Payroll Security and Audit Flashcards

What is 'payroll fraud' and what are the three most common types found in workplace investigations?

Answer: Payroll fraud involves falsifying payroll records for financial gain; the three most common types are ghost employees, timesheet fraud, and commission/bonus manipulation

Payroll fraud encompasses any scheme to manipulate payroll for unauthorized financial gain; ghost employees, falsified timesheets, and manipulated commissions/bonuses are the most frequently occurring types.

How does ADP's New Hire Report support payroll audit and compliance?

Answer: It lists all employees added to the system within a date range, allowing auditors to verify that new hire setup followed proper authorization procedures and that required information is complete

ADP's New Hire Report helps auditors confirm that every employee added to payroll was properly authorized and that required data (SSN, tax forms, bank info) was captured correctly.

What is an 'IP allowlist' in ADP access security and how does it protect the payroll system?

Answer: An IP allowlist restricts ADP system access to requests originating from approved IP addresses, preventing access from unauthorized or unknown network locations

Configuring an IP allowlist in ADP limits system access to trusted network addresses, reducing the risk of unauthorized access from external or unrecognized locations.

Why is it a payroll best practice to conduct a 'terminated employee audit' in ADP at least quarterly?

Answer: To ensure terminated employees have been removed from active payroll, their system access has been revoked, and no payments have been issued post-termination

A terminated employee audit confirms that former employees are not still receiving payments, that their access to ADP is revoked, and that final pay and documentation were handled correctly.

What is the function of ADP's 'Suspicious Activity Monitoring' or similar alerting features within payroll?

Answer: To flag unusual payroll events such as large pay rate changes, duplicate direct deposit accounts, or after-hours system access for review by a payroll administrator

Payroll anomaly detection in ADP flags statistically unusual or high-risk events — such as sudden large pay increases or duplicate bank accounts — that may indicate fraud or error requiring investigation.

When an ADP payroll user's employment is terminated, what is the immediate security step the payroll manager must take?

Answer: Immediately revoke the user's ADP system access, change shared credentials if any were used, and review the audit trail for any recent changes made by that user

Revoking access immediately upon employee termination is a critical security control; delayed revocation creates a window for unauthorized payroll changes by a disgruntled former employee.