Payroll Support Package for Controllers: Build a Reviewable Evidence Index
Updated: Nov 3
A controller opens the month-end payroll folder and finds the final register, a balanced journal and a bank debit. Those records still leave a question: which evidence establishes that the payroll tax liability was paid to the right account? The folder needs a way to distinguish a supported conclusion from a document that merely looks related.
Build the payroll support package around the questions finance must answer. Identify the payroll events included, connect each conclusion to an exact source, record the checks performed and preserve the limitations that remain at release. A later reviewer should be able to follow that path without relying on the preparer's memory.
This guide is for U.S. payroll and finance teams assembling controller support for close, variance review and subsequent audit requests. The proposed evidence index is a practical operating method, not a mandatory government form or an assurance opinion. Adapt it to the entity's accounting policies, reporting needs, retention schedule and review responsibilities.
If the recurring difficulty is obtaining usable reports from your provider, compare reporting access and retained responsibilities before changing services. SelectSoftware Reviews offers advisor-led payroll matching for employers evaluating that choice.
Contents
Give the package a defined boundary
Start the index with the legal entity, accounting period, currency and payroll events it covers. Include earned dates and pay dates separately. A package for the September close might contain September pay dates, a payroll accrual for unpaid September service and later settlement evidence. Those are different populations unless someone has explicitly reconciled them.
List every included regular run, off-cycle payment, void, replacement and adjustment. Record the source system's identifiers where available. If an export has no stable identifier, assign a controlled file version and retain the extraction details that distinguish it. A filename such as Payroll Final.xlsx is not enough when three people have saved different files under that name.
Choose the package's boundary before reconciling its totals. A report filtered to active employees can omit a terminated employee's final payment. An export grouped by pay date can omit an accrual that finance posted by earned period. A total that agrees with another report using the same incomplete filter has not established population completeness.
The handoff from payroll to finance should identify when the approved run and its support become available. The evidence index then records what finance actually received and reviewed. If a missing file prevents a close decision, name that missing file and the person obtaining it instead of marking the whole package complete.
For multiple entities or currencies, use a separate index or clearly identified sections with their own control totals. Keep any consolidation or translation bridge visible. Combining unrelated totals into one summary can hide the very difference the controller needs to investigate.
Choose evidence by the question it can answer
The controller's questions determine which records belong in the package. One source can support several questions, but its limitations travel with it.
What was approved for payment? Identify the final payroll register, the approved input changes and the approval covering that version.
What reached the ledger? Retain the posted journal or batch reference and a bridge from payroll amounts to its accounts.
What explains the change? Show a comparable prior-period basis, quantified drivers and the evidence behind those drivers.
What remains payable? Connect the liability balance to its underlying obligations, payments and unresolved items.
What happened to the money? Identify the relevant bank, provider and recipient evidence without treating those records as interchangeable.
What did the reviewer decide? Preserve the reviewer, date, scope, disposition and any conditions that were left open.
A bank debit may establish that money left the company's account. It does not, by itself, establish the allocation between wages, taxes, benefit deductions, service fees and reserves. A provider funding report may describe that allocation without establishing government receipt. Label the question each document answers.
Use an index entry rather than copying the same attachment into six folders. For example, the approved register can be one controlled record linked from the gross-to-net reconciliation, the journal bridge and the variance explanation. Each entry should identify the relevant page, tab, row range or report section so the reader does not have to search the entire file.
Preserve source evidence as well as a summary. A screenshot of a total loses filters, detail and sometimes the report version. It can illustrate a result, but a usable export or retained source report is usually better support for reproducing the calculation. Where the system cannot export sufficient detail, document that limitation and the alternative evidence the reviewer accepted.
Make exported reports reproducible
For each important report, record its source, extraction time, parameters, included population and version. Include filters that can change the answer: legal entity, employee status, pay date, earned dates, adjustment status, currency and whether voids are included or excluded.
