A payroll audit checklist for UAE employers is short to describe and slow to assemble: prove that every dirham of salary was calculated correctly, approved, paid to a real employee and recorded in the accounts. Auditors rarely find fraud. What they find is missing evidence: a salary change with no letter, a cash payment with no receipt, a gratuity provision nobody can rebuild.
This guide lists what auditors ask for, explains how they test payroll, walks through a worked tie-out from the payroll run to the WPS file and the ledger, and ends with a preparation checklist you can run before the audit team arrives.
What is a payroll audit checklist in the UAE?
A payroll audit checklist is the list of records and reconciliations a UAE employer prepares so an auditor can confirm that salaries were calculated correctly, authorised, paid to real employees through the right channel and posted to the accounts. It covers the payroll registers, WPS files, bank statements, employee records, gratuity provision and system controls.
The same checklist serves an external financial statement audit, an internal audit, a group reporting review and due diligence. The depth changes; the questions do not. Payroll is usually one of the largest costs in the accounts, so it is rarely left out of scope.
What do auditors ask for in a payroll audit?
Auditors ask for evidence at four levels: the monthly payroll registers and their reconciliation to the general ledger, proof of payment (WPS SIF files and bank statements), the employee records behind the numbers (contracts, salary changes, attendance, joiners and leavers), and the year-end liabilities, mainly end-of-service gratuity and leave.
The request list, and what each item proves:
| What they ask for | What it proves | Where it comes from |
|---|---|---|
| Payroll register for every month | The salary expense is complete and calculated consistently | The final, locked payroll run for each period |
| Payroll to general ledger reconciliation | What payroll calculated is what the accounts recorded | The payroll journal voucher and the ledger accounts it posts to |
| WPS SIF files and bank statements | What was calculated was actually paid, to the right people | The SIF generated for each month and the matching bank debit |
| Employee list with joiners and leavers | Everyone paid was employed in that month | HR records with dates of joining and leaving |
| Contracts and salary change approvals | Pay rates were agreed and changes were authorised | Signed contracts, increment letters, job change history |
| Attendance, overtime and unpaid leave records | Variable pay and absence deductions have a source | Attendance reports, approved overtime, leave records |
| Deduction and salary advance schedules | Deductions were agreed and recoveries are tracked | Advance requests, repayment schedules, deduction approvals |
| End-of-service gratuity working | The liability in the accounts is complete and correctly calculated | Per-employee gratuity calculation as at the reporting date |
| Leave balances at the reporting date | Any accrued leave liability is supported | Leave balance report by employee |
| Final settlements for leavers | Leavers were paid correctly and not paid again | Settlement calculations, clearance and payment proof |
| Access rights and change history | Only authorised people can change salaries and bank details | Role permissions and the system audit log |
The last row is asked for more often each year. If anyone with a login can change a bank account or a basic salary and nothing records who did it, the auditor has to test far more transactions to get the same comfort. See roles, permissions and the audit log for what that control looks like in practice.
How do auditors test payroll?
They work in two passes. First the totals: each month's payroll register is agreed to the ledger, and net pay is agreed to the WPS file and the bank statement. Then a sample: a handful of employees are followed from contract to salary setup, payroll run, payslip and bank credit, with every change in between checked for approval.
Within the sample, expect questions on:
Existence. Is this a real employee who worked in the month? Joiners and leavers get the most attention, because that is where a payment to someone who was not employed would sit.
Rate. Does the salary in the payroll system match the signed contract or the latest approved increment letter?
Variable pay. Is the overtime, commission or bonus supported by an approved record, and was it calculated on the right basis?
Deductions. Was each deduction agreed and documented? Article 25 of Federal Decree-Law No. 33 of 2021 limits the cases in which an employer may deduct from wages, so an undocumented deduction is a finding.
Payment. Did the net amount on the payslip reach the bank account on file, and was that account changed during the year?
Cut-off. Were December salaries, unpaid overtime and final settlements recorded in the right period?
A month-on-month comparison answers most of these before the auditor asks. That is the job of a salary reconciliation, and it is why teams that reconcile every month have short audits. For how overtime should be calculated, see overtime pay in the UAE.
Worked example: tying payroll to WPS, the bank and the ledger
Start from the locked payroll run and build the bridge from total earnings to net pay. Split net pay by payment method, then agree each part to its evidence: the bank-transfer total to the SIF file and the bank statement, cash to signed receipts, and the whole net figure to the journal voucher in the ledger.
