Payroll Audits: How CPAs Can Help Clients Avoid DOL Penalties

8/3/2026

Start by separating two exposures the phrase "payroll audit" runs together, because they involve different agencies, different rules, and different remedies.

The Department of Labor enforces wage and hour law — whether employees were paid the required minimum wage and overtime, and whether records were kept. It does not assess payroll tax penalties.

Employment tax — withholding, deposits, returns, and the penalties for getting them wrong — is an IRS matter.

Both are real, both surface in the same client conversation, and a self-audit should cover both. But the DOL exposure is the one clients underestimate, because it is not capped by a tax computation: it is back wages, frequently doubled, going back years, for a class of employees at once.

Why the Wage and Hour Exposure Is Larger Than Clients Expect

Four structural features:

Liquidated damages can double the back wages owed, as a general matter, which turns an accounting error into twice an accounting error.

The lookback period is measured in years, and is longer where the violation is willful — and a client who was told about a problem and did nothing is in a materially worse position than one who never knew.

Violations are usually class-wide. A misclassification is rarely one person; it is a job title, which means everyone who has ever held it.

Owners and managers can face individual liability under the FLSA's definition of employer, which is a different conversation from a corporate assessment and one that gets a client's attention.

Add attorneys' fees in private litigation, and the arithmetic explains why this is worth a summer afternoon.

Where the Money Actually Is

In rough order of exposure, and not in the order clients expect.

1. Employees classified as exempt who are not

The largest single source of wage and hour liability, and the reason is that the test is about duties, not about the salary or the title.

The salary requirements are necessary but not sufficient: an employee must be paid on a salary basis, at or above the required level, and perform duties meeting the relevant exemption's test. A well-paid employee with a managerial title who spends their time doing the same work as the people they nominally supervise is not exempt because of the title or the pay.

What to actually examine, position by position:

What the person does all day, established from the employee and the supervisor rather than from the job description — which is usually aspirational and was written by someone who is no longer there.

Whether an administrative exemption claim rests on genuine discretion and independent judgment as to matters of significance, which is the most-litigated phrase in the area and the one most often assumed rather than analyzed.

Whether a managerial claim involves genuine supervision and authority over personnel decisions.

Whether the salary basis has been broken by improper deductions — because docking an exempt employee's pay for partial-day absences or as discipline can destroy the exemption for that employee and potentially for the whole classification.

That last point is worth flagging: a client can have a defensible classification and lose it through payroll practice.

2. Time worked and not recorded

The second-largest, and the one that has grown with remote work.

The employer's obligation is to pay for hours worked, including work it knew about or should have known about — regardless of whether it authorized the work or whether the employee recorded it.

Where it hides:

Remote and after-hours work. Answering messages and email outside scheduled hours is generally compensable for a non-exempt employee, and "we told them not to" is not a defense if the employer permitted it and benefited.

Pre-shift and post-shift activity — startup, closing, equipment, and required preparation.

Working through breaks, including an employee who eats at their desk while covering the phone.

Travel time, which has specific and counterintuitive rules.

Training and required meetings.

Automatic meal deductions applied whether or not the break was taken — a practice that generates a class claim almost by itself.

Rounding practices that systematically favor the employer.

The related management issue: a policy prohibiting unrecorded work does not cure it. What cures it is a mechanism that captures the time and a supervisor culture that does not reward working around the system.

3. The regular rate of pay

The most common technical error, and one that CPAs are well placed to find because it is arithmetic rather than judgment.

Overtime is computed on the regular rate, which is not the base hourly rate. It generally includes non-discretionary bonuses, shift differentials, commissions, certain incentive payments, and other remuneration — allocated back over the period earned, which means a quarterly production bonus can require retroactive recomputation of overtime for every week in the quarter.

Certain payments are excludable, and the exclusions are specific rather than general.

Two frequent failures: paying overtime at one and a half times the base rate while paying non-discretionary bonuses separately, and treating a bonus as discretionary because it is called discretionary when the criteria and expectation make it otherwise.

This computation is where a payroll self-audit most reliably finds real money, and it usually finds it in a client that believes its payroll is clean. Coverage sits in the DOL rules on overtime session.

4. Independent contractor classification

A dual exposure: wage and hour on one side, employment tax on the other, with different tests applied by different authorities to the same facts — which means a client can be right for one purpose and wrong for the other.

Our post on worker classification covers the tests. The self-audit points: examine the actual relationship rather than the agreement, look for contractors who work only for this client and have done so for years, look for contractors doing the same work as employees, and check whether any state applies a stricter test than the federal one.

5. Records

Unglamorous and decisive. Where the employer's records are inadequate, an employee's reasonable estimate of hours worked may carry the day — so a recordkeeping failure converts a factual dispute into one the employer is positioned to lose.

Check: hours recorded for all non-exempt employees, retention for the required period, pay statement content where a state prescribes it, and the ability to reproduce records for a period years back.

Do Not Forget the State Layer

Frequently stricter than federal law, and it is where multi-state clients get caught:

Daily overtime in some states, on top of weekly.

Meal and rest break premiums, with their own penalty structures.

Pay statement content and frequency requirements, some with per-violation penalties that scale alarmingly across a workforce.

Final pay timing on termination, with penalties for delay.

Higher minimum wages, including local ordinances that exceed the state's.

Paid sick leave and accrual rules — see the state sick pay law review session.

Stricter classification tests, both for exemption and for contractor status.

A client with employees in several states has several compliance regimes, not one — the same multiplication our post on multi-state payroll describes for withholding.

