Labor Day is a good time to focus on how your business pays employees. Payroll reporting does not have to be a laborious process. Consider using an outside company to manage your payroll function. Here is why payroll outsourcing may be beneficial and how a service audit can provide assurance about your payroll provider’s internal controls.

Rewards & risks

Payroll can be an administrative nightmare if done in-house, especially for smaller companies. In addition to keeping up with employee withholdings and benefits enrollment, you must file state and federal payroll tax returns and follow union reporting requirements. Outside service companies that specialize in payroll administration can help you manage all of the details and reduce mistakes. Payroll providers also can handle expense reimbursement for employees and provide other services.

When payroll is outsourced, however, your company could be exposed to identity theft and other fraud risks if the service provider lacks sufficient internal controls. For example, sensitive electronic personal data could be hacked and sold on the Dark Net or old-fashioned paper files could be stolen and used to commit fraud. However, if you do proper research and due diligence you will be able to find an experienced, quality provider.

Audits of payroll companies

Fortunately, CPAs offer two types of reports that provide assurance on whether an outside payroll provider’s controls over paper and electronic records are adequate.

Type I audits. This level of assurance expresses an opinion as to whether controls are properly designed.

Type II audits. Here, the auditor goes a step further and expresses an opinion on whether the controls are operating effectively.

When performing these attestation engagements, Statement on Standards for Attestation Engagements (SSAE) No. 18 requires:

• The payroll company’s management to provide a written assertion about the fairness of the presentation of 1) the description of the organization’s control objectives and related controls and the suitability of their design; and 2) for a Type II audit, the operating effectiveness of those control objectives and related controls
• The auditor’s opinion in a Type II audit regarding description and suitability to cover a period consistent with the auditor’s tests of operating effectiveness, rather than being as of a specified date
• Auditors to identify in the audit report any tests of control objectives and related controls conducted by internal auditors

Further, auditors are prohibited from using evidence on the satisfactory operation of controls in prior periods as a basis for a reduction in testing in the current period, even if it is supplemented with evidence obtained during the current period.

When an audit is complete, the service auditor typically will issue a report to the payroll company. As the customer of the service provider, it is then up to you to obtain a copy of the audit report from the payroll provider and distribute it to your financial statement auditors as evidence of internal controls.

Outsourcing with confidence

Your financial statement auditors are required to consider the internal control environment for any services you outsource, including payroll, customer service, benefits administration, and information technology functions. Most service providers obtain service audit reports. If yours does not, you might need to request permission for your CPA to contact and visit the payroll provider to plan their financial statement audit. Contact us for more information