Blog

Compliance testing, also known as conformance testing, is a periodic, independent, and objective assessment of compliance-related processes or controls. As the name implies, you’re testing those controls to see how well they actually work.

Compliance testing plays a major role in identifying vulnerabilities in existing compliance risk management controls; many regulations also require testing as part of an organization’s compliance obligations, and testing should follow an established process, as well as a risk-based approach.

All that said, testing can be a complicated endeavor. This article will unpack the best practices typically involved, so that you can understand the issues here and plan your own testing program wisely.

What Are the Benefits of Compliance Testing?

Compliance testing has multiple benefits that help to assure your IT systems work as planned. For example, testing can identify which of your employees might not understand compliance obligations that your business has, and then you can follow up with extra training as needed. Testing might also uncover defective technical controls around, say, encryption; which you could then correct with new controls.

Continued testing through a monitoring program means you’ll find potential threats and weaknesses before a cybersecurity risk comes to fruition. You can think of compliance monitoring and testing as preventive measures, such as visiting the doctor annually, even if you don’t feel sick.

Steps to Effective Compliance Testing

To minimize risk and make certain that your compliance management system is working correctly, you must have an effective compliance testing program in place. These tests will help your company to avoid legal violations, which can be complicated and costly to resolve. By following the steps below, you can create a testing process that will catch potential problems before they occur. Consider employing automation for some of these steps to give your compliance officer or compliance team stronger tools.

1. Create a requirements library Whether your company already has a small compliance testing program or you’re developing a new program, the first thing you have to do is build a requirements library. That library establishes the requirements that apply to your company. You will use it to identify the existing controls (or lack thereof) that mitigate your company’s compliance risk.A requirements library is an inventory of in-scope requirements that you will use to identify the compliance risks to your organization. To establish the library, you must identify all the statutory, regulatory compliance, or contractual requirements that apply to your company’s operations.You might want to first consider consulting with a subject matter expert in your industry who can help you identify the in-scope requirements. Then work with the executives from each business unit, including your legal team, to assure you capture all applicable requirements.Next, map the requirements to their applicable business functions and work with the business unit executives to define the compliance risks. This can take the form of an internal audit. You should also validate the applicability of the requirements with the business owners to help them clearly understand the importance of each requirement and what could happen if it’s not met.Once you’ve mapped the requirements and identified the risks, you should identify the controls you have in place to mitigate the compliance risks. This is a great opportunity to determine how many controls mitigate each compliance risk; it’s also where you should focus on compliance testing in the future, to minimize duplicate testing.Ultimately the requirements library should be a “single source of truth” for your company’s compliance requirements. Maintaining the requirements library within a governance, risk, and compliance (GRC) software tool assures that you preserve the integrity of that source of truth. You can also implement compliance controls to prevent unauthorized users from making unintended additions, deletions, or other changes that could compromise the requirements library. 
   
   
2. Conduct a compliance risk assessment Begin this step by defining the parameters of the compliance risk assessment, including the categories, risk profiles, and factors you will measure, as well as the data sources that will be used to conduct the risk assessment.The next step is to evaluate the inherent risk for each risk – that is, the risk of violating a requirement when your business process has no controls to prevent that risk at all. Then evaluate the effectiveness of the control that does mitigate this risk, and consider what’s left over: the residual risk that still exists even after the control is in place.Use the residual risk to prioritize which controls should be tested first or most often. The higher the residual risk, even after a control is in place, the more often you want to test that control.
   
   
3. Develop the compliance testing methodology After performing the risk assessment, develop a compliance testing methodology to determine how you’ll test in-scope requirements or their associated controls.To develop the testing methodology, you have to define the following:
   • Testing approach, including purpose, scope, and objective.
   • Sampling method that you’ll use when performing testing.
   • Process you’ll follow when you identify compliance violations or issues.
   • Remediation methods when you find defective controls.
   • Reporting requirements, including stakeholders.
4. Communicate the testing methodology Communicate the testing methodology to the business unit that’s being audited as well as to the relevant parties and member firms that perform the testing to reduce duplication of efforts.Communicating a clearly defined methodology early in the testing process can minimize resistance from the teams being audited, by letting them know what they should expect and when.Your methodology may evolve every year as your compliance program becomes more mature. For example, your objective for the first year may just be to assure that all areas comply with the applicable laws by testing all the requirements in the library. In succeeding years, you won’t need to limit compliance testing just to verify compliance. You may also want to test the controls that mitigate the compliance risk.
   
   
5. Establish the testing schedule
   Use the residual risk established in the compliance risk assessment to determine how often you should test for each requirement. The schedule will vary depending on the size of your team and the company’s objectives. For example:
   • High residual risk: quarterly (or more frequently)
   • Medium residual risk: semiannually
   • Low residual risk: annually
6. Group the requirements by business function or overall regulation, and state when each of these groups will be tested. Add the established timeframe as a data point in your risk assessment to confirm that you have testing coverage for all requirements. Once you’ve completed the schedule, communicate it to the business units so they all understand when you’ll be testing them and what you’ll be testing against.
   
