Payroll Compliance Audit: Controls to Test for PF, ESI, TDS and Professional Tax

Every employee was paid correctly and on time. Nobody complained. Yet when the internal auditor laid the payroll register next to the PF challans, the ESI returns and the quarterly TDS statements, the numbers did not agree. Allowances had been classified to keep contribution bases low, deposits were drifting past due dates, and filed returns no longer matched the books. This article explains why payroll is a compliance-sensitive process, what typically goes wrong, which controls an internal audit should test, and how to build a monthly reconciliation that keeps penalties away.

Why payroll is a compliance risk, not just an operations task

Most organisations judge payroll on one outcome: were employees paid accurately and on time? That is the outcome employees see, so it gets attention. The statutory side of payroll is invisible to employees until something goes wrong, which is why gaps can build up for months.

Each monthly payroll run creates several legal obligations at once. Employee contributions are deducted and become money held in trust for a statutory fund. Employer contributions become payable. Tax is deducted at source on salary. In most states professional tax is deducted. Each of these has its own wage base, due date, return and penalty regime.

The exposure is not only interest and damages. Under the income-tax law, employee contributions to PF and ESI deposited after the due date under the relevant welfare law are not deductible as business expenditure. In Checkmate Services Pvt Ltd v CIT (2022), the Supreme Court held that depositing before the return filing date does not cure this. A few days of delay can therefore convert an employee deduction into taxable income for the company.

For companies, the statutory auditor also reports under CARO 2020 clause 3(vii) on whether undisputed statutory dues, including provident fund, employees' state insurance and income tax, have been regularly deposited, and lists amounts outstanding for more than six months. Payroll lapses can therefore surface in the audit report itself.

What changed with the Labour Codes (status in 2026)

The four Labour Codes (Code on Wages, 2019; Industrial Relations Code, 2020; Code on Social Security, 2020; and the Occupational Safety, Health and Working Conditions Code, 2020) were brought into force from 21 November 2025, replacing 29 central labour laws. The Central Government notified the final central rules in May 2026, and operational provisions of the Code on Social Security, including EPF parameters, were notified later that month. State rules are at different stages, so employers in several states still deal with a mix of old and new requirements.

For payroll, the most important change is the uniform definition of wages in section 2(y) of the Code on Wages, which applies across the Codes. Certain components, such as house rent allowance, conveyance allowance, overtime, commission and employer contributions to PF, are excluded from wages. However, if the excluded components (under the specified clauses) exceed 50% of total remuneration, the excess is deemed to be wages. This matters because wages drive PF, gratuity, ESI and bonus calculations.

The EPF wage ceiling for mandatory contribution continues at ₹15,000 per month under the notified parameters, and interest on overdue EPF amounts is 12% per annum simple. Because state rules and departmental clarifications are still evolving, every pay-structure conclusion should be dated and revisited at least half-yearly.

What typically goes wrong in payroll compliance

Payroll compliance gaps rarely come from one big mistake. They come from small mismatches that nobody owns. The most common patterns are:

TDS on salary adds its own risks: incorrect regime selection, unverified investment declarations, perquisites missed in payroll, and mismatches between the TDS deposited, the quarterly statement and Form 16. Since the Income-tax Act, 2025 applies from 1 April 2026, payroll teams should also confirm that software, form references and computations have been updated for the new Act.

Payroll compliance controls internal audit should test

A risk-based payroll audit should test both the design of controls and whether they actually operated during the period. The table below summarises key controls and practical tests.

For the wider internal audit framework, including how to plan scope and report to the Audit Committee, see our guide to internal audit and corporate governance.

How to reconcile payroll with statutory filings every month

The single most effective control is a monthly reconciliation that ties payroll, statutory payments and the general ledger together before the month is closed. It should be prepared by payroll and reviewed by someone in finance who did not run the payroll.

1. Lock the payroll register. Freeze headcount, gross wages, each deduction and employer cost for the month.
2. Tie to PF and ESI. Match the number of members and wages in the ECR and ESI contribution file to the register; explain every difference (exits, ceiling cases, exempt employees).
3. Tie to TDS. Match TDS deducted per register to the challan deposited, and quarterly to the salary TDS statement.
4. Tie to professional tax. Match state-wise PT deducted to the amount remitted.
5. Tie to the books. Agree salary expense, statutory liabilities and payments to the general ledger; liabilities should clear to nil after deposit.
6. Record and escalate. Log unresolved items with an owner and target date; report repeat items to the CFO.

At year end, the cumulative salary in the payroll register, the TDS statements, Form 16 and the financial statements should agree. A difference here is often the first sign of off-payroll payments, missed perquisites or unrecorded reimbursements.

Illustrative example: how a small structure issue becomes a large exposure

The figures are illustrative. The actual position depends on the notified rules, any exemption applicable to the establishment and legal advice on past periods. The point for management is that pay-structure decisions need a documented compliance review, not just an HR or tax-saving rationale.

Red flags in payroll that deserve a deeper look

• PF or ESI challans regularly paid in the last days before, or after, the due date.
• Large 'special allowance' or 'other allowance' components that are paid to everyone.
• Headcount in statutory returns lower than headcount in payroll or attendance.
• Statutory liability ledgers with balances that roll forward month after month.
• Employees paid outside payroll through vendor invoices or reimbursements.
• Salary changes made directly in the payroll system without an approval trail.
• Contractors unable to produce challans or employee-wise contribution details.
• No register of notices, inspections or demand orders from the PF, ESI or tax authorities.

Payroll that leaks through vendor channels also tends to create income-tax questions on TDS and genuineness of payments, which we discuss in our article on TDS disallowance under section 40(a)(ia).

Payroll compliance audit checklist

1. Is there a written pay-structure review against the Code on Wages definition, dated within the last six months?
2. Are joiners, leavers and pay changes approved by someone outside the payroll processing team?
3. Is there a compliance calendar for PF, ESI, TDS and PT with a named owner and a backup?
4. Were all twelve months' deposits made by the due date? If not, have interest and tax consequences been computed?
5. Do monthly ECR, ESI and TDS figures reconcile to the payroll register, with differences explained?
6. Does annual salary per payroll agree with TDS statements, Form 16 and the financial statements?
7. Are professional tax registrations in place for every state where staff work?
8. Is contractor PF and ESI compliance verified before contractor invoices are paid?
9. Are notices and inspections tracked, with responses filed on time?
10. Are payroll system access rights reviewed, and is the payroll master change log examined?

Frequently asked questions

Conclusion

Paying salaries on time keeps employees satisfied. Depositing, filing and reconciling statutory dues on time keeps the company protected. With the Labour Codes now in force and the Income-tax Act, 2025 applying from April 2026, payroll structures and processes that worked a few years ago need a fresh review.

The fix is usually not complex: a documented pay-structure review, a compliance calendar with clear ownership, and a monthly reconciliation reviewed by someone independent of payroll. Internal audit's role is to test that these controls exist and operate, and to escalate when they do not.

This article is for general information only and does not constitute professional advice or solicitation. Examples are illustrative. Labour Code rules and state notifications are evolving; confirm the current position before acting. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.