Step 1. Payroll run, March (illustrative figures, AED):
| Line | Amount |
|---|---|
| Fixed salaries and allowances | 480,000 |
| Overtime and other variable pay | 22,500 |
| Total earnings | 502,500 |
| Less: absence deductions | (6,800) |
| Less: salary advance recoveries | (5,000) |
| Less: other deductions | (2,500) |
| Net pay per the locked payroll run | 488,200 |
Step 2. Agree net pay to the evidence:
| Check | Per evidence | Per payroll | Result |
|---|---|---|---|
| Net pay by payment method | Bank transfer (WPS) 451,700 + cash 36,500 | 488,200 | Agrees to the payroll run. |
| WPS SIF file total | 451,700 | 451,700 | Agrees to the bank-transfer population. |
| Bank statement salary debit | 451,700 | 451,700 | Agrees to the SIF. |
| Journal voucher, net salaries payable | 488,200 | 488,200 | Agrees to the payroll run. |
| Cash salaries with signed receipts | 32,300 | 36,500 | Short by 4,200. One employee, no signed receipt. Finding. |
Four of the five checks agree. The one that does not is small, 4,200 out of 488,200, and it is exactly the kind of item that ends up in a management letter: not a wrong number, a missing document.
Step 3. Follow one sampled employee end to end:
| Evidence | What it shows | Result |
|---|---|---|
| Signed contract | Basic 7,300 + housing 2,500 + transport 700 = 10,500 | Agrees |
| Salary setup in the payroll system | 10,500 fixed monthly salary | Agrees to contract |
| March payroll run | 10,500 + overtime 450 = 10,950 net, no deductions | Overtime supported by an approved record |
| Payslip | 10,950 | Agrees to the run |
| SIF line and bank credit | 10,950 | Agrees to the payslip |
| Gratuity at the reporting date | 4 years of service: 84 days × 240 = 20,160 | Agrees to the provision working |
The gratuity line uses the daily wage of basic salary × 12 ÷ 365, so 7,300 × 12 ÷ 365 = 240 per day. Four years at 21 days per year is 84 days, and 84 × 240 = 20,160. If your provision working uses a different daily-wage basis, say so in the working and apply it to every employee the same way. Consistency is what the auditor is testing.
Which UAE-specific payroll items get the most audit attention?
Four areas draw the most questions in a UAE payroll audit: the end-of-service gratuity provision, the match between payroll and what went through the Wage Protection System, salaries paid outside WPS in cash or by cheque, and final settlements for leavers. Each one involves a calculation or a payment that sits outside the routine monthly run.
End-of-service gratuity. Under Federal Decree-Law No. 33 of 2021, an employee who completes at least one year of service earns 21 days' basic wage per year for the first five years and 30 days' per year after that, capped at two years' wage. Auditors recompute a sample and compare the total to the provision in the accounts.
Payroll versus WPS. The bank-transfer population in the payroll run should equal the SIF total for the month. Differences usually come from employees paid by another method, late joiners or a file generated before a last correction.
Payments outside WPS. Any salary paid in cash or by cheque needs its own evidence: who was paid, how much, and a signed acknowledgement.
Leaver settlements. The final payment brings together unpaid salary, leave balance and gratuity. Auditors check the calculation, the approval and that the leaver does not appear in a later payroll run.
For the accounting side of gratuity, see EOSB accrual for finance teams, and to check a single employee's figure, the UAE gratuity calculator. For current salary payment deadlines and WPS requirements, see WPS rules in the UAE.
How do you prepare a payroll audit file before the auditors arrive?
Build one folder per month and one for the year end. Each month holds the final payroll register, the SIF file, the bank statement page and the journal entry, already agreed to each other. The year-end folder holds the employee list, the gratuity and leave workings, leaver settlements and the list of salary and bank changes.
A preparation checklist:
Lock every month. Confirm each payroll period in the audit year is final and cannot be edited, so the register you hand over is the register that was paid.
Tie each month out. Net pay to the SIF and the bank statement, and the payroll totals to the ledger. Explain any difference in a one-line note while you still remember why.
List the joiners and leavers. With dates of joining and leaving, first and last payroll months, and the settlement file for each leaver.
List every salary change. Old amount, new amount, effective date and the approval behind it.
List every bank detail change. Who requested it, who changed it and how the new account was verified.
Rebuild the gratuity provision. Per employee, as at the reporting date, with the basis stated, and agree the total to the ledger.
Pull the leave balances. As at the reporting date, by employee.
Check the file is complete for a sample of five employees. Contract, ID documents, salary letter, payslips. If five files are complete, the rest probably are; if one is not, fix the gap before someone else finds it.
