A nerve-wracking visit from the IRS isn’t the only type of audit out there. There are several audits you can, and should, conduct regularly. To do that, you need to know how to conduct an audit.
- Internal audits help you verify accuracy, improve processes, and stay compliant, reducing the risk of IRS audits.
- Follow a five-step process: plan, notify, execute, report, and implement changes.
- For payroll audits, gather 3–4 years of payroll registers, Forms W-2 and 1099, Forms 941 and 940, timesheets, pay stubs, and bank reconciliations.
- Audit cadence: quarterly or semiannual internal payroll checks; annual comprehensive reviews.
What is a business audit?
First things first: What is an audit, exactly? An audit analyzes a business’s financial records to verify accuracy and completeness. The person auditing your business generally reviews your transactions systematically by comparing your financial statements to books.
So, who should be the one doing the audit? Take a look at the following parties who might audit your business:
- You
- Your employees
- IRS
- CPA
You probably don’t want the IRS to regularly audit your business. Ideally, you’d love for them to never audit your business. But if you think this way about all audits, you could be missing out, and opening the door to potential IRS audits.
Regular audits (e.g., once per year by you or a CPA) can help you get your books in order, which can help you prevent and prepare for potential IRS audits.
The types of business audits
Because different parties can audit a business, several types of audits can occur. Nine different types of audit include:
- Internal audit: Someone in your business may conduct an audit to monitor process effectiveness, make sure you comply with laws, and evaluate risk management.
- External audit: An accountant or other third party may audit your business for reporting accuracy. The auditor follows generally accepted auditing standards (GAAS).
- IRS tax audit: The IRS audits your business to assess the accuracy of your business tax returns.
- Financial audit: Generally, an external auditor analyzes your business’s financial statements for accuracy and releases an audit opinion to lenders, creditors, and investors.
- Operational audit: Like in internal audits, this audit analyzes a business’s operations, goals, and results to look for areas of improvement.
- Compliance audit: An auditor examines your business’s policies and procedures to ensure they’re compliant (e.g., workers’ compensation compliance).
- Information system audit: Software and IT companies may undergo an information system audit to ensure software development, data processing, and computer systems are running smoothly.
- Payroll audit: An auditor (typically internal) analyzes your company’s payroll process to make sure there are no errors in your payroll process, like miscalculations.
- Pay audit: Not to be confused with payroll audit, a pay audit helps you identify pay discrepancies among employees.
Some of the types of business audits are internal, external, or both. The ones that you can do internally (e.g., internal audit, pay audit, etc.) are the ones you should know how to conduct. Of course, you can learn what happens when you get audited by the IRS for your own knowledge, too! But for the purpose of this article, we’ll stick to how you can conduct internal audits, and why performing them is important.
Why performing an audit is important
Sure, conducting an audit can seem overwhelming. After all, it can be a lengthy process (sometimes lasting up to several months).
But, regular audits are key to a healthy business. So before diving into the internal audit process, let’s review why you should conduct one.
Conducting an audit can help you:
- Check for accuracy in your business finances or processes
- Find errors in your books, processes, payroll, or pay rates
- Prevent IRS audits by helping you avoid incorrect reporting on tax returns
- Implement new accounting or business processes
- Make more informed business decisions based on accurate information
- Ensure your business is compliant (e.g., payroll tax rules)
And, here’s another bit of good news: The more organized your business is and the more audits you conduct, the less time each may take.
How to conduct an audit (5 steps)
Want to reap the benefits of auditing your business? Take a look at the following basic internal audit process steps below.
How to conduct an audit:
- Begin planning the business audit
Like anything in business, efficient audits require planning. So, your first step toward internal audits is planning the process.
You should decide:
* What areas you need to audit
* Who will be conducting the audit
* How frequently to audit
* When the audit will begin and end
Let’s say you want to conduct a payroll audit. To do this, you need to analyze your payroll records, including gross pay rates, tax withholdings, and net pay. You appoint your HR manager as the person conducting the audit. And, you decide that you’ll do payroll audits annually. You plan on the audit lasting two weeks.
Pro tip: Jot down every activity related to the area you plan to audit. That way, you don’t miss part of the process. And, create an audit schedule that lays out each step of the audit process.
Planning checklist (at-a-glance):
* Define objective and scope (e.g., payroll for Q1–Q4 last year).
* Identify criteria and laws to test against (e.g., FLSA, state wage laws).
* List data sources (general ledger, bank statements, timekeeping, payroll registers).
* Assign roles, timelines, and deliverables.
* Determine sampling method. - Notify your employees
Unless you’re doing a surprise audit (i.e., you think there’s suspicious activity afoot), you should notify employees that you plan to conduct an audit.
After you plan and schedule your audit, you should:
* Alert employees involved in the audit
* Ask all departments to get you any documents and info you need for the audit
* Add your audit schedule to a company-wide calendar
* Share your audit schedule directly with relevant parties
* Give your team ample time to gather necessary documents and continue their regular daily tasks.
Tip: Share a short “document request list” with due dates so employees know exactly what to provide (e.g., timesheets, payroll registers, etc.). - Conduct the audit
Your next step in learning how to audit is the audit itself. That’s right, it’s time to conduct the audit.
When conducting an audit, be sure to:
* Gather documents from employees
* Review business processes
* Interview employees to learn more about their skill levels
Take your time during the audit. You may even consider shadowing an employee or department to learn more about their work.
