Timesheet and payroll anomaly checks
Also called payroll exception reporting, ghost employee detection, time and attendance alerts, payroll audit analytics
How automated checks catch timesheet padding, ghost employees and payroll errors, what the fraud data shows, what they cost, and the biometric traps.
Payroll fraud is slow and costly. In the ACFE's 2022 study, payroll schemes ran for a median 18 months with a median loss of US$45,000, and organisations under 100 staff had the highest median fraud loss of any size, at US$150,000. Organisations using proactive data monitoring had 47% lower median losses and 56% shorter schemes, yet only 21% of small organisations used it. Most of the value comes from simple rules, not clever AI. We found no independent study of AI anomaly scoring on small-firm payroll.
At a glance
| Status | In pilots |
|---|---|
| What it does | Compares timesheets, rosters and payroll runs against rules and past patterns, and flags exceptions: missed clock-outs, overtime spikes, duplicate bank accounts, unexplained pay changes and people paid with no hours recorded. |
| Typical cost | Time-and-attendance tools from US$5 per user per month; another vendor offers a free plan for up to 10 users without payroll integration (vendor list prices, checked Oct 2026). Payroll-audit analytics are mostly quote-based. |
| Data it needs | Clock-in records or timesheets, rosters, the payroll employee master file with bank details, and several months of past pay runs. |
| Setup effort | Low for built-in time-clock alerts; Medium for cross-checks between payroll, bank and HR records held in different systems. |
| Evidence | Moderate. A large independent fraud survey and government data-matching results support monitoring in general; no independent study of AI scoring in small firms. |
What are timesheet and payroll anomaly checks?
They are automated checks for hours and pay that do not add up. At the simple end, a time-and-attendance app flags a missed clock-out, a shift far longer than rostered or overtime above a limit. At the payroll end, software compares each pay run with the last: new employees, changed bank details, two staff sharing one account, or someone paid with no hours recorded.
Some products add machine-learning scores that rank how unusual each line is. Others are plain rules, which catch most of what matters in a small business.
The targets are fraud (ghost employees, padded hours, friends clocking in for each other) and honest error, including underpaid overtime, which carries its own cost. In its 2025 fiscal year the US Wage and Hour Division recovered more than US$259 million in back wages for 176,957 workers.
How does it work?
The checks sit where records meet. Clock or timesheet data is compared with the roster and with legal limits. Payroll data is compared with the previous run and with the employee master file. Bank details are compared across employees.
Typical rules include:
- Overtime beyond the legal limit or rate: 10 hours a week in South Africa, a 48-hour weekly average in the UK unless the worker opts out, and time-and-a-half after 40 hours in the US.
- Hours paid but not clocked, or clocked but not approved.
- Duplicate bank accounts, ID numbers or addresses in the employee file.
- New starters or pay changes without a matching approval.
Each flag goes to a person to explain or correct before pay is released. The UK's National Fraud Initiative runs a large version, matching payroll records across public bodies and treating each match as a lead, not proof of fraud.
What it needs to work
Anomaly checks compare records, so they need hours, rosters and pay that can be joined on the same employee, plus enough history to know what normal looks like.
- Clock-in or timesheet records for every hourly employee, synced each pay period, with the approver recorded against each entry.
- Rosters or planned shifts for the same period, so actual hours can be compared with planned hours.
- The payroll employee master file: ID or national insurance number, bank account, pay rate, start and end dates, and an audit log of every change.
- Several months of past pay runs, so the software or reviewer can see each person's normal pattern and spot departures.
- A written list of the rules that apply: overtime caps and rates, maximum hours, and any bargaining council or sectoral determination.
- A named person who must review and sign off flagged items before the pay run is released, and who is not the person approving the timesheets.
Most use cases in this guide succeed or fail here, on the data underneath them, before any AI is involved.
What does the evidence show?
The best independent evidence is about fraud monitoring in general, not AI. The ACFE's 2022 study of 2,110 occupational fraud cases found payroll schemes in 9% of them, lasting a median 18 months against 12 months for fraud overall. Organisations with proactive data monitoring had a median loss of US$80,000 against US$150,000 without it, and schemes ran 8 months rather than 18. That is a pattern reported by fraud examiners, not a controlled trial.
Detection still leans on people: tips uncovered 42% of cases, and automated transaction monitoring only 4%.
Government data matching shows what joined-up records can do. The UK's National Fraud Initiative reported £510.1 million in outcomes for 2022 to 2024, though payroll matches in England led to only 38 dismissals or resignations. We found no independent study of AI anomaly scoring on small-firm payroll.
Automated payroll checks vs manual payroll review
| Compared on | Automated anomaly checks | Manual review |
|---|---|---|
| Coverage | Every line, every pay run | Spot checks, usually of totals |
| What it catches | Duplicates, missing clock-ins, limit breaches, pattern changes | Obvious outliers the reviewer notices |
| Weakness | Alert fatigue; misses collusion | Slow; easy to skip in a busy month |
| Cost model | Per-user subscription, often bundled with time and attendance | Owner or bookkeeper time |
| Best for | Hourly, shift-based or multi-site workforces | Small salaried teams with few changes |
Status and evidence
Rated pilots because a large independent fraud survey links proactive data monitoring to lower losses and faster detection, and government data matching produces results at scale, yet only 21% of small organisations used such monitoring. Evidence is moderate for monitoring in general; we found none for AI anomaly scoring specifically.
Where does it go wrong?
- Too many flags. If every late clock-out raises an alert, the manager approves them in bulk and the one that matters slips through.