The Employment Tax Side, Briefly

Since the same review should cover it: deposit timeliness and the schedule the client is actually on; the reconciliation of quarterly returns to the annual W-2 totals, per our post on payroll reconciliation; taxable fringe benefits and the accountable plan question; state unemployment reporting, per the Form 940 and federal-state unemployment overview; and the penalty-avoidance points in how to minimize and eliminate payroll penalties.

The Part CPAs Get Wrong: How to Run the Self-Audit

Here is the tension nobody warns clients about.

A self-audit creates a written record. If it finds a violation and the client does not correct it, the firm has helped create evidence of a knowing violation — which is exactly the finding that extends the lookback period and supports willfulness.

So the structure matters:

Engage employment counsel, and have counsel direct the review where a material problem is plausible. This is the same privilege reasoning as our post on fraud investigations: work performed at counsel's direction may be protected, while the same work performed for management may be fully discoverable.

Scope it with counsel before testing, so the review does not wander into an area the client is not prepared to remediate.

Agree in advance what happens if something is found. A client who will not correct a violation should not commission a document proving one exists.

And the point most CPAs do not know:

A private settlement of an FLSA claim may not be effective. Releases of FLSA rights generally require DOL supervision or court approval to be enforceable, which means an employer that quietly pays back wages in exchange for a signed release may have paid the money and not extinguished the claim.

So the remediation route is a legal decision: correct going forward, pay back wages through a supervised process, or use a DOL self-audit program where one is available and applicable. That is counsel's call, made with the numbers you produced — not the CPA's call, and not a matter to improvise.

A Working Sequence

1. Scope with counsel, and decide the privilege structure.
2. Inventory the workforce — every position, exempt status, pay basis, and state.
3. Test exemptions by duties, interviewing incumbents and supervisors rather than reading job descriptions.
4. Check the salary basis for improper deductions.
5. Examine time capture for the unrecorded-work patterns above, including remote work and automatic meal deductions.
6. Recompute the regular rate for any period with bonuses, differentials, or commissions.
7. Review contractor relationships against both tests, federal and state.
8. Test records for completeness, retention, and reproducibility.
9. Layer the state requirements for every state with employees.
10. Quantify by issue, position, and period.
11. Take remediation to counsel, with the release problem understood.
12. Fix the process, not just the arrears — and re-test annually.

Structured coverage runs through how to do a payroll audit, the payroll boot camp, and the Certified Payroll Manager program.

Where Clients Get Assessed

• Classifying by title or salary rather than by the duties test
• Job descriptions accepted as evidence of what people actually do
• An administrative exemption assumed without analyzing discretion as to matters of significance
• The salary basis broken by improper deductions, destroying a defensible exemption
• Remote after-hours work treated as unauthorized rather than as hours worked
• Pre-shift and post-shift activity unrecorded
• Automatic meal deductions applied whether or not the break was taken
• Rounding that systematically favors the employer
• Overtime computed on the base rate with non-discretionary bonuses paid separately
• A bonus called discretionary when its criteria make it otherwise
• No retroactive overtime recomputation after a quarterly or annual bonus
• Contractors who work only for this client, for years, doing employee work
• Inadequate time records, letting an employee's estimate control
• State daily overtime, break premiums, and pay statement rules ignored
• A self-audit run without counsel, creating a record of a knowing violation
• A private release signed in exchange for back wages, which may not extinguish the claim
• Arrears paid and the process unchanged, so the exposure restarts

The summary for a CPA with an employer client: the DOL exposure is back wages potentially doubled across a whole job classification for several years, and the three places it lives are the exempt duties test, time worked and not recorded, and the regular rate computation. Run the review through counsel, quantify before deciding anything, and know that a private settlement may not release the claim — so remediation is a legal decision made on your numbers.

Frequently Asked Questions

Does the Department of Labor assess payroll tax penalties?

No. The DOL enforces wage and hour law — minimum wage, overtime, and recordkeeping — while employment tax withholding, deposits, returns, and their penalties are an IRS matter. Both belong in a payroll self-audit, but they are different exposures with different rules and remedies.

Why is wage and hour exposure larger than clients expect?

Because liquidated damages can double the back wages owed, the lookback runs for years and is longer where the violation is willful, violations are usually class-wide since a misclassification attaches to a job title rather than a person, and owners and managers can face individual liability. Attorneys' fees follow in private litigation.

What is the biggest source of wage and hour liability?

Employees classified as exempt who do not meet the duties test. The salary requirements are necessary but not sufficient — the work actually performed has to satisfy the exemption. A client can also hold a defensible classification and lose it through payroll practice, since improper deductions can break the salary basis.

What is the most common technical error?

The regular rate computation. Overtime is computed on the regular rate rather than the base hourly rate, and that rate generally includes non-discretionary bonuses, shift differentials, and commissions allocated back over the period earned — so a quarterly bonus can require retroactive recomputation of overtime for every week in the quarter.

What is the risk of running a payroll self-audit?

That it creates a written record. If the review finds a violation the client does not correct, the firm has helped document a knowing violation — the finding that extends the lookback and supports willfulness. Scope it with employment counsel, have counsel direct it where a material problem is plausible, and agree in advance what happens if something is found.

Can an employer settle back wages privately?

Often not effectively. Releases of FLSA rights generally require DOL supervision or court approval to be enforceable, so an employer that pays back wages in exchange for a signed release may have paid the money without extinguishing the claim. The remediation route is a legal decision made on the numbers the CPA produces.