in American payroll because it compounds: back overtime, liquidated damages, employment taxes, and interest, across every affected worker and every pay period since the misclassification began.

Time capture on hourly workforces. Rounding practices applied inconsistently, unapproved overtime that nobody sees until it is paid, shifts entered from memory days later. In any business with hourly staff across multiple sites, this line alone usually exceeds the total cost of the payroll system. The upstream fix is rarely a payroll fix at all: it sits in how shifts are planned in the first place, which is why this problem and workforce scheduling are the same problem viewed from two ends.

Retro pay and late changes. A rate change approved on the fifth, entered on the twentieth, effective the first. Every one of these generates a correction, and corrections are where the two hundred ninety one dollars of direct and indirect cost per error comes from.

Termination handling. Final pay timing rules vary sharply by state, from immediate to the next regular pay date. Accrued and unused leave payout rules also vary. The company that applies one national rule is wrong in several states, and the penalty is per employee.

Duplicate and ghost payments. Rare in absolute terms, expensive when they happen, and almost always traceable to a missing segregation of duties, meaning the same person could add a payee and approve the payment.

Reconciliation drift. Small differences between the payroll register and the general ledger, carried forward because nobody has a mandate to chase them. They are not material in month one. They are material at the quarterly filing.

The pattern is clear: payroll losses are process losses and control losses, not arithmetic losses. Any improvement plan that starts with software rather than with the control layer is solving the wrong problem in an expensive way.

The control layer: five controls that do most of the work

Internal controls in payroll have a reputation for bureaucracy they do not deserve. Five of them do most of the protective work, and none of them require a large finance team.

Segregation of duties between master data and payment. The person who can add an employee, change a bank account, or change a pay rate must not be the person who approves the payroll run. In a small company where that separation is impossible inside finance, move the approval outward: an owner, a general manager, a board member. A reviewer who does not understand payroll deeply but who cannot change the data is worth more than an expert reviewer who can.

Exception review instead of full review. Reviewing an entire register is theater. Nobody reads three hundred lines carefully at six in the evening. Define six to eight exception rules with thresholds, and review only what trips them. Gross pay changed more than fifteen percent versus prior period. Net pay negative or zero. Bank details changed in the last thirty days. Employee flagged as terminated with pay. Hours above a set ceiling. New payee in first cycle. This takes twenty minutes and catches more than an hour of scrolling.

Bank detail change protocol. Any change to direct deposit details is confirmed through a channel other than the one that requested it, and never by replying to the original message. Payroll diversion fraud works because the request looks entirely normal and arrives from a real looking address. The only reliable defense is a second channel and a mandatory waiting period before the first payment on new details.

Independent reconciliation. Someone who did not run the payroll reconciles the register to the general ledger and the tax liability to the deposits made. Monthly at minimum, and always before a quarterly filing. This is the control that catches errors the other four missed.

A written change log with dates. Every rate change, classification change, and policy change recorded with effective date, approver, and reason. This is not for you. It is for the audit, the claim, or the dispute that arrives eighteen months later, when memory is worthless and documentation is everything. The same logic governs any compliance function inside a business: the record made at the time beats the reconstruction made under pressure.

If you install only one of the five, install the first. Segregation of duties is the control that makes fraud require collusion rather than opportunity, and collusion is rare while opportunity is constant.

The compliance floor in the United States

This is the part you do not get to design. Everything above sits on top of rules that set the outer limits of your process, and misreading them is how a well run company acquires penalties.

Deposit schedules and the lookback period

Your federal employment tax deposit schedule is not a choice. It is assigned based on what you reported during a lookback period, which for Form 941 filers is four quarters. Reported taxes of fifty thousand dollars or less in that window put you on a monthly schedule. More than fifty thousand puts you on semiweekly.

On the monthly schedule, employment taxes for payments made during a month are deposited by the fifteenth day of the following month. On the semiweekly schedule, taxes for payments made on Wednesday, Thursday or Friday are deposited by the following Wednesday, and taxes for payments made Saturday through Tuesday are deposited by the following Friday. The IRS publishes the full rules and the current year calendar on its employment tax due dates page.

