HMRC carries out around 30,000 employer compliance reviews each year, and the average settlement runs to roughly £10,000 [1]. Late Real Time Information filing alone can cost between £100 and £400 for each month a return misses its deadline, scaled by the size of the payroll [2]. For an employer, a payroll audit is less a dramatic raid than a methodical examination of whether PAYE, National Insurance and benefit reporting have been operated correctly.
An HMRC payroll audit, more precisely an employer compliance review, is the process by which HMRC checks that an employer has deducted the right tax and National Insurance, reported it on time through RTI, treated benefits correctly, and paid workers at least the statutory minimum. It draws on statutory information powers, focuses on well-defined risk areas, and ends in an assessment, a penalty, or a clean bill of health.
This article explains what a payroll audit involves, what tends to trigger one, the records HMRC inspects, the focus areas that recur in almost every review, the record-keeping duties that underpin the whole system, and the penalties that follow when the figures do not reconcile.
Key takeaways
- An employer compliance review checks PAYE, National Insurance, benefits and minimum wage, and HMRC runs roughly 30,000 of them a year [1].
- Late RTI filing penalties range from £100 to £400 per month, banded by payroll size [3].
- Employers must keep PAYE records for at least three years after the end of the tax year [4].
- HMRC obtains records through statutory information notices under Schedule 36 of the Finance Act 2008 [5].
- National Minimum Wage breaches carry penalties of up to 200% of arrears and public naming above £500 owed [6].
What an HMRC payroll audit is
An HMRC payroll audit is an employer compliance review, a structured check that the employer has met its obligations as a deductor of tax and National Insurance. The reviewing officer inspects payroll records, expenses and benefit records, and the systems that produce them, looking for areas where the wrong amount of tax or National Insurance may have been paid [1]. The scope covers PAYE deductions, National Insurance categories, benefits in kind, expense payments, employment status and minimum wage compliance in a single exercise [7].
The review is part of HMRC's wider compliance-check framework, the same statutory regime that governs checks on Income Tax, VAT and Corporation Tax [8]. What distinguishes an employer compliance review is its focus on the payroll function specifically, and its reliance on records the employer is legally required to keep for at least three years [4].
Compliance check versus full investigation
Most payroll audits are compliance checks rather than fraud investigations. A compliance check is HMRC verifying that returns are accurate and that the right tax has been paid, and it can be opened on any employer, whether selected at random or flagged by a risk indicator [8]. The tone is administrative: HMRC asks for records, examines them, and raises queries where figures do not reconcile [9].
A full investigation is a different matter, reserved for cases where HMRC suspects deliberate understatement rather than error. These are far rarer and follow a distinct procedure, often under the Code of Practice 9 civil fraud process [9]. For the ordinary employer, the realistic prospect is a compliance check, and preparation for it rests on keeping accurate records and filing on time [8].
What triggers a review
Some payroll audits are random, but many are prompted by a specific risk indicator in HMRC's data. The most common triggers are late RTI submissions, late payment of PAYE, and repeated corrections to earlier returns, all of which flag an employer whose payroll is not running cleanly [10]. HMRC's systems match the Full Payment Submission data against the payments actually received, and a persistent mismatch is enough to open a check [10].
Beyond internal data, HMRC acts on third-party information. Inconsistencies between an employer's returns and data from banks, other employers or overseas tax authorities can trigger a review, as can intelligence from former employees or business partners [9]. The prolonged use of emergency tax codes and discrepancies between payslips and RTI submissions are recurring flags, because both suggest the payroll is not being maintained accurately [10].
How the review unfolds
A payroll audit follows a recognisable sequence. HMRC gives notice, meets the people who run the payroll, inspects the records, raises queries, and issues its findings. Understanding the shape of the process removes much of the anxiety, because each stage is procedural rather than adversarial [1].
The notification and opening meeting
HMRC opens a review by contacting the employer, usually by letter or telephone, to give formal notice that a check is beginning [1]. Before inspecting any records, the officer typically arranges a meeting with the business owner, a director, or whoever is responsible for payroll and benefit reporting. The purpose is to understand the systems in place and to identify where the risk of non-compliance is highest [1].
That opening meeting shapes the rest of the review. HMRC often wants to speak to the people who handle payroll, expenses, benefits and, where relevant, human resources, to map the processes and procedures the business relies on [11]. The areas that look weakest in that conversation become the focus when the officer starts examining the underlying records [1].
The records HMRC inspects
Once the meeting is done, the officer inspects the payroll and related records, and for a larger employer this can take several days [11]. The records in scope include payslips, RTI submissions, tax code notices, starter and leaver documentation, expense claims and benefit records, all cross-checked against each other for consistency [7]. HMRC concentrates on the points where payroll commonly goes wrong: the correct use of tax codes, the treatment of new starters and leavers, expense payments, and the disclosure of benefits on the P11D [10].