Keep the source export intact. Perform transformations in a separate working file or clearly separated layer, preserving the mapping and formulas used. If payroll codes become general-ledger accounts, retain the applicable mapping version and explain any manual overrides. A later mapping change should not silently rewrite the explanation for an earlier payroll.
Check completeness against an independent reference where possible. Reconcile the run list to the approved payroll calendar and the separately authorized nonstandard runs. Compare exported totals with the final system summary and account for exclusions. Counting rows alone is weak when one employee can have several rows or an entire omitted run contributes none.
Check accuracy at the level needed for the conclusion. A controller evaluating a department variance needs a reliable department assignment, not only a company-wide wage total. Review a risk-based selection of underlying changes and transformations, document why those items were selected and retain the result. Do not describe a sample as a full-population check.
For audits conducted under PCAOB standards, AS 1105 addresses evaluating company-produced information, including its accuracy, completeness and sufficient precision for the auditor's purpose. This is not a rule making the proposed index compulsory for every employer. It explains why a file's existence alone may not answer a later audit request.
Agree with the actual auditor on requested evidence and delivery arrangements. An index can organize a response; it cannot promise that a particular auditor will accept a report or that the package establishes an effective control.
Use each layer to answer its own question. A completed step does not substitute for evidence needed at the next layer.
Follow one payroll through the financial records
Consider a fictional employer using an approved accrual-basis accounting policy. All amounts below are assumed for illustration, not statutory tax rates or a recommended account structure.
Its final current payroll contains $120,000 of regular wages and an $18,000 off-cycle bonus. Total gross wages are $138,000. Assumed employee tax withholding is $33,000 and employee benefit deductions are $3,000, leaving $102,000 of net pay.
The employer also records $10,000 of employer payroll taxes and $5,000 of employer benefit expense. Its summarized journal is:
Debit wage expense: $138,000.
Debit employer payroll tax expense: $10,000.
Debit employer benefit expense: $5,000.
Credit net-pay clearing: $102,000.
Credit payroll tax liabilities: $43,000.
Credit benefit liabilities: $8,000.
Both sides total $153,000. The $43,000 combines employee withholding and employer tax cost; the $8,000 combines employee benefit deductions and employer benefit cost. Actual records would separate the relevant authorities, plans and accounts.
The package should show how those amounts came from the final payroll and reached the posted batch. It should also identify which costs, if any, require a separate period-end accrual under the employer's policy. Paying employees during one month does not, by itself, determine the accounting treatment of every earned period.
Now trace the $102,000 net-pay clearing amount to the payment evidence. Account for outstanding checks, rejected deposits or replacement payments rather than assuming the whole batch settled because the provider withdrew funding. Keep the employee payment reconciliation distinct from the tax and benefit liability schedules.
Suppose one tax subaccount, for the same authority and period, contains a $9,000 obligation. A verified remittance of $7,000 leaves $2,000 unexplained in that line. The index must show the difference and its owner. It must not label the tax account settled simply because the journal balances or the company funded the provider.
Investigate the payment, allocation, timing and applicable deposit requirements promptly. A controller's financial-close disposition does not extend a legal payment deadline or authorize delayed tax deposits. The package can truthfully document an open item while the responsible tax or payroll owner resolves it.
Explain changes on a comparable basis
Use the same entity, employee population, currency, earned-period basis and payroll-event scope for the amounts being compared. If the basis changed, bridge that change before attributing the remainder to operating activity.
In the fictional example, the comparable prior regular payroll was $110,000. The current regular payroll is $120,000, explained by $8,000 for new hires, $3,000 less for unpaid leave and $5,000 for approved rate changes. The regular-pay movement is $10,000. The separately authorized $18,000 bonus brings total current gross wages to $138,000, a $28,000 increase over the stated prior basis.
Retain the supporting change records, their effective dates and the calculation assigning each amount to its driver. Explain whether those drivers describe paid wages, earned cost or another measure. A headcount report can support who joined; it may not reproduce the payroll effect without pay-period dates, rates and hours.