- Collusion passes the rules. A supervisor who approves a friend's padded hours satisfies any check that only asks whether hours were approved.
- The data is never joined. Rosters sit in a spreadsheet, hours in an app and pay in the payroll system, so nothing compares them.
- Biometric clocks create legal risk. The UK regulator ordered a leisure operator to stop using facial recognition and fingerprints to monitor attendance of more than 2,000 staff at 38 sites, and expects a non-biometric option to be offered. In South Africa biometric data is special personal information.
- The software docks pay on its own. Solely automated decisions about pay trigger extra legal duties in the UK and South Africa.
Numbers it should move
Ask the demo business
Northgate Supply is a fictional wholesale distributor of catering and packaging supplies: 28 staff, R46.6m in sales over the last year. Its data is generated for this demo, to 30 September 2026.
Payroll took 12.6% of sales over the year. December's payroll was nearly double a normal month because of 13th cheques, but record sales held that month's ratio to 14.9%, about the same as February 2026, the quietest month for sales, at 14.7%. March's increases lifted monthly payroll by about 5.5%.
How this was worked out
Monthly payroll cost, including 13th cheques, divided by monthly sales.
Where the data usually lives
Where the records this use case needs are usually kept in a small business. It is not a list of recommended tools.
Frequently asked questions
How much does timesheet anomaly software cost?
One time-and-attendance vendor lists plans from US$5 per user per month. Another offers a free plan for up to 10 users without payroll integration, with paid plans from US$29 a month for the first 30 users on annual billing. Both were checked in October 2026. Dedicated payroll-audit analytics are usually quote-based, and many payroll systems already include basic variance reports.
Do I need an IT person to set up payroll checks?
Usually not. Overtime alerts and missed clock-out flags are settings in most time-clock apps. Cross-checking payroll against bank details or rosters may mean exporting to a spreadsheet each pay run, which a bookkeeper can do. You only need technical help to automate the link between systems that do not share data.
How common is payroll fraud in small businesses?
In the ACFE's 2022 study, payroll schemes appeared in 8% of fraud cases at organisations with fewer than 100 staff. Small organisations had the highest median loss of any size, US$150,000 per case, and had notably lower use of anti-fraud controls such as proactive data monitoring. Tips, often from staff, were the most common way fraud was found.
Can I use fingerprint or face scanners for clocking in under POPIA and UK GDPR?
Only with care. POPIA treats biometric information as special personal information, which may be processed only under specific exceptions such as consent. The ICO says biometric time and attendance is high risk, requires a data protection impact assessment before you start and should come with a non-biometric alternative; it has ordered a leisure operator to stop. Check guidance from the Information Regulator and the ICO. This is not legal advice.
Can software automatically deduct pay when it finds a timesheet problem?
It should not act alone. In the UK, solely automated decisions with significant effects, such as changing pay, are restricted, and workers must be able to get human review. POPIA similarly restricts decisions based solely on automated profiling of work performance. South African law also forbids false entries in time and pay records. Use flags to prompt a conversation, not a deduction.
More in people & payroll
Sources
- 1Occupational Fraud 2022: A Report to the NationsAssociation of Certified Fraud Examiners, 2022Survey
- 2National Fraud Initiative Report 2022 - 2024 (HTML)Cabinet Office, GOV.UK, 2025Government
- 3Forging the Future: A Year of Progress Focused on the American WorkforceUS Department of Labor, Wage and Hour Division, 2025Government
- 4Wages and the Fair Labor Standards ActUS Department of Labor, Wage and Hour Division, 2026Government
- 5Basic Conditions of Employment Act 75 of 1997South African Government, 1997Government
- 6Maximum weekly working hoursGOV.UK, 2026Government
- 7Can we use biometric data for time and access control and monitoring?Information Commissioner's Office (UK), 2024Government
- 8Serco Leisure Operating Limited and relevant associated TrustsInformation Commissioner's Office (UK), 2024Government
- 9What do we need to do if we use monitoring tools that use solely automated processes?Information Commissioner's Office (UK), 2026Government
- 10Protection of Personal Information Act 4 of 2013South African Government, 2013Government
- 11Deputy pricing plansDeputy, 2026Vendor
- 12PricingConnecteam, 2026Vendor
This entry is educational. It is not legal, financial or professional advice, and it does not recommend any vendor. Figures attributed to vendors are their own claims.
- 1Occupational Fraud 2022: A Report to the NationsAssociation of Certified Fraud Examiners, 2022Survey
- 2National Fraud Initiative Report 2022 - 2024 (HTML)Cabinet Office, GOV.UK, 2025Government
- 3Forging the Future: A Year of Progress Focused on the American WorkforceUS Department of Labor, Wage and Hour Division, 2025Government
- 4Wages and the Fair Labor Standards ActUS Department of Labor, Wage and Hour Division, 2026Government
- 5Basic Conditions of Employment Act 75 of 1997South African Government, 1997Government
- 6Maximum weekly working hoursGOV.UK, 2026Government
- 7Can we use biometric data for time and access control and monitoring?Information Commissioner's Office (UK), 2024Government
- 8Serco Leisure Operating Limited and relevant associated TrustsInformation Commissioner's Office (UK), 2024Government
- 9What do we need to do if we use monitoring tools that use solely automated processes?Information Commissioner's Office (UK), 2026Government
- 10Protection of Personal Information Act 4 of 2013South African Government, 2013Government
- 11Deputy pricing plansDeputy, 2026Vendor
- 12PricingConnecteam, 2026Vendor