Two practical consequences. First, your schedule can change between years as your payroll grows, and the change is not announced by anyone who will chase you about it. Check it every year. Second, if you are on semiweekly, your payroll calendar and your banking cutoffs have to be built around deposit deadlines rather than around pay dates, which is a different planning exercise than most companies run.

What late deposits actually cost

The failure to deposit penalty is tiered by lateness, and the tiers do not stack: the higher rate replaces the lower one. Two percent of the unpaid deposit at one to five calendar days late. Five percent at six to fifteen days. Ten percent beyond fifteen days. Fifteen percent if the amount remains unpaid more than ten days after the first IRS notice, or after a demand for immediate payment. The IRS explains the structure and relief options directly.

Read those numbers as a cash management fact rather than a compliance fact. A ten percent penalty on a deposit is an extraordinarily expensive form of short term borrowing, far worse than any credit line. Companies under cash pressure sometimes delay a tax deposit by a few days as an informal financing decision. At these rates that decision is close to indefensible, and it is also the single clearest signal to any future buyer or lender that the business has a liquidity problem it has not disclosed.

Recordkeeping

Under the Fair Labor Standards Act, payroll records are kept for three years, and records on which wage computations are based, such as time cards and work schedules, for two years. State requirements can be longer, and several states require more. Practically, the retention period that matters is the longest one that applies to you, not the federal minimum, and the safe default in most organizations is longer still because the same records serve employment claims that have their own timelines.

State and local reality

There is no single American payroll. Final pay timing, paid sick leave accrual, pay statement content, wage notice requirements at hire, overtime thresholds for exempt classification, and paid family leave contributions all vary by state, and some by city. A company operating in three states is running three compliance regimes with one process.

The operational rule that follows is simple and widely ignored: register in a state before the first employee works there, not after the first pay run. Retroactive registration is possible and it is unpleasant, and it usually comes with penalties that exceed the cost of doing it in the right order.

In house, outsourced, PEO, or global: the decision that actually matters

The build versus buy conversation in payroll is usually held at the wrong altitude. The real question is not which vendor, it is which operating model, and there are four.

In house with software. You own the process, the vendor provides the engine. Best when your payroll is complex in ways only you understand, such as unusual pay rules, union agreements, or heavy variable compensation, and when you have at least one person whose job includes payroll rather than someone who does it on top of everything else.

Outsourced processing. The provider runs the cycle, you supply the inputs and approve. Best when payroll is standard and your constraint is people rather than complexity. Note the boundary carefully: outsourcing processing does not outsource liability for employment taxes, and the classification decisions remain entirely yours.

Professional employer organization. A co employment arrangement in which the PEO becomes the employer of record for payroll and benefits purposes. Best for small companies that want benefit buying power and compliance coverage more than they want control. The trade is real: switching away from a PEO later is a significant project, and your employee data and benefit relationships live inside someone else's structure.

Global employment through an employer of record. For hiring in a country where you have no entity. Excellent as a bridge, expensive as a permanent state. The usual trigger for moving to your own entity is somewhere around five to ten employees in a single country, at which point the per employee fee exceeds the cost of running the entity.

The honest decision rule I give founders is this. If payroll takes a competent person less than one day per cycle and your exception rate is low, keep it in house. If it takes more than two days per cycle, or if your exception rate is above a few percent, you are paying for outsourcing already and receiving none of the benefits. The same cost logic that governs finance operations at the CFO level applies here: the question is never the vendor invoice, it is the total loaded cost including the hours your own people spend.

If you are weighing this decision right now and want an outside read from somebody who is not selling a platform, write to me with your headcount, the states or countries you operate in, and how long a cycle currently takes. I will tell you which of the four models I would run and what I would fix before changing anything.

What payroll really costs, including the three lines nobody budgets

The visible cost is the per employee per month fee. It is the smallest part.