Check that the explanation reconciles to the total. Do not label the entire movement as growth if part comes from an off-cycle payment, an extra payday, a retroactive adjustment or a changed report filter. If several effects overlap, choose a calculation order and disclose it so the same change is not counted twice.
For example, new hires at changed rates should not appear fully in both the headcount and rate categories. Calculate their contribution once, then define the remaining rate category for the continuing comparable population. The index should point to that bridge rather than a sentence saying management understands the increase.
Retain unexplained differences explicitly. Under a different evidence outcome, a $28,000 movement with only $26,500 supported drivers would have a $1,500 residual. Naming it other does not establish its cause. Assign investigation and apply the employer's review and materiality policies, including qualitative concerns, without inventing a universal dollar threshold.
A payroll variance investigation may uncover a true payment or posting error. Preserve the connection between the explanation and the correction, including the employee or account population affected. Updating the narrative alone does not repair the record.
Record what is complete and what is still open
Use release terms that describe the actual state. A practical choice is complete for the stated scope, released with named open items, or incomplete for the decision requested. Define those terms in the team's procedure so one preparer's complete does not mean another reviewer's waiting on tax evidence.
The release record should state who reviewed which version, what they checked, the outcome and the release time. A named approval with no evidence reference can become ambiguous after a workbook is replaced. Link the approval to the version or controlled location the reviewer actually saw.
Some work may proceed while another conclusion remains unsupported. Finance might accept an accrual estimate under its accounting policy while a later settlement comparison remains open. Record both decisions and their owners. Do not turn permission to use an estimate into a claim that the eventual payment or liability has been reconciled.
Where an open item prevents a specific conclusion, make that consequence visible at the front of the package. State the affected account or report, the information still needed, the next decision time and the escalation route. A provider ticket can document that help was requested; its open status is not evidence that the underlying issue was resolved.
Keep the package index connected to the close issue log. The index locates evidence and review results; the issue log manages the unresolved work and its escalation. Linking the records is more useful than maintaining two independent descriptions that diverge as the case changes.
In a small team, identify which tasks share a preparer and which reviewer provides the available oversight. A practical compensating review might inspect the final bank reconciliation, changes to payment details and unexplained balances. Describe the actual review performed rather than claiming separation of duties the team does not have.
Compare providers against the records you need
If your provider cannot supply a reproducible review package, describe the missing reports and access requirements to SelectSoftware Reviews. Ask prospective providers to demonstrate an export your controller can review.
Copy the Controller Payroll Evidence Index
Use one package header for the stated scope. Repeat the question entry for every conclusion the controller needs, then complete the release section. Keep the underlying records in controlled locations and test the links using the intended reviewer's access.
Package header
1. Package boundary: Legal entity; accounting period; currency; earned dates; pay dates; purpose of this release.
2. Included events: Regular, off-cycle, void, replacement, adjustment and accrual references; final versions; exclusions and their reasons.
3. Extraction freeze: Source systems; extraction date and time with time zone; parameters; controlled source location; preparer.
Repeat for each controller question
4. Controller question: The conclusion this entry supports, expressed so a reviewer can tell whether it has been answered.
5. Named evidence: Exact file or report version; source location; relevant tab, page or row range; associated run or ledger reference.
6. Completeness and accuracy checks: Population reference; control totals; transformations or mapping version; checks performed and their scope.
7. Result and limitation: Reproducible calculation or finding; supported conclusion; unresolved difference; what this evidence does not establish.
8. Reviewer and disposition: Reviewer; reviewed version; review time; accepted, returned or open; specific follow-up owner and decision deadline.
Release and later change
9. Release decision: Complete for the stated scope, released with named open items, or incomplete; authorized reviewer; date and time.
10. Open follow-up references: Linked issue records; affected conclusion; next action; escalation and verification requirements.
11. Access and retention owner: Intended reviewers; restricted underlying records; approved retention schedule; applicable hold or review instructions.
12. Replacement or addendum trail: Prior released version; new evidence or correction; financial and reporting impact; approval; supersession reference.
