3 Questions Every CFO Should Ask their Head of Payroll
Payroll is one of the largest recurring cost bases an organisation carries, and one of the few that rarely appears as a single line in the accounts. Employee costs may be spread across cost of sales, operating expenses, research and development, project costs recorded as assets, and multiple legal entities or cost centres. In service and knowledge-based sectors it is the largest operating cost of all. Yet for all that weight it is usually governed as an administrative cycle: something that runs, not something that is controlled. The size is visible to everyone, but the aggregate exposure, fragmented across the statements, to almost no one. That gap is the subject of this briefing.
The largest source of misstatement, and where the controls stop
Payroll is among the largest single sources of potential misstatement on the P&L: a high-volume data engine feeding many lines of the accounts at once, whatever its share of total cost. That does not mean it flows to the statements unchecked. Controllership sits downstream to catch what payroll gets wrong: payroll-to-ledger and bank reconciliation, accrual and provision review, flux analysis, tax-remittance checks, audit sampling. That stack does real work.
The exposure is not that those controls are missing, but what they test. They confirm the payroll number was recorded, reconciled, and internally consistent. They do not re-derive it from statutory source. So, a figure wrong at the point of calculation but internally consistent passes cleanly: it reconciles to itself, ties to the ledger, and clears the bank. Reconciliation checks agreement, not correctness.
Variance analysis detects change, not steady-state error: a rate misapplied from the first run and applied every period since generates no flux to investigate and can run for years unseen. And much payroll failure books as accurate expense while creating the real liability where a P&L lens never looks: withholding errors, misclassification, statutory underpayment. The expense line stays clean; the penalty, the back-pay, the reserve, and the restatement risk are not on it.
Why the exposure stays invisible
Payroll tends to report green, and a green dashboard reassures in exactly the wrong way. Green confirms the payment went out on time. It does not confirm the number was right and says nothing about whether the function is one resignation, one system change, or one missed deadline from failure.
The trap is what green measures: realised incidents, not the manual interventions, workarounds, and named individuals holding the process up behind them. A control environment can post a low failure rate for years, not because the risk is low but because knowledgeable people keep rescuing it before payday. Reported frequency stays flat while control risk climbs, and the two are easy to confuse until the person who remembers the workaround leaves. Most failures are contained and corrected; what decides whether an error stays local or compounds into financial, statutory, and reputational cost is not luck but the state of that control environment. It is the risk profile Finance is paid to govern, and the one most often filed under “operational” and left alone.
Where the error enters, and who carries it
A significant share of payroll error originates upstream, not in payroll: a wrong input from HR, an unapproved time record, a misread policy, a late change. Payroll generates its own too, through configuration, manual entry, interface defects, and interpretation. For Finance the useful question is not where an error is born but where it is last catchable, and that is payroll: the final control point before upstream reality becomes money paid, expense booked, and statutory liability created. It cannot own every source transaction, but it is the last place an error can be stopped before it is real. Two consequences follow.
First, correcting output without correcting the input treats the symptom and leaves the cause in place, so the error returns next cycle. A function measured on corrections rather than on removing their causes will correct the same thing indefinitely.
Second, outsourcing the processing does not move the accountability. A vendor may carry contractual liability for failures it causes, but it automates the inputs it receives, including the wrong ones, faster. The employer's ultimate accountability for filings, tax accuracy, and statutory reporting does not transfer with the processing. The calculation is outsourceable. The accountability is not.
Three questions to ask your Head of Payroll
A CFO does not need to learn payroll to govern it. Three questions reveal more than any dashboard:
What share of our payroll errors and corrections originate upstream, in HR, time, or approvals, and is that share rising or falling? This asks for a trend, not an anecdote, and shows whether root causes are being removed or just re-corrected each cycle.
Which payrolls depend on undocumented knowledge or named individuals, what compensates for that, and would we know it had failed before payday or after? This tests single points of failure, and whether green reflects a healthy process or a rescued one.
When incorrect data is processed correctly, how is responsibility allocated across HR, managers, payroll, and vendor, and is that allocation written into our controls, service agreements, escalation routes, and root-cause reporting? This forces a description of the operating model rather than a principle. A function that cannot describe it does not have one.
The answers locate the risk. A function that answers all three crisply is operating as a control. One that cannot is carrying an exposure that has simply not surfaced yet.
What governing it as a control means
Agreeing payroll should be a financial control is not the same as knowing what that looks like, so to be concrete: it means owning the whole chain, from source data through calculation, posting, payment, and statutory reporting, not just the run. In practice, named ownership at each handoff; preventive and detective controls with reconciliations that test correctness, not only agreement; controlled system and vendor change; resilience that does not rest on specific individuals; and error reporting that removes recurring causes instead of correcting their symptoms every cycle. Built this way, payroll produces the accuracy the downstream stack already assumes it is getting. Left to run on delivery and heroics, it does not and cannot tell you which of the two it is.
The bottom line
Payroll is where the organisation's largest human commitment becomes a number, and that number flows into reporting, cash, and statutory liability alike. It is a financial truth engine: written in numbers, paid in wages, reflected across the accounts. When it is wrong at source, the controls downstream confirm the figure rather than correct it, and the error lands not only on the P&L but in the balance sheet, the cash forecast, or the statutory return, sometimes in all three while each still ties out.
Governed as a control, payroll is one of the most reliable sources of financial accuracy a company has. Left to run as administration, it is the largest source of misstatement the rest of the stack is least equipped to catch. The three questions above will tell a CFO, in about the length of one meeting, which of the two he owns.