HR-Glossar
Internes Kontrollsystem (internal control system)
What an internal control system does in payroll, which controls matter in Germany and how their effectiveness is evidenced to auditors.
1. What is Internes Kontrollsystem (internal control system)?
An internal control system is the totality of rules, procedures and checks with which a company ensures that transactions are recorded correctly, completely and on time – and that assets are protected against loss and misuse.
It is not a document but a property of procedures. It consists of three kinds of control:
- Preventive — authorisation concepts, segregation of duties, the four-eyes principle, approval limits. - Detective — reconciliations, plausibility checks, variance analyses, sampling. - Corrective — defined routes for fixing errors, following up and learning.
In HR work, payroll is the core area. Money flows there, reports to public bodies arise there and data enjoying particular protection are processed there. Accordingly, auditors, pension insurance auditors under Section 28p SGB IV and payroll tax auditors regularly examine whether effective controls exist.
A control is effective only where it is evidenced – the principles of proper bookkeeping require traceable records under Section 238 HGB and Section 146 AO. A check that takes place but is not documented does not exist as far as an auditor is concerned.
2. Origin and development
Internal control systems come from accounting and auditing. Their present form is strongly shaped by international frameworks that arose after major accounting scandals.
In German HR work the control system became relevant by two routes: through the commercial law duty to have control over processes relevant to financial reporting – and payroll is one – and through the audit practice of the social security and tax authorities, which ask for traceable controls.
That second route is the one international groups tend to miss. A group framework built for financial reporting covers the first but not necessarily the second, because the control points the German auditors look for are German procedures: the reconciliation of the payroll journal against the contribution statement, the completeness of the social security reports, the evidence behind payments treated as tax-free.
3. Core principles and how it works
Segregation of duties
Recording, checking, approving and paying belong to different roles. Where that cannot be staffed, compensating controls are needed.
The four-eyes principle at the risk points
Not everywhere, but where errors are expensive: new records, changes to pay, one-off payments, bank details, leavers.
Authorisations on a need basis
Access only so far as the task requires. Authorisations accumulate over years unless they are reviewed regularly.
Reconciliation as a standard step
Payroll journal against contribution statement, against payroll tax return, against the accounts. Figures that drift apart are the classic audit finding.
Documentation makes controls auditable
Who checked and approved what, and when, belongs recorded. Without evidence the control cannot be demonstrated.
4. Who is Internes Kontrollsystem (internal control system) relevant for?
- Management – it is answerable for establishing the system. - Payroll and HR – that is where the controls operate day to day. - Auditors and inspectors – they ask about it. - Payroll service providers – a control system is part of the service and often its real added value. - Small entities – for them segregation of duties is the real difficulty.
5. How it differs from related terms
- Control system and compliance – compliance aims at adherence to rules as a whole; the control system is the control architecture through which that happens. - Control system and internal audit – internal audit examines the control system; it is not part of it. - Control system and quality management – quality management aims at the quality of output, the control system at propriety and the protection of assets. - Control system and risk management – risk management identifies and assesses risks; the control system holds the controls that limit them.
6. Variants and adaptations
- Process-integrated controls – anchored in the workflow, for instance a system block until a second approval. - Process-independent controls – downstream, for instance sampling or internal audit. - Manual and automated controls – automated ones are more reliable, manual ones more flexible; both are needed. - Compensating controls – where segregation of duties cannot be staffed, for instance through external second review or close follow-up inspection.
7. Advantages and challenges
Advantages
- Errors are found before they take effect
- Demonstrability at employer audits and payroll tax audits
- Protection against misuse, and against the suspicion of misuse
- Knowledge is tied to procedures rather than to individuals
- Clear responsibilities take pressure off the people involved
Challenges
- Controls cost time, particularly under deadline pressure
- In small teams genuine segregation of duties is barely achievable
- An overdone system produces circumvention rather than security
- Documentation is experienced as bureaucracy where its purpose is not explained
- Controls age with the processes unless they are maintained
8. Best practices for implementation
Name the risk points rather than controlling everything
Where can money flow out, where do reporting errors arise, where are master data changed? That is where the controls belong – not spread evenly everywhere.
Secure changes to bank details separately
Changing account details is the classic point of attack. It belongs secured with a call-back or a second approval.
Review authorisations annually
Roles change, access stays. A recurring review is one of the most effective single measures.
Document controls, do not merely perform them
A tick with a date and initials is enough. Without it the control does not exist for an auditor.
Compensate in small teams
Where segregation of duties is impossible, a second pair of eyes from outside or above is needed – which is an argument for outsourced payroll. For a small German subsidiary of a larger group this is the usual case, not the exception.
9. Tips for employers and employees
For employers
- **Put controls where it hurts** – master data, bank details, one-off payments
- **Document, or it does not count** – auditors see evidence, not intentions
- **Clear out authorisations regularly** – otherwise they grow quietly
- **Be honest where the team is too small** – an external second review is more effective than a separation that exists only on paper
For employees
- **Controls are not directed at you** – they also protect against wrongful suspicion
- **Report anomalies** – whoever stands in the process sees deviations first
- **Take