A payroll audit is a set of checks against the record rather than a formal event, and most of the value comes from running a short list regularly instead of a long list once. The checks that find genuine errors are unglamorous and can be run by somebody who did not process the payroll.
The checks that find real errors
Everybody paid is a current employee, everybody who left has stopped, bank details changed this period were confirmed independently, gross pay movement is explained, and nobody was paid twice. Five checks, done every period by somebody who did not run the payroll, catch the overwhelming majority of what goes wrong.
The periodic deeper pass
Once or twice a year, reconcile payroll to the general ledger, check that deductions and contributions agree with the underlying records, and confirm that filings and payments match what was reported. This is where systematic errors surface, as opposed to the one off mistakes the periodic checks catch.
Keep the evidence
A signed or logged record that each check was performed, by whom and when. This costs minutes and is what turns an assertion that controls exist into evidence that they operate. It is also the thing an external auditor or an investigation asks for first, and reconstructing it afterwards is not possible.
Questions people ask about payroll audit
Who should perform the checks?
Somebody other than the person who processed the payroll. Segregation is the control; the checklist is only the method.
How often should a full audit happen?
A short check every period and a deeper reconciliation once or twice a year. Annual only is too infrequent to catch a recurring error early.
What is the most common finding?
Leavers still on the payroll and unconfirmed bank detail changes. Both are cheap to check and expensive to miss.