   
7. Perform testing Notify the business units about the planned audits well in advance, and include what you’ll require of process owners and department heads. Allocate enough time to submit document requests and review the evidence you’ve gathered.Obtain the data and materials you’ll need to perform testing against the regulatory requirements. Then test per the established testing methodology you’ve communicated to the audited business unit. This ensures that your testing process stays consistent by eliminating confusion and frustration for the leaders of your business units.Document the testing programs and preserve evidence of the results of the testing. Follow up on findings to assure that the issues or control gaps you’ve identified aren’t false positives.Communicate the final results to the business units and obtain the approval or agreement from the affected business function on any issues you’ve identified. When you’ve completed all the testing steps, draft and issue the final report of your results to the relevant parties, such as the audit committee.
   
   
8. Implement an issues management process Once you’ve identified and confirmed the issues or control gaps, you must follow an issues management process to manage those issues from identification through remediation. Start by entering the issues you’ve identified in the issues management system (JIRA, for example). Then assign ownership by determining which business function is responsible for the compliance violation based on the mapping you did when you were creating the requirements library.Determine the severity of the compliance violation on your company. When you rate violations of law, you should also assess the pervasiveness, duration, and severity of the violation.Be sure to document the underlying cause of each issue and work with the affected business units to document the remediation plan to address that underlying cause, including milestones you want to achieve and when you want to achieve them.
   
   
9. Validate remediation When you’ve completed the milestones of the remediation plan, validate that the plan worked as intended. Validation should assure that the corrective actions addressed the immediate issue and that the long-term remediation prevents the issue from recurring. You may be required to perform the test again to validate that the remediation plan worked. You will also need evidence that you completed the remediation plan.
   
   
10. Monitor sustainability You should establish a period of sustainability that must be achieved before closing the issue – for example, the compliance violation should not occur again for at least two months. Based on the organization’s risk appetite, you could increase the number of months.At the end of the sustainability period, you must gather and maintain evidence that the issue did not recur. If the issue does not recur, then you can close the issue. However, if the issue did recur during the sustainability period, you’ll have to reestablish the underlying cause and adjust the remediation plan accordingly.

ZenGRC Offers a GRC Solution for Compliance

If you operate in a regulated environment, you’re expected to have a compliance management system. If you want your compliance management system to be effective, you must perform testing against the statutory, regulatory, or contractual requirements that affect your company.

Performing compliance testing in an ad-hoc manner can lead to increased regulatory scrutiny since you won’t be able to provide evidence that you have a fully functioning compliance testing program.

By following these steps, you’ll be able to get your company’s compliance testing program off the ground.

Contact ZenGRC today to get a demo and see how we can help you with your compliance needs.

Payroll is a crucial business process in any organization because it assures that employees are compensated in full and in a timely manner. Employees assume they will receive their paychecks without delays or errors; it’s a basic expectation.

Conversely, payroll delays and errors erode employee morale and productivity — and even lead to enforcement from labor regulators. Unhappy employees, meanwhile, also jeopardize the company’s profitability, financial stability, and reputation. For these reasons, it’s critical to develop a strong payroll process, identify any risks, and implement robust control activities to mitigate those risks.

Common Payroll Risks and the Need for Controls

Ghost Employees

Ghost employees are a common cause of payroll fraud. These are usually:

• Fake employees who don’t exist and are employees on paper only;
• Dead or terminated employees who remain on the payroll;
• Real people who never work at the business but receive paychecks from it anyway.

Ghost employee fraud is almost always perpetrated by someone inside the company, usually working in or managing the payroll function.

If the ghost employee is an actual person, he or she may also be involved in the fraud. In some cases, a ghost employee payroll scheme is set up by an employee to bribe someone outside the company and make the bribe payments look like legitimate payroll payments.

Timesheet Padding

Hourly employees claiming that they worked more hours on their timesheet than they actually worked is another common payroll risk. Such padding of time records is particularly prevalent in smaller companies that use legacy timekeeping systems, such as paper time cards or spreadsheets. Timesheet padding is also common when employees work remotely or when there is little or no managerial oversight.

Attendance by Proxy

Attendance by proxy (also known as “buddy punching”) happens when one employee clocks in for another. If it happens on rare occasions, the harm to payroll is small. When widespread or frequent, however, the fudged hours or days can add up and result in significant losses for the organization.

Incorrect Classification

The risk of incorrect payee classification is fairly high for companies with inexperienced teams running payroll in-house. When contractors and freelancers are not separated from full-time employees in the payroll, the company may end up paying more taxes than it needs to.

Lack of Security Leading to Data Loss

The payroll system contains all sorts of sensitive information related to the organization and its employees. Unfortunately, many organizations still use insecure password-based systems or have no controls to identify or prevent phishing scams. This lax security leaves the organization vulnerable to data breaches, fraud, and compliance-related fines.

