Having helped numerous companies uncover such theft, payroll fraud specialist and founder of YSchoültz Attorneys & Conveyancers & Notaries, Yolande Schoültz is often frustrated that it takes so long to uncover what is really a straightforward crime. However, many organisations don't pick up on such theft; some even make drastic changes because they think they are unprofitable.
"It happens in some cases where the company isn't making a profit," says Schoültz. "People start being retrenched, but in actual fact it was payroll eating the money. It's astounding that companies rarely pay attention to payroll, even though it's often their single-biggest expense. They just tend to trust payroll departments too much and leave them to their own devices."
Why does that attitude set in? Schoültz says it's usually down to several factors. There is no formal qualification to become a payroll administrator, so some people grow into the role, and it becomes separated from other financial functions. The rest of the business simply trusts the payroll staff and doesn't treat it as a potential risk, putting controls and oversight in place. Payroll starts being treated at arm's length, and that's where problems arise.
"Most payroll administrators are honest, but there are many opportunities to commit fraud," says Sandra Crous, managing director at PaySpace. "Some people change bank account details on payslips, and others keep employees on the payroll for months after they have left. Old systems and antiquated reporting make it easy to hide such fraud, especially since nobody checks regularly if everything is above board and one or two people control the payroll software."
Payroll fraud steals millions from South African businesses. Recently, two employees at a major casino were convicted of defrauding over R4m through payroll fixing. Yet, catching payroll fraud is relatively straightforward when companies implement the following measures:
As mentioned, payroll departments often become isolated, and their teams are more trusted than many other financial functions. Even if one can trust their payroll administrators, this complacency is poor governance and a recipe for future fraud. Businesses must put functions in place that scrutinise payroll indicators. This action is particularly essential if there are highly variable payouts, such as overtime, sales bonuses, and freelance contractors.
"Payroll is the last department people look at as a department for risk. They trust the people working in payroll without realising what kind of fraud schemes can go on," says Schoültz.
Payroll fraudsters often hide their crimes through gatekeeping, maintaining defensive control over their records and refusing others direct access. To combat this, different stakeholders should be able to print reports rather than rely on what the payroll department provides. A modern, integrated payroll software platform will enable different people to access and produce reports.
"You get people who insist on printing payroll reports and redistributing those to the finance department. That's a red flag," Schoültz warns. "Everyone must print their own reports from the system. If you check something, you do not take someone else's report because they are going to show you what they want you to see."
Headcounts can be onerous as they require employees to report in person with their credentials. However, doing this exercise once a year will deter fraud and uncover ongoing activities such as ghost employees.
"It's very important, at least once a year, there be a headcount audit. It's a lot of work. You have to ask employees to physically identify themselves with their IDs. But you want to know if you've got those employees on your payroll — a headcount audit is the best thing to do," says Schoültz.
It's staggering to realise that while payroll is often a company's single-biggest financial cost, there is scant training for payroll administration. There are certifications and professional bodies, but most financial professionals have a bare-bones understanding of payroll, and many other employees (such as executives and managers) have no real grasp on the practice. Providing training and workshop opportunities will strengthen their knowledge and reduce fraud risks.
"Most executive teams and managers aren't equipped, knowledge wise, to know how to check payroll. They see it as an input/output function when payroll is much more complicated. That's often where the problem comes in," says Schoültz.
Payroll fraud often occurs when payroll systems are monolithic, opaque, and controlled by a handful of people, due to old and outdated payroll software. Yet payroll duties can extend into finance, human resources, and team projects. At the very least, financial staff should have access to the payroll system and assigned duties or oversight roles. Nobody should have complete access to all payroll functions. Modern payroll software platforms let organisations assign roles and segregate duties to ensure oversight.
"There must be segregation of duties. It must start with the payroll users, and it must go upwards," says Schoültz. "The group managers and the executive teams are ultimately responsible for letting payroll fraud slip through. If your segregation of duties and the access control of the payroll system are nicely defined, it becomes very hard to pull off most payroll fraud schemes."
Discovering fraud under your roof is never pleasant, and some companies prefer to avoid the problem by firing the fraudster and sweeping the damage under the carpet. But while this might help them save face, they are making the problem worse. People who commit fraud are prone to do so again, and many caught payroll fraudsters are repeat offenders.
If charged, they can get a criminal record, stopping them from sneaking into a different business and starting their theft again. Schoültz is adamant that letting a fraudster go just lets them commit their crimes elsewhere.
"You see it a lot. They go from one company to the next and they just do the same. They don't get noticed because there is no criminal record. Defrauded companies must go to the Commercial Crime Unit of the police, and they must open a criminal case against these people. That's the only way you're going to get rid of fraudsters or avoid hiring them in the first place."