The reconciliation between systems is central. HMRC expects payslips, tax codes and RTI submissions to align, and a gap between what the payroll produced and what was reported through Real Time Information is exactly the kind of discrepancy a review is designed to surface [10]. Employers running HMRC-recognised payroll software that submits the FPS automatically at each payrun start from a stronger position, because the payroll record and the RTI record are generated from the same data.
HMRC's information powers
HMRC does not rely on goodwill to obtain records. Its power to require documents and information comes from Schedule 36 of the Finance Act 2008, which allows the issue of a formal information notice where the material is reasonably required to check a taxpayer's position [5]. These powers apply across Income Tax, National Insurance, PAYE, CIS and VAT, so an employer, a contractor and a company can all be served [12].
An information notice turns a request into a legal obligation, and failure to comply carries its own penalties [12]. There are limits, however. A recipient can appeal against a notice or against specific requirements within it, on grounds such as the information not being reasonably required, the request being too wide, or the documents being outside the recipient's possession or power [9]. Knowing where the powers start and stop is part of managing a review calmly rather than conceding every request automatically [12].
The areas HMRC focuses on
Payroll audits are not random trawls through every figure. They concentrate on a small number of areas where errors are common and the tax at stake is meaningful. Three recur in almost every employer compliance review.
RTI, tax codes and starters and leavers
Real Time Information is the backbone of PAYE, and it is the first thing a review tests. The defining rule is that the Full Payment Submission must reach HMRC on or before the date the employee is paid, and late submissions expose the employer to penalties under the RTI regime [2]. HMRC checks that the FPS was filed on time, that it matches the payslips, and that the amounts reported reconcile with the PAYE actually paid over [10].
Tax codes and the handling of new starters and leavers are the second recurring theme. The prolonged use of emergency tax codes, missing starter checklists and late P45 processing all signal a payroll that is not being maintained accurately, and each can produce an under-deduction that HMRC will seek to recover [10]. Getting year-end documents right sits alongside this, and the discipline that keeps the P60 end-of-year forms accurate is the same discipline that survives an audit [7].
Benefits in kind and expenses
Benefits and expenses are a perennial audit focus because the rules are detailed and the errors are frequent. HMRC checks that taxable benefits have been reported on the P11D or payrolled correctly, and that Class 1A National Insurance has been paid on them [13]. A company car omitted, a medical policy undervalued, or an expense treated as exempt when it is not, all produce an underpayment the review will pick up [7].
The interaction between benefits and National Insurance is where the money adds up. Because Class 1A is an employer-only charge, a benefit that has been under-reported creates an employer liability rather than an employee one, and interest and penalties attach to the shortfall [13]. Employers who want to understand how these figures fit into the wider cost of employment can start with the guide to employer National Insurance, and those seeking the reporting mechanics can read the guide to P11D reporting.
Employment status and IR35
The third focus is employment status. HMRC examines whether people treated as self-employed contractors are, in substance, employees who should be inside PAYE, and whether the off-payroll working rules have been applied correctly [7]. A misclassification shifts a large tax and National Insurance liability, which is why status reviews are a standard part of the employer compliance check [11].
For businesses that engage contractors through intermediaries, the off-payroll rules place the status determination on the engager, and HMRC expects that determination to be evidenced and defensible [9]. Platforms and larger employers that embed payroll through an HMRC-recognised payroll API keep the tax treatment consistent across every worker the system processes, which reduces the risk of an inconsistent status decision surfacing in a review [8].
Record-keeping obligations
The whole audit process rests on records the employer is legally required to hold. Under the PAYE regulations, an employer must keep and preserve PAYE records for at least three years after the end of the tax year to which they relate [4]. The records cover pay, tax and National Insurance deductions, benefits and expenses, and the documentation supporting statutory payments, and they may be held in paper or digital form [14].
Inadequate records are penalised in their own right, separately from any tax underpayment they conceal. HMRC can charge penalties of up to £3,000 for failing to keep adequate records, so the record-keeping duty is not a formality that only matters when a review starts [14]. Many employers keep records for six years rather than the statutory three, to cover the wider window in which tax assessments and employment disputes can arise [14]. The table below summarises the core retention rule.
| Record type | Minimum retention | Basis |
|---|---|---|
| PAYE and NI deductions | 3 years after the tax year end | PAYE regulations [[4]](https://www.gov.uk/running-payroll) |
| Benefits and expenses | 3 years after the tax year end | Expenses and benefits guidance [[13]](https://www.gov.uk/employer-reporting-expenses-benefits) |
| Practical retention many employers adopt | 6 years | Wider tax and dispute window [[14]](https://www.litrg.org.uk/employers/keeping-records-employer) |
Penalties and settlements
A payroll audit that finds errors ends in a settlement: the underpaid tax and National Insurance, plus interest, plus a penalty scaled to the behaviour behind the error. Two penalty regimes recur, one for late RTI filing and one for minimum wage breaches, and both are formula-driven.