Internal hours. Count every hour spent across capture, review, approval, funding, reconciliation and correction, by everyone involved including managers who approve time. In most mid sized companies this number is between two and four times the vendor fee. Until you have counted it, every payroll business case you build will be wrong.

Correction cost. Multiply your corrections per period by a realistic unit cost. The EY figure of two hundred eighty one dollars direct plus ten dollars indirect per error is a reasonable anchor for a mid sized company, lower for simple environments and higher for complex ones. This is the line that makes process improvement pay for itself, and it is almost never on the spreadsheet.

The cost of being wrong. Penalties, interest, amended returns, and the professional fees to fix them. This line is zero in most years and very large in one, which is exactly why it gets excluded from averages and exactly why it should not be.

There is also a cost that never appears in any model and matters more than all three: the trust cost. An employee paid incorrectly twice stops believing the company is competently run, and that belief does not stay inside payroll. It shows up in how they read every other promise the company makes.

Seven numbers to run payroll by

If you track nothing else, track these. They fit on one page and they will tell you where the process is failing before anyone complains.

| Metric | How to compute | Healthy range |

|---|---|---|

| Payroll accuracy | Payslips with no correction divided by total payslips | Above 99 percent |

| Corrections per cycle | Count of off cycle payments and adjustments | Trending down, near zero for stable headcount |

| Cycle time | Hours from time approval close to payment transmission | Under one working day for standard payroll |

| Cost per payslip | Total loaded cost divided by payslips issued | Falling as headcount grows |

| On time deposit rate | Deposits made on schedule divided by deposits due | One hundred percent, no exceptions |

| Reconciliation lag | Days from pay date to completed register to ledger reconciliation | Under five working days |

| Exception rate | Payslips tripping an exception rule divided by total | Under three percent |

The one to watch most closely is corrections per cycle, because it is a leading indicator of everything else. A rising correction count almost always means phase one capture has degraded, usually because a manager stopped approving time properly or a new site was onboarded without training.

A ninety day plan to fix a payroll process

This sequence assumes an existing payroll that works but costs too much and errs too often. It does not assume a system change, because in most cases a system change at day one is premature.

Days one to thirty: measure and separate. Count the seven numbers above for the last three cycles using whatever data you have. In parallel, establish segregation of duties between master data changes and payroll approval, and write the exception rules. These two changes cost nothing and are the highest return actions available. Do not change systems, do not change vendors, do not renegotiate anything yet.

Days thirty one to sixty: fix capture. Take the single largest source of corrections identified in the first month and fix it upstream. If it is time approval, set a hard cutoff with a named approver per site and a consequence for missing it. If it is rate changes, move to a single effective date convention with a documented request path. If it is classification, run the duties tests properly and correct going forward with advice. One source, fixed properly, beats five improved slightly.

Days sixty one to ninety: close the loop. Implement independent reconciliation with a named owner and a deadline of five working days after each pay date. Build the payroll calendar for the next twelve months including deposit deadlines, filing dates, and banking holidays, and publish it to everyone who feeds inputs into the cycle. Re measure the seven numbers.

Only after these ninety days does a system or model change make sense, because now you know what you are buying and you can describe your requirements in terms of your own failure modes rather than a feature list. Teams that skip this and buy first usually reproduce the same problems in a more expensive environment, which is the most common outcome I see when a company tells me the new system did not help.

What changes when you cross certain thresholds

Payroll does not degrade smoothly as a company grows. It breaks at specific thresholds, and knowing where they are lets you prepare instead of react.

The second state. The moment an employee works in a state where you are not registered, your single process becomes two compliance regimes. Registration, withholding, unemployment insurance, wage notices and final pay rules all fork. This threshold arrives long before anyone thinks about it, usually with one remote hire, and it is the most common source of retroactive penalties in small companies.

The first hourly workforce. Moving from an all salaried team to hourly staff changes the nature of the work entirely. Capture becomes continuous instead of monthly, overtime calculation becomes a live risk, and break and rest rules enter the picture. Companies that add hourly staff without changing their payroll operating model discover the gap in the first cycle with unapproved overtime.

