Two directions an investigation can take
Internal payroll fraud often involves fake employees, unauthorized pay increases, inflated overtime, or misuse of payroll cards. External investigations may come from tax authorities, labor departments, or insurers examining whether wages were paid off the books, workers were misclassified, or payroll was underreported to lower premiums. Each direction carries different risks, and an internal discovery can sometimes lead to an outside inquiry if it reveals reporting problems. Understanding which kind of payroll fraud investigation you face is the first step. Workers' compensation and unemployment insurance premiums are tied to payroll, so underreporting can draw insurer audits as well as government ones.
Records and how to handle them
Preserve payroll registers, timekeeping data, bank records, tax filings, and communications with payroll vendors, and suspend routine deletion. For internal matters, restrict access to the system while the review is underway and consider having counsel direct any forensic work. For external inquiries, gather the specific records requested and avoid making changes to historical data. Employees who raise concerns about payroll practices may be protected by whistleblower or anti-retaliation laws. If a payroll vendor holds the data, send a written preservation request so that its records are kept too.
How we approach the next steps
We start by identifying who is investigating, what period is under review, and whether there is criminal exposure. For internal fraud, we help plan interviews, coordinate with forensic accountants, and consider recovery through insurance or civil claims. For external audits, we review the agency's requests, discuss how to respond, and assess whether corrections or voluntary disclosures make sense. Throughout, we watch for issues that could expand the inquiry, such as unfiled tax forms or inconsistent records. Where an employee is suspected, we also look at how to handle that person's employment status and final pay without creating new claims.
