HR & Payroll
Payroll Banking Detail Changes
Bank-detail changes on the payroll master are a leading red flag for salary diversion; this screen makes every amendment visible and accountable.
Why mid-cycle banking changes warrant forensic attention
A change to an employee's bank account on the payroll master, made shortly before a pay run, is one of the most reliable indicators of salary diversion and ghost-employee fraud. Accounting officers carry a direct MFMA Section 62 (or PFMA Section 38) duty to maintain effective systems of internal control over payroll, and the AGSA routinely tests the change-control around banking details during regularity audits. AuditPro Core captures every banking-detail amendment with its timestamp, initiator and approver so that suspicious patterns surface before money leaves the account rather than during a post-mortem investigation.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Account changes
214
this pay cycle
Within 3 days of run
31
▲ 9 vs prior
Unauthorised changes
7
Duplicate accounts
4
shared across staff
Banking changes by proximity to pay run
High-risk banking changes
| Entity | Employee no. | Days to run | Dual auth |
|---|---|---|---|
| City of Tshwane | EMP-40219 | 1 | No |
| Limpopo Health | EMP-11783 | 2 | No |
| Eskom | EMP-90551 | 3 | Yes |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
The salary-diversion fraud pattern
A fraudster changes a legitimate employee's banking details to an account they control, lets one or two cycles pay out, then reverts the change to hide the trail. Concentrations of changes just before payroll cut-off, or changes paired with a later reversal, are the signature of this scheme.
Segregation of duties on the master file
The person who can amend banking details should never be the person who approves the change or releases the pay run. Where one user can do all three, the control breaks down regardless of how good the surrounding process looks on paper.
Maker-checker and independent verification
Sound practice requires that a banking change is confirmed against an independent source — a bank-stamped letter or account-verification service — and authorised by a second official before it takes effect on the master file.
Audit trail completeness
A change is only as auditable as the evidence behind it. The old value, the new value, who made it, who approved it and the supporting document must all be retained and tamper-evident to satisfy an AGSA or internal-audit review.
How AuditPro Core Bridges the Gap
- Change capture: every banking-detail amendment is logged with before-and-after values, initiator, approver and a precise timestamp tied to the source HR/payroll system.
- Exception workflow: changes occurring inside the pay-run cut-off window, or paired with a subsequent reversal, are raised as exceptions for an independent reviewer to clear before payment.
- Segregation enforcement: the platform flags cases where the same user initiated and approved a change, evidencing a breakdown in segregation of duties.
- Audit-ready export: a defensible change register, complete with supporting documents and sign-offs, can be exported for the audit file in one step.
Key Takeaways
- Mid-cycle banking changes paired with a later reversal are the classic salary-diversion signature — monitor the pairing, not just the change.
- Independent verification and maker-checker on banking amendments are the primary preventive controls.
- Same-user initiate-and-approve is a segregation failure that should never reach production payroll.
- Retaining before-and-after values and supporting evidence turns the change log into admissible audit evidence.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.