Payroll Security and Audit Flashcards

What is multi-factor authentication (MFA) and why should it be enabled for ADP payroll system access?

Answer: MFA requires users to verify identity through two or more factors (e.g., password + SMS code); it significantly reduces the risk of unauthorized access even if a password is compromised

Multi-factor authentication adds a second verification step to ADP login, protecting against credential-based attacks even when passwords are stolen or guessed.

What is a payroll internal audit and which ADP reports are most useful for conducting one?

Answer: A systematic review of payroll processes, controls, and data accuracy; useful ADP reports include the Audit Trail, Payroll Register, New Hire Report, and Terminated Employee Report

A payroll internal audit uses ADP reports like the Audit Trail, Payroll Register, New Hire, and Terminated Employee reports to verify data integrity, authorization, and compliance.

What is 'payroll data masking' and when is it applied in ADP?

Answer: Hiding or obscuring sensitive data such as SSNs and bank account numbers in reports and interfaces so that only authorized users see the full information

Data masking in ADP partially conceals sensitive information like SSNs (showing only the last four digits) in reports and screens to limit exposure to users who don't need the full data.

Under GLBA (Gramm-Leach-Bliley Act) and similar data regulations, what obligation do employers have regarding payroll data security?

Answer: Employers must implement reasonable safeguards to protect the security and confidentiality of employee financial information, including access controls, encryption, and incident response plans

While GLBA primarily targets financial institutions, its principles influence employer data security obligations for sensitive payroll and financial data, requiring safeguards against unauthorized access.

What should a payroll specialist do upon discovering that a terminated employee's direct deposit was not deactivated in ADP?

Answer: Immediately deactivate the direct deposit in ADP, initiate an ACH reversal for the erroneous payment, and document the incident in the audit log

Erroneous direct deposits to terminated employees require immediate deactivation of the deposit, an ACH reversal to recover the funds, and documented internal incident tracking for audit purposes.

What is a SOC 1 Type II report and why is it relevant to employers using ADP payroll services?

Answer: A third-party audit report confirming that ADP's internal controls over payroll processing are designed effectively and operating reliably over a defined period

A SOC 1 Type II report provides employers with independent assurance that ADP's payroll processing controls are effective over time, supporting the employer's own financial reporting and audit obligations.