The payroll invetigation that wasn’t

The assignment appeared straightforward.

BB Manufacturing was growing rapidly. The furniture exporter employed more than 300 people across production and office functions and was preparing for another phase of expansion. The review drew upon four months of biometric attendance records, payroll spreadsheets and employee master data. One relationship in the data refused to behave.

Production output almost doubled between December and January. February remained at a similarly high level. Overtime, however, showed remarkably little variation across all three months. December had produced approximately half the volume of finished furniture, yet the factory appeared to have worked almost the same amount of overtime.

Experienced manufacturing managers instinctively expect those two measures to move together. When they do not, either the reporting is wrong or the operation is behaving in an unexpected way. At that stage there was no reason to suspect a payroll issue. The question was simply whether the management information could be trusted.

The first stage of the investigation therefore concentrated on understanding the production data. Financial records were reconciled, production reports were reviewed and monthly trends were compared. Nothing explained the disconnect. Rather than continuing to analyse summary reports, attention shifted towards the original operational records from which those reports had been created.

The factory operated a biometric attendance system that recorded every employee entering and leaving the site. During the first quarter alone, the system had captured more than twenty-two thousand individual clocking records. A second file generated by the same software contained the processed attendance schedule used for payroll preparation. These two files should have described exactly the same workforce viewed from different perspectives. One represented physical attendance captured by biometric hardware. The other represented attendance after shift rules, overtime calculations and employee master data had been applied.

Comparing the two files produced the first unexpected result.

The processed attendance schedule contained twenty-two employee records that had no corresponding biometric clock records anywhere in the quarter. On its own, that observation proved very little. New employees are sometimes entered before biometric enrolment has been completed. Senior staff occasionally work under different attendance arrangements. Administrative explanations were entirely plausible, so the investigation continued without drawing conclusions.

The next comparison transformed the investigation.

Every one of those twenty-two employees displayed exactly the same attendance profile for the entire ninety-day period. No regular working hours had been credited. No production shift had been assigned. Every day carried the same attendance code together with eight hours of overtime. The pattern repeated day after day across all twenty-two records. Among employees who physically clocked in and out, no comparable attendance pattern existed.

Patterns matter in investigations because they distinguish isolated mistakes from systematic behaviour. Even so, experience teaches investigators to distrust attractive theories until they survive repeated testing. The possibility remained that an unusual system configuration or payroll rule could produce exactly this result.

The investigation therefore broadened rather than narrowed.

Employee identities were traced back into earlier payrolls. Eight of the twenty-two appeared in the December payroll, several receiving unusually low payments despite having been registered for weeks. One employee receiving a management-level salary paid in cash could not be located in either attendance system. Several additional payroll records appeared to have no operational footprint anywhere in the business. Each discovery strengthened the hypothesis that payroll contained significant irregularities, while simultaneously raising new questions that required independent verification.

Then the investigation took another unexpected turn.

One of the supposedly fictitious employees was very real. His company email showed continuous activity throughout the quarter. Another employee carrying the same attendance pattern had been confirmed as being on maternity leave. The working hypothesis changed immediately. Some records might represent employees who existed physically while their payroll records followed an entirely different path through the payment process. The distinction mattered because it suggested that the investigation might involve diverted payments as well as fictitious identities.

Understanding how attendance became salary now became more important than identifying individual names.

Management believed payroll was largely automated. In reality, the process relied upon a sequence of manual transfers between the attendance system, locally maintained employee records and an increasingly complex Excel workbook. Leave adjustments were entered manually. Employee master data existed outside the payroll calculation itself. Multiple versions of factory worksheets had evolved over time. Knowledge of the process rested largely with one experienced payroll administrator who had developed the system incrementally over several years. The structure reflected practical adaptation rather than formal systems design.

Every investigation eventually reaches a point where process understanding becomes more valuable than further data analysis. Payroll had reached that point.

The Excel workbook therefore became the next object of study. Expectations were modest. Large spreadsheets that evolve over many years usually contain copied formulas, hidden errors and undocumented assumptions. The review eventually tested more than twenty-four thousand formulas and independently recalculated every employee’s payroll from source data.

The mathematical structure proved more robust than expected. Eight of the nine internal consistency tests passed across every employee. Gross pay also reconciled arithmetically into taxable income, net salary and payment values.

That internal consistency did not mean the payroll was correct. A common personal income tax calculation error affected every employee because the same incorrect logic had been applied consistently throughout the workbook. Two additional formula errors were actively affecting employee pay, while several tax calculations still reflected historical legislation and would activate under particular conditions. Social insurance values had also become hard coded, making future salary revisions vulnerable to silent error. Three parallel copies of the factory payroll sheets had evolved into separate calculation environments, increasing the risk that amendments would be applied to one version while another remained unchanged.

By this stage the investigation had travelled a considerable distance from its original purpose.

The seven hundred million Vietnamese Dong represented the value at risk. Evidence available at that stage supported probable losses only in the high tens of millions.. This indicated a level of risk only, evidence at that point only supported  losses in the high tens of millions. Bank mandate files, HR records and social insurance submissions remained essential before individual conclusions could be established to a legal standard, yet management already possessed sufficient information to make an operational decision.

That decision reflected practical business judgement rather than legal theory.

Many investigations naturally progress towards disciplinary action or criminal prosecution. Senior management viewed the problem through a different lens. The priority was protecting the business rather than reconstructing every historical transaction. Obtaining court-quality evidence would require months of forensic work, legal involvement, witness interviews and disruption to a rapidly expanding manufacturing operation. Recovering losses remained uncertain. Eliminating the opportunity for recurrence offered a clearer return.

Payroll responsibilities were therefore redesigned around separation of duties. Independent approval stages were introduced between attendance processing, payroll preparation and bank payment. Historical knowledge was documented before key personnel changes took place. The payroll workbook entered a redesign programme, automation opportunities were identified and new reconciliation procedures became part of the monthly payroll cycle. As each control weakness was removed, the opportunity for similar schemes diminished. monthly AI-assisted post-processing review for payroll anomalies was also introduced as part of the routine.The investigation closed without answering the original question.

Several months later a separate operational review finally resolved the overtime anomaly. The production manager had gradually incorporated overtime into his relationship management approach. Within the social dynamics of a Vietnamese factory, overtime represented far more than additional labour cost. It became a valuable resource through which cooperation, loyalty and flexibility could be encouraged across production teams. The pattern reflected management culture as much as production planning, explaining why overtime remained relatively stable despite substantial changes in factory output.

Looking back, the assignment produced an outcome that no one had anticipated.

The original question opened the first door. Each answer revealed another question; each hypothesis demanded fresh evidence and every stage required earlier assumptions to be reconsidered in the light of new information. Artificial Intelligence accelerated the analysis of thousands of payroll and attendance records, yet the investigation itself remained an exercise in judgement, persistence and disciplined enquiry. The lasting value lay less in identifying probable fraud than in redesigning the system so that similar opportunities could no longer arise.

For management, that proved to be the more valuable outcome.