What to test:
* Completeness: Are all transactions recorded? Any missing pay periods or invoices?
* Accuracy: Do amounts agree across source docs, ledger, and bank?
* Authorization: Were changes to pay rates, vendors, or policies approved?
* Compliance: Do practices match written policies and applicable laws?
* Separation of duties: Are tasks like time entry, approval, and payroll processing separated? - Document and report your findings
Throughout the audit, take plenty of notes. Record what you see, and annotate whether your business and employees follow proper procedures.
Create an auditor’s report to document your findings. Under the generally accepted auditing standards (GAAS), the report should include the:
* Responsibilities of the auditor and directors
* Scope of the audit
* Auditor’s opinion
The more details you document, the more you’ll understand what works and what doesn’t in your business. That way, you can refer back to your supporting documents and connect the dots. The AICPA also requires the auditor to include their opinion in the report.
After creating your audit report, share it with any applicable parties, such as a business partner, investors, or upper management.
For internal audits, structure your report with:
* Objective, scope, and period covered
* Standards/criteria used (policies, laws)
* Procedures performed and samples tested
* Findings by risk level, with supporting evidence
* Root causes, recommendations, and owners
* Agreed corrective actions and timelines - Make changes
Last but not least, use your audit results. Don’t leave them to sit on a shelf collecting dust. So, determine what changes you can make to improve your audit findings.
For example, you may need to take one or more of the following actions:
* Provide additional training to employees
* Change a business process to be more compliant
* Update your books and financial statements
* Tweak business policies and procedures
Let’s say you conduct a financial audit and realize your financial statements are incorrect. In addition to correcting the issues (e.g., recording missed journal entries), you might also begin using accounting software for better recordkeeping.
Implementation tip: Track corrective actions (issue, owner, due date, status) and review progress monthly until closed.
How to prepare for a payroll audit (step-by-step)
Preparing payroll reports for audits is largely about completeness, organization, and reconciliation. Use th following steps:
- Run a pre-audit review
- Generate recent payroll summaries and exception reports to spot gaps or unusual amounts.
- Verify employee details: legal names, SSNs, active/terminated status, exempt/nonexempt, employee vs. contractor.
- Gather and organize documentation (keep 3–4 years)
- Payroll registers (wages, overtime, deductions, employer taxes)
- Timesheets/time-and-attendance exports
- Pay stubs, PTO/leave balances, and policy manuals
- W-2s, 1099s (e.g., 1099-NEC), and W-4s; I-9s retained separately as required
- Tax filings and proofs of payment: IRS Forms 941 and 940, state and local returns
- General ledger payroll accounts, bank statements, and bank reconciliations
- Benefit invoices and reconciliations (health, retirement, garnishments)
- Verify hours, wages, and compliance
- Match time records to paid hours and overtime; confirm pay rates to offer letters.
- Ensure PTO balances in payroll match HR records.
- Check classifications and overtime rules against federal/state law.
- Review tax withholdings and deposits
- Tie withholdings to W-4 elections and confirm gross-to-net calculations.
- Verify timely and accurate deposits and returns (FICA, FUTA, and state and local).
- Reconcile with financial records
- Reconcile payroll totals to bank statements and the general ledger; resolve discrepancies.
- Document findings and fixes
- Summarize scope, discrepancies, compliance status, and corrective actions (e.g., training, automation).
- Recommend cadence: quarterly or semiannual internal payroll checks; annual comprehensive review.
Common pitfalls to fix before an external review
- Misclassified employees/contractors
- “Ghost employees” or duplicate records
- Unapproved pay rate changes
- Late or missing filings/deposits
- PTO balances that don’t match payroll
Payroll software for audit preparation
Patriot’s accounting and payroll software can streamline audit prep:
- Centralized records: Keep payroll registers, tax filings, and employee details organized and exportable.
- Built-in tax filings: Create and access federal (e.g., Forms 941/940) and supported state filings to verify submissions and payments.
- Data accuracy: Automate payroll calculations to reduce manual errors.
- Easy reporting: Run payroll summaries, employee earnings, and deduction reports for any date range.
- Integrations: Sync accounting and payroll to automate recordkeeping and reconciliations.
FAQs: Business and payroll audits
Payroll registers, timesheets, pay stubs, W-2/1099s, W-4s, Forms 941/940, state returns, general ledger payroll accounts, bank statements/reconciliations, PTO records, and benefit/garnishment documentation.
Do light internal checks quarterly or semiannually; perform a comprehensive annual review. Increase frequency if you’ve had errors or rapid growth.
A knowledgeable internal team member not responsible for day-to-day processing (to maintain independence), or an external accountant for added assurance.
Internal audits assess controls and compliance for management. External audits provide an independent opinion on financial statements.
Small audits can take days; company-wide audits may take weeks. Strong organization and software reduce time.
No audit can “prevent” an IRS audit, but regular internal reviews reduce risk by improving accuracy and compliance in filings.
Looking for accounting software that makes it easy to keep records … without sucking up all of your time? Try Patriot’s online accounting! We created our software with the input of business owners and accountants to make managing your books fast, easy, and affordable. Get your free trial today!
This article has been updated from its original publication date of September 15, 2022.
This is not intended as legal advice; for more information, please click here.