Keep each numbered field on its own row. A completed release section does not override an unresolved payment, tax, legal or accounting requirement.
A filled entry for the fictional tax difference
Question: Is tax subaccount T1 settled for the stated period?
Evidence: Final payroll liability detail T1-v3, approved $9,000 obligation; authority payment confirmation P17 for $7,000; bank settlement reference B44.
Checks: Same employer account, authority, tax type and period confirmed; payment compared with the liability detail; no other payment identified in the reviewed records.
Result: $2,000 remains unexplained. The available evidence does not support a settled conclusion. Payroll's tax owner will check allocation and missing or failed payments immediately against the applicable requirements.
Disposition: Returned for investigation. The controller records the separate close treatment under company policy and links issue T1-09. A later receipt or correction must be verified and added to the trail before this entry changes to settled.
This entry is useful because its conclusion is narrower than the entire package. The wage calculation and journal may be supported while this specific tax question remains open. Do not copy the fictional identifiers or assumed amounts into a real employer's records.
Separate the review package from restricted payroll data
Give controllers and auditors the evidence they need through approved access channels. A broadly shared index may contain totals and controlled references while detailed employee records remain in a restricted location. Confirm that authorized reviewers can actually retrieve the necessary support before release.
The FTC's business guidance on protecting personal information recommends limiting sensitive information to what the business needs, restricting access to those with a need to know and maintaining a written retention policy. Apply those principles to the review copy without deleting legally required source records.
Avoid unnecessary Social Security numbers, bank details and personal explanations in variance narratives. An employee identifier and a reference to the restricted supporting record may be enough for the controller's calculation. Where law or a legitimate review requires the underlying details, provide them through the authorized channel.
A link is useful only if its permission, location and owner survive the review period. Test access as the intended recipient, identify who can restore it and avoid employee-owned storage that disappears when someone leaves. Do not distribute passwords or payroll credentials inside the package.
For external audit delivery, confirm the request, approved recipient, secure transfer method and permitted scope. Keep a record of what was supplied. A redacted convenience copy should be identifiable as such and traceable to the controlled original, so a later reviewer does not mistake missing detail for missing source evidence.
Assign retention by record type
The controller's index is not a replacement for the employer's retention schedule. Record categories can have different minimum periods and starting events. Apply the relevant requirements to the underlying records, the index, working papers and review evidence rather than choosing a destruction date from the age of the folder.
IRS Publication 583 describes the general employment-tax record minimum as at least four years after the tax becomes due or is paid, whichever is later. That is a baseline, not permission to discard records subject to a longer requirement.
The current 2026 IRS Publication 15 recordkeeping section specifies at least seven years for records related to qualified wages for the COVID-19 employee retention credit paid after June 30, 2021. It specifies at least six years for records related to qualified sick and family leave wages for leave taken after March 31 and before October 1, 2021. Identify the actual record category before applying either period.
The Department of Labor's FLSA recordkeeping guidance describes generally retaining payroll records for at least three years and wage-calculation records, such as time cards and wage-rate tables, for two years. Those FLSA categories do not replace tax or other applicable obligations.
Have the responsible legal, tax and records owners approve the schedule for the employer's jurisdictions and records. Route pending claims, audits, notices or other preservation instructions to that owner before disposal. The package should identify the schedule and any applicable hold, not ask each preparer to make a fresh legal retention judgment.
Keep retention and access together. A seven-year record held in a canceled provider account with no workable retrieval route is an operational problem even if someone believes it still exists. Include historical exports and read access in provider-transition planning, and verify that retrieved records remain readable and sufficiently detailed.
Keep provider records connected to employer responsibility
For an ordinary payroll service provider arrangement, the IRS explains that outsourcing does not remove the employer's responsibility for employment-tax obligations and recommends verifying federal tax payments through EFTPS. Other arrangements, including certified PEO arrangements, have different rules; establish the actual arrangement rather than applying this statement to every provider.
