Reasons to Outsource Payroll and Get a Service Audit Report

Payroll reporting doesn’t have to be a laborious process. Consider using an outside company to manage your payroll function.

Here’s why payroll outsourcing may be beneficial and how a service audit can provide assurance about your payroll provider’s internal controls.

Rewards and Risks

Payroll can be an administrative nightmare if done in-house, especially for smaller companies. In addition to keeping up with employee withholdings and benefits enrollment, you must file state and federal payroll tax returns and follow union reporting requirements.

Outside service companies that specialize in payroll administration can help you manage all of the details and minimize mistakes. Payroll providers can also handle expense reimbursement for employees and provide other services.

When payroll is outsourced, however, your company could be exposed to identity theft and other fraud risks if the service provider lacks sufficient internal controls. For example, sensitive electronic personal data could be hacked and sold on the Dark Net — or old-fashioned paper files could be stolen and used to commit fraud.

(Download Video Transcript)

Audits of Payroll Companies

Fortunately, CPAs offer two types of reports that provide assurance on whether an outside payroll provider’s controls over paper and electronic records are adequate.

Statement on Auditing Standards (SAS) No. 70 Type I Audits

This level of assurance expresses an opinion as to whether controls are properly designed.

SAS 70 Type II Audits

Here, the auditor goes a step further and expresses an opinion on whether the controls are operating effectively.

Starting in 2013, Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization, requires:

• The payroll company’s management to provide a written assertion about the fairness of the presentation of 1) the description of the organization’s controls and the suitability of their design; and 2) for a Type II audit, the operating effectiveness of those controls,
• The auditor’s opinion in a Type II audit regarding description and suitability to cover a period consistent with the auditor’s tests of operating effectiveness, rather than being as of a specified date, and
• Auditors to identify in the audit report any tests of controls conducted by internal auditors.

Further, auditors are prohibited from using evidence on the satisfactory operation of controls in prior periods as a basis for a reduction in testing in the current period.

When an audit is complete, the service auditor typically will issue a report to the payroll company. As the customer of the service provider, it’s then up to you to obtain a copy of the audit report from the payroll provider and distribute it to your financial statement auditors as evidence of internal controls.

Outsourcing with Confidence

Your financial statement auditors are required to consider the internal control environment for any services you outsource, including payroll, customer service, benefits administration and IT functions. Most service providers obtain SAS 70 audit reports.

If yours doesn’t, you’ll need to request permission for your CPA to contact and visit the payroll provider to plan their financial statement audit. Contact us for more information.