Fifty employees. Several federal obligations attach at or near this size, and the informal arrangements that worked at fifteen people stop being defensible. This is typically the point where payroll needs a named owner rather than being a shared responsibility.

The first international hire. Every assumption in your process is now optional. Pay frequency, mandatory benefits, statutory notice, termination protection, currency, and data residency all differ. Use an employer of record as a bridge, plan the entity threshold in advance, and do not let the bridge become permanent by default.

The first acquisition or entity merge. Two payroll histories, two sets of classifications, two benefit structures, and one quarterly filing deadline that does not move. Payroll integration is routinely underestimated in deal timelines and is one of the few workstreams where a delay produces an immediate, quantifiable penalty rather than a soft cost.

At each threshold the right response is the same: re run the seven numbers, re check the control layer, and re read the compliance floor for the new jurisdiction. The process that got you here will not survive the next step unchanged, and the cost of finding that out through a penalty is always higher than the cost of checking.

Eighteen questions that stress test your payroll

Answer these honestly. Every no is a task.

Can the person who changes bank details also approve the payroll run?
Do you have written exception rules, or does someone review the whole register?
When did you last verify your federal deposit schedule against the lookback period?
Is there a documented protocol for direct deposit changes involving a second channel?
Who reconciles the register to the general ledger, and are they the same person who ran it?
How many corrections did you make last cycle, and do you know the number without looking?
Do you have a published payroll calendar covering the next twelve months?
Are you registered in every state where an employee currently works?
When did you last run duties tests on your exempt classifications?
Do you know your final pay timing obligation in each state you operate in?
How long does it take to produce an accurate headcount to payroll reconciliation?
What happens if the person who runs payroll is unavailable on a pay date?
Is there a second person who has actually run a cycle, not just been trained on it?
Do managers approve time by a hard cutoff, and what happens when they miss it?
How are retro pay and mid period rate changes handled, and by whom?
Are garnishment orders tracked with their own deadlines and proof of remittance?
Can you produce three years of payroll records and two years of time records on request?
If an employee disputes a pay item from fourteen months ago, can you show the change log?

Questions one, four and twelve are the ones I would fix first in almost any company. Number twelve in particular: an alarming number of otherwise well run businesses have exactly one person who knows how to run payroll, no documented procedure, and no tested backup. That is not a payroll risk, it is a continuity risk, and it usually gets discovered in the worst possible week.

Two patterns from the field

In a hospitality business I worked with, payroll pain was blamed on the provider for two years. The actual cause was upstream: managers approved time on the morning of the run rather than the night before the cutoff, which meant every cycle contained a batch of late entries processed without review. Moving the cutoff by twelve hours and naming an approver per department removed most of the correction volume without touching the payroll system at all. The business went from roughly nine million to ten million in revenue over the same period for entirely unrelated reasons, but the finance team stopped losing two days a month to payroll cleanup.

In a medical services business, the constraint was different. Scheduling and payroll used separate rules for the same shift patterns, so paid hours and scheduled hours never matched and nobody could tell whether overtime was a planning failure or a capture failure. Reconciling the two rule sets was tedious and unglamorous, and it produced around a twenty percent improvement in usable capacity because it surfaced how much staff time was being spent on work nobody had planned. Payroll was not the goal, it was the instrument that made the real problem visible.

Both cases share the same lesson. The payroll process is the most honest report a company produces about how it actually operates, because unlike a forecast it cannot be adjusted to look better. If your payroll is messy, the mess is upstream, and it is telling you something true about how work gets planned and approved. Teams that treat payroll data as an operating signal rather than an administrative chore find things they were not looking for, which is also the most practical argument for bringing modern tooling into HR operations rather than leaving them as the last manual island in the business.

Where payroll meets the rest of finance

Payroll does not sit alone. It shares a boundary with three processes, and problems at the boundary get blamed on payroll.