Request evidence that matches the conclusion: a final register for payroll amounts, a posting report for the journal, a bank trace for a payment movement and appropriate tax-account evidence for deposits. Record the provider's delivery schedule and what the employer must obtain independently.
If a provider cannot reproduce an old report, preserve its written explanation and identify what alternative evidence is available. Do not create a replacement file that appears to be the original export. Label a reconstructed schedule, show its sources and assumptions, and obtain the review needed for the purpose.
A provider change can split the evidence across systems. Name the custodian for each period, the export deadline, the permitted access after termination and the owner who checks the transferred files. Include corrected returns and later notices in that arrangement so the archive does not stop at the conversion date.
Where repeated manual rebuilding is caused by the available reporting, use a realistic sample of the employer's required outputs during provider evaluation. Ask the seller to demonstrate those outputs and explain limits. An attractive dashboard is not evidence that the controller can retrieve a historical, version-specific package.
Preserve the released version when facts change
Keep the original released index and supporting files identifiable. Add later evidence through a dated addendum or a controlled replacement that references the earlier version. Avoid silently overwriting a conclusion that the controller or auditor previously used.
The change record should identify the new information, affected events, financial impact, downstream records, reviewer and effective replacement. If no amount changed, say what did change, such as receipt of a payment confirmation or corrected employee allocation. That lets a later reader distinguish an evidence improvement from a financial correction.
In the fictional example, a preparer initially used a $124,000 regular-pay preview rather than the $120,000 approved run. Replace the wrong source in the working reconciliation, explain the $4,000 version difference and review every calculation that used it. Do not post a balancing entry merely to make the ledger agree with an obsolete export.
If the wrong preview had already supported a posted journal, the controller must assess the actual posting and any required correction under company policy. Link the corrected batch, reconciliation and issue record. A revised index should not imply that the original journal was correct when it was not.
Later settlement evidence may resolve the fictional $2,000 tax question. Verify that the evidence relates to the same employer account, authority, period and obligation, then record whether a payment, allocation correction or other action resolved the balance. Preserve the original unresolved entry and the date the conclusion became supportable.
Keep the original release available. Link later decisions to the evidence and records they actually change.
Before filing the next package, give another authorized reviewer one question from the index and ask them to follow it to the named support. Resolve missing permissions, ambiguous versions and unexplained calculations while the preparer still remembers the work. Record what was checked and what failed; a planned retrieval exercise is not a claim that the archive has already passed one.
Questions about controller support
Must every payroll have its own folder?
Use the structure that makes the event boundaries and shared evidence clear. A monthly package can reference several runs if each run is identifiable and its totals are reconciled. If a single folder mixes entities, periods and versions without those distinctions, split it or improve the index before release.
Is a provider's standard report enough?
It can be sufficient for a particular question if the report's population, version, accuracy and relevant detail are established. It may be insufficient for a different question, such as government receipt of a payment. Assess the conclusion and the evidence together rather than rejecting or accepting all standard reports as a category.
Can the package be released before all later payments settle?
Define the release scope and record the unsettled obligations, owners and required follow-up. A release may support a stated accounting review without establishing settlement. It does not change employee-pay, deposit or filing deadlines. The responsible owner must assess any missing or late payment immediately.
What is the first improvement for a scattered archive?
Choose a recently completed payroll and build the question-to-evidence index from its actual records. Identify one unsupported conclusion, one ambiguous version and one access failure if they exist. Fix the specific gaps, then use the resulting structure for the next package. Keep useful records and avoid moving the entire archive solely to make folder names uniform.
Ready to discuss payroll options?
Take the evidence requirements from your controller index into an optional SelectSoftware Reviews conversation. Verify the actual reports, retention access and service responsibilities before selecting a provider.
Explore related payroll resources:
About the author
Ben Scott writes and maintains payroll decision guides for founders and operators. His work focuses on execution realities and how decisions hold up under growth, complexity, and controls and documentation pressure. He works hands-on in HR and leave-management roles that intersect with payroll-adjacent workflows such as benefits coordination, cutovers, and compliance-driven process controls.