How long you must keep these records depends on more than one law, so agree the retention period with your auditor or legal adviser rather than assuming. The journal side of the file is covered in payroll journal entries in the UAE.
What are the most common payroll audit findings?
Most findings are about evidence, not arithmetic: salary changes with no approval on file, payroll figures edited after payment so the register no longer matches the bank, a gratuity provision kept in a spreadsheet nobody can rebuild, cash salaries without signed receipts, leavers paid after their last day and shared logins that hide who changed what.
Unsupported salary changes. The new amount is right; the letter authorising it cannot be found.
Registers that moved. The payroll export produced in January for last March does not match what the bank paid in March, because the run was never locked.
A provision nobody can rebuild. The gratuity figure in the accounts comes from a spreadsheet with overwritten formulas and no per-employee working.
Cash without receipts. The payment was real, the acknowledgement was never collected.
Leavers that linger. An employee who left mid-year appears in a later run.
No trail on bank changes. An IBAN was changed and there is no record of who did it or why.
All six are control gaps, and all six are on the list of payroll controls a UAE finance manager should demand.
How does HRX360 help with a payroll audit?
HRX360 keeps the audit evidence as a by-product of running payroll. Each run is locked once final and records who locked it and when. Payslips, the WPS SIF file and the journal voucher are produced from that locked run, so they agree by construction, and an Audit Log records changes across the system.
What you can hand an auditor from the system:
Locked payroll runs: every run moves from Completed to Locked. A locked run cannot be reprocessed or deleted until it is unlocked, the summary shows when it was locked and by whom, and the run exports to Excel.
Salary History report: salaries across multiple periods with a component-level breakup, filters and a formatted Excel export. This is the payroll register for the year in one file.
WPS Generator: the SIF file is produced from the payroll run, by payment method, so the bank-transfer total and the file total come from the same figures.
Salary Review workbook: a month-on-month comparison by department, employee and payment method, with joiners identified by date of joining and leavers by date of leaving.
EOS Report and provision ledger: gratuity liability per employee as of any date you choose, with a monthly end-of-service provision behind it.
Journal voucher: a balanced payroll journal with debit and credit lines. Finance can switch on GL account mapping, and the official numbered voucher is exported only after the run is locked.
Audit Log: a trail of changes and sensitive actions across the system, filterable by user, action and date, and exportable.
Roles and permissions: module-level rights for create, edit, delete, print and authorise, so you can show who is able to change salary and bank details.
Employee documents: contracts, visas and ID documents stored on the employee record with expiry reminders.
These are part of HRX360's payroll software, within HR software built for the UAE. For the ledger handoff, see the payroll journal voucher; for employee files, document management.
Have the audit file ready before anyone asks
HRX360 locks each payroll run, produces the payslips, WPS file and journal voucher from it, and logs who changed what, so the evidence an auditor asks for already exists. Full UAE payroll with WPS/SIF, gratuity and Salary Review is on the Professional plan, from AED 14 per employee per month, billed annually.
Frequently asked questions
What is a payroll audit?
It is a review of whether the salaries a company recorded were calculated correctly, authorised, paid to real employees and posted to the accounts. It can be part of the annual financial statement audit, an internal audit, a group review or due diligence before a sale or investment.
What documents do auditors ask for in a UAE payroll audit?
Typically the monthly payroll registers, the reconciliation of payroll to the general ledger, WPS SIF files and bank statements, the employee list with joiners and leavers, contracts and salary change approvals, attendance and overtime records, deduction and advance schedules, the gratuity provision working, leave balances and final settlements.
How do auditors test payroll?
They tie the totals together first: payroll register to ledger, and net pay to the WPS file and the bank statement. Then they pick a sample of employees and follow each one from contract to salary setup, payroll run, payslip and bank credit, checking that every change in between was approved.
How is end-of-service gratuity checked in an audit?
Auditors recompute the liability for a sample of employees and compare it to the provision in the accounts. Under Federal Decree-Law No. 33 of 2021 the calculation is 21 days' basic wage per year for the first five years and 30 days' per year after that, capped at two years' wage, for employees with at least one year of service.
How often should payroll be reviewed internally?
A good working practice is a short tie-out every month before the run is locked and paid, and a fuller internal review once or twice a year using the same checklist an external auditor would use. Monthly checks keep the year-end audit short because the evidence already exists.
Does HRX360 keep an audit trail for payroll?
Yes. Each payroll run moves from Completed to Locked and records when it was locked and by whom. The Audit Log report shows changes and sensitive actions across the system, filterable by user, action and date. Payslips, the WPS file and the journal voucher are produced from the locked run. Full payroll is on the Professional plan.