With expenses. Reimbursements paid through payroll must be separated cleanly from wages for tax purposes, which depends entirely on whether your reimbursement arrangement is accountable. Getting this wrong converts non taxable reimbursements into taxable wages retroactively. The design of that boundary starts with your expense policy, not with the payroll system.

With benefits. Carrier files and payroll deductions drift apart quietly, usually after an open enrollment. A monthly reconciliation between the benefit file and the deduction register catches it. Without one, you find out when an employee's claim is denied.

With the general ledger. Payroll should post to the ledger in a structure that lets you read labor cost by department, site or project without a manual rebuild every month. If your ledger structure and your payroll cost centers were designed by different people at different times, fix that before you add any reporting on top of it.

The unifying idea is that payroll is a data producer for the rest of the business, not a terminal process. Designed that way, it answers questions about labor cost and capacity that finance otherwise reconstructs by hand. Designed as a closed loop that only pays people, it produces nothing beyond the payment itself.

If your payroll currently produces the payment and nothing else, and you want to know what it would take to turn it into a usable operating signal, send me a short description of your setup and the seven numbers if you have them. I will tell you what I would change first and what I would leave alone.

FAQ

What are the payroll process steps and internal controls every company needs?

The process has twelve steps across four phases: capture, calculation, disbursement and filing, and reconciliation. The internal controls that carry most of the weight are five. Segregation of duties so the person who can change master data or bank details cannot approve the run. Exception based review with written thresholds instead of reading the full register. A bank detail change protocol using a second verification channel. Independent reconciliation of the register to the general ledger by someone who did not run the payroll. A dated change log for every rate, classification and policy change. If you implement only one, implement segregation of duties.

How often do payroll errors actually happen?

More often than most leadership teams assume. EY research found that the average company runs an eighty percent payroll accuracy rate and makes fifteen corrections per pay period, with each incident costing around two hundred eighty one dollars in direct costs plus ten in indirect costs. The most expensive single error types were sick time not entered, at roughly seven hundred five dollars, and an employee not entered into the system in time, at roughly six hundred thirty five. A healthy benchmark at the transaction level is accuracy above ninety nine percent, meaning fewer than one payslip in a hundred requires correction. If you do not know your own correction count for the last cycle without looking it up, that is itself a finding, because it means nobody owns the number.

What happens if I deposit employment taxes late?

The IRS failure to deposit penalty is tiered and the tiers replace each other rather than stacking. Two percent of the unpaid deposit for one to five calendar days late, five percent for six to fifteen days, ten percent beyond fifteen days, and fifteen percent if the amount is still unpaid more than ten days after the first notice or a demand for immediate payment. Treat these as financing rates rather than compliance trivia: a ten percent charge for a short delay is far more expensive than any credit facility, which makes deliberate deposit delay one of the worst cash decisions available to a business.

Should payroll be in house or outsourced?

Use time and exception rate rather than headcount as the test. If a competent person completes a full cycle in less than one working day and your exception rate is low, keep it in house and invest in the control layer. If a cycle takes more than two working days, or the exception rate is above a few percent, you are already paying outsourcing prices in internal hours without receiving the benefit. Remember the boundary: outsourcing processing does not transfer liability for employment taxes, and worker classification decisions remain yours in every model.

How long do I have to keep payroll records?

Under the Fair Labor Standards Act, payroll records are retained for three years and the records supporting wage computations, such as time cards and schedules, for two years. Several states impose longer periods, and employment claims often have timelines of their own that outlast both. The practical rule is to retain for the longest period that applies to your situation rather than the federal minimum, and to make sure the records are retrievable in a usable form, since an archive nobody can search is functionally the same as no archive at all.

What is the first thing to fix in a payroll process that keeps producing errors?

Look upstream at capture rather than at calculation, because that is where roughly eighty percent of errors originate. In practice the first fix is usually a hard time approval cutoff with a named approver per site or department, and a consequence when the cutoff is missed. The second is a single effective date convention for rate changes with a documented request path, which removes most retro pay corrections. Do both before changing systems, because a new system inherits bad inputs faithfully and makes them more expensive to correct.