Non-Compliance

A lack of understanding of relevant laws around taxation, overtime pay, holiday pay, or minimum wage pay rates can create compliance headaches for the payroll department. Further, the legal and regulatory landscape is constantly changing, so payroll must keep up to assure that the company is not fined or otherwise punished for its compliance mistakes.

Natural Disasters or Other Disruptive Events

Disasters and emergencies can disrupt operations in any company. If a disruptive event occurs, the company may not be able to fulfill its payroll obligations. That can lead to disgruntled employees, increase churn, and ultimately harm operational continuity and service delivery.

Internal Controls Procedures for Payroll Systems

Many types of internal controls play a critical role in minimizing risks for payroll systems. Every organization should consider these payroll internal controls.

Segregation of Duties

Segregation of payroll duties, also known as separation of duties, assures that no single person has access to all the sensitive payroll data or tasks to perpetrate fraud. At the very least, these payroll tasks should be segregated:

• Timesheet approver
• Payroll processor
• Paycheck signer and issuer
• Payroll tax preparer

Payroll Audits

Regular payroll audits can minimize the chance of fraud due to buddy punching or ghost employees. Audits can confirm that the payroll system is running correctly and reveal whether the organization is accurately fulfilling its payment and tax obligations.

Separate Bank Accounts

A separate bank account for payroll reduces the number of company assets at risk. Even if an employee commits payroll fraud, the business losses will be limited to that account only. A dedicated payroll account also simplifies audits.

This account should only contain enough funds to process and complete payroll. All other business funds should be maintained in a separate bank account.

Management Review

A member of company management (or the business owner) should periodically review payroll records. Managerial oversight can assure proper payroll record-keeping and reduce the risk of fraud.

Digitized Time Tracking

Time and attendance software can address the risk of incorrect timekeeping, payroll mistakes, and fraud. Time tracking and payroll software also records overtime, approved paid time off, and unpaid absences as additional payroll controls.

For example, software applications are now available with an approval checkbox on every employee’s time card. A supervisor must provide that approval before the time card can be sent to payroll for processing. Once the payroll preparer receives this approval, the employee cannot make changes to the timesheet.

Access and Change Control

The roles and access levels of payroll staff should be carefully assigned and monitored. Only authorized staff with the proper access rights and permissions should be allowed to make changes to the payroll system. Non-payroll employees should not be able to access the payroll information of other employees.

Any changes — especially incorrect ones due to either fraud or negligence — can be quickly identified and addressed with changelogs and audit trails.

Variance Analysis

Organizations should know how much they spend each payroll cycle. If payroll in one pay period greatly fluctuates from the average spend, that could indicate payroll errors or fraud. Therefore, a mechanism should be established for payroll managers to investigate such variances.

Other Security Controls

All electronic payroll and employee records should be protected with strong passwords and ideally with two-factor or multi-factor authentication (2FA or MFA). All physical payroll records must be stored in a safe place with robust access controls so that unauthorized people cannot access, modify, compromise, or delete the documents.

Some other ways to strengthen payroll security are:

• Train payroll staff on the dangers of social engineering scams such as phishing, as well as ransomware and different kinds of cyberattacks that may result in data breaches.
• Limit access to the payroll office to authorized personnel only.
• Protect payroll documents stored offsite with strong physical security.
• Protect all computer systems and databases with a strong firewall, endpoint security solutions, and other security measures.
• Protect online payroll documents or records with robust access control.
• Securely dispose of all paper documents.
• Establish a policy to process all external requests for payroll information specifying the:
  • Acceptable communication channels (for example, all requests should be given in writing);
  • Audit controls;
  • History and change logs

How Can I Implement Payroll Internal Controls?

Implementing internal payroll controls should start by first identifying the risks specific to your organization. For instance, a small business with fewer than a dozen employees is less likely to have a problem with ghosting or buddy punching. In larger organizations, both these issues could be more challenging to detect.

It’s also essential to identify the relevant regulatory and legal rules applicable to the organization. Non-compliance can be a serious problem, so knowing your compliance obligations is another good starting point for implementing internal payroll controls.

Automated time and attendance tracking systems should be implemented, along with cybersecurity measures such as access control and MFA. In addition, if payroll staff have multiple roles or carry out various activities, their duties should be segregated.

If a separate bank account does not already exist for payroll, open one without delay. A designated bank account is a quick and easy way to improve control over your payroll processes. Finally, the organization should establish a mechanism to conduct regular management audits and fraud audits.

Protect Your Payroll System With ZenGRC

Protect your payroll function with adequate controls to reduce financial risks and keep your business running smoothly. ZenGRC can help you identify and manage payroll risk and compliance by documenting audits and tracking workflows.

Get better visibility into your payroll landscape, recognize risks, and mitigate business exposure — all from one single, integrated platform. ZenGRC provides customizable risk calculations and enables continuous risk monitoring, so you can catch and remediate payroll and other risks quickly before they become an issue.

Want to see for yourself how ZenGRC works? Schedule a demo.