Payroll Fraud Controls for Small Sri Lankan Firms
Stop payroll fraud in a small company by separating who adds staff, who approves pay, and who releases the bank file. Four frauds to watch for.
On this page
- The four frauds small Sri Lankan payrolls actually suffer
- Ghost employees and how the EPF member list exposes them
- Bank detail changes: the two-person rule
- Month-on-month variance review before you pay
- What an audit trail must capture to be useful
- A one-page payroll approval policy
- Frequently asked questions
- What if I am the only owner and I run payroll myself?
- Does outsourced payroll remove the need for these controls?
- Do family staff need the same controls?
- How often should the variance review happen?
- Which control should a small firm set up first?
Separate three jobs: who can add an employee, who approves a pay run, and who releases the bank file. No single person should do all three. Add a monthly variance check and you catch payroll fraud before money leaves the account. The five main statutory payroll payments in Sri Lanka still have to be right too.
The four frauds small Sri Lankan payrolls actually suffer
| Fraud | What it looks like |
|---|---|
| Ghost employee | Someone on payroll who does not exist, or who has already left |
| Unauthorised rate or bank detail change | A salary or account number edited without approval |
| Timesheet or overtime inflation | Hours claimed that were not worked |
| Diverted payment | A real employee’s pay quietly redirected to another account |
Each one needs a different check. None of them need expensive software to catch, only a clear process.
Ghost employees and how the EPF member list exposes them
Every employee on your payroll should also appear on your EPF and ETF member records, with a matching name and number. A name on the payroll that is not on that list, or a member number that does not match, is worth investigating immediately. Run this check every month, not just at audit time. See how to avoid errors in payroll processing for other checks that catch mismatches early.
Bank detail changes: the two-person rule
Never let one person both request and approve a change to an employee’s bank account. One person raises the request. A different person checks it against a signed instruction from the employee, then approves it. This rule removes the one point where a single person could both make the change and hide it.
Month-on-month variance review before you pay
Before you release a pay run, compare it to last month. Look for:
- Any employee whose net pay moved by an unusual amount.
- Any new name that was not on last month’s list.
- Any name from last month missing without a recorded leaver.
- A total payroll figure that moved more than headcount changes explain.
This takes minutes once you have last month’s numbers to hand. See fixing a payroll error after payslips have gone out for what to do when the variance turns out to be a mistake.
What an audit trail must capture to be useful
A record of a change is only useful for catching fraud if it shows four things. It must name who made the change, the old value, the new value, and exactly when. A system that only shows the current salary, with no history, cannot help you find who changed it or when.
A one-page payroll approval policy
Write down, in one page:
- Who can add or remove an employee from payroll.
- Who approves the pay run total before release.
- Who can release the bank payment file, and that this must be a different person from the one who approved it.
- Who can change a bank account number, and the two-person rule that applies.
- How often the variance review in this article happens, and who does it.
Keep it to one page. A longer policy does not get followed. Put it alongside what employee records to keep, and for how long, so the checks become routine.
Do this automatically in Humanised. Payroll software in Sri Lanka controls what each user can see and change, by role. Plans start at LKR 10,000 a month for up to 15 staff. The free 7-day assisted trial is set up by the Humanised team on your own data.
This is general payroll guidance. Every case is different. For your own case, speak to a payroll practitioner or a lawyer.
Frequently asked questions
What if I am the only owner and I run payroll myself?
You cannot fully separate duties alone. At minimum, review your own pay run against last month’s figures before releasing it, and keep a written record of every change you make.
Does outsourced payroll remove the need for these controls?
No. You still need to check the pay run your provider sends you before you approve the bank release. Outsourcing moves who calculates pay, not who is responsible for approving it.
Do family staff need the same controls?
Yes. A family member on payroll should appear on EPF and ETF records like any other employee. Their pay changes should follow the same approval rule as anyone else’s.
How often should the variance review happen?
Every pay run, before you release payment. It takes minutes and it is the single best chance to catch a problem before money moves.
Which control should a small firm set up first?
Separating who can release the bank payment file from who approved the pay run. That split means no one person can both approve a payment and send it.
Was this article helpful?
Your feedback helps us improve these guides.