RTI late filing penalties
Late RTI submissions carry monthly penalties banded by the size of the PAYE scheme. The bands run from £100 for the smallest employers to £400 for the largest, as set out below [3]. An employer incurs at most one penalty per tax month per scheme, and the first default in a tax year is not penalised, which gives a limited margin for a single slip [3].
| PAYE scheme size | Monthly penalty |
|---|---|
| 1 to 9 employees | £100 [[3]](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch401255) |
| 10 to 49 employees | £200 [[3]](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch401255) |
| 50 to 249 employees | £300 [[3]](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch401255) |
| 250 or more employees | £400 [[3]](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch401255) |
Late payment of the PAYE itself is penalised separately from late filing, and interest runs on any amount paid after its due date [2]. Because the two charges are independent, an employer that both files and pays late can face penalties on each [2].
National Minimum Wage penalties and naming
Minimum wage compliance is enforced by HMRC with some of the sharpest penalties in the payroll system. An employer that has underpaid must repay the arrears to the worker and pay a penalty of up to 200% of those arrears, with a minimum penalty of 100% [6]. The penalty is reduced where the employer settles quickly, but the underlying arrears are always repayable to the worker [15].
Public naming adds a reputational cost. Employers that owe arrears above £500 are named publicly once enforcement concludes, and recent rounds have named hundreds of employers at a time across millions of pounds of underpayment [6]. There is no penalty or naming where an employer repays arrears before HMRC opens a compliance check, which is a strong incentive to self-correct rather than wait to be found [15].
How to prepare for and reduce audit risk
The best defence against a payroll audit is a payroll that would pass one on any given day. That means filing every FPS on or before payday, paying PAYE by its due date, keeping benefit records current, and reconciling payslips to RTI submissions each period [2]. Where errors are found internally, correcting them and disclosing before HMRC opens a check reduces or removes the penalty, because unprompted disclosures attract the lowest penalty loading [8].
Systems matter as much as diligence. A payroll that generates its RTI submission from the same data that produces the payslip removes the most common discrepancy a review looks for, and one that tracks benefit values through the year removes the P11D errors that follow [13]. Accountants managing this across many client schemes typically work from a payroll bureau platform that flags late filings and reconciliation gaps per scheme, so a single client's slip does not go unnoticed until an audit surfaces it. For a small business, the guide to small business payroll sets out how these routines fit into the ordinary payrun.
Conclusion
An HMRC payroll audit is a test of process, not a stroke of bad luck. The reviews that end badly are almost always the ones where the payroll was already running loose: late FPS filings, emergency codes left in place, benefits under-reported, workers misclassified. The reviews that end quietly are the ones where the records reconcile and the returns were filed on time, because there is nothing for the officer to unpick.
The direction of enforcement is towards more data-matching, not less, as HMRC cross-references RTI, benefit and third-party information in real time. That makes the accuracy of each submission the point of control. An employer that treats every payrun as if it will one day be inspected, and keeps the records to prove it, turns the prospect of an audit from a threat into a routine confirmation that the numbers were right all along.
Frequently asked questions
What triggers an HMRC payroll audit?
Some reviews are random, but most are prompted by a risk indicator in HMRC's data. Late RTI submissions, late PAYE payments, repeated corrections and prolonged use of emergency tax codes are the common flags, because each suggests the payroll is not running cleanly [10]. HMRC also acts on third-party information, including mismatches with data from banks or other employers and intelligence from former staff [9].
How long must an employer keep PAYE records?
An employer must keep and preserve PAYE records for at least three years after the end of the tax year to which they relate, and the records can be held in paper or digital form [4]. The records cover pay, tax and National Insurance deductions, benefits and expenses. Many employers keep records for six years to cover the wider window in which assessments and employment disputes can arise, and inadequate records can themselves attract a penalty of up to £3,000 [14].
Can HMRC force an employer to hand over payroll records?
Yes. HMRC's power to require documents comes from Schedule 36 of the Finance Act 2008, which allows it to issue a formal information notice where the material is reasonably required to check the employer's position [5]. Failure to comply carries penalties, but the recipient can appeal against a notice or specific requirements within it, for example where the request is too wide or the documents are not in the recipient's possession [12].
What are the penalties for failing a payroll audit?
The penalties depend on what the review finds. Late RTI filing carries monthly penalties of £100 to £400 banded by scheme size, and late PAYE payment is charged separately with interest [3]. National Minimum Wage underpayment carries a penalty of up to 200% of the arrears plus public naming above £500 owed, and underpaid tax on benefits attracts interest and a penalty scaled to the behaviour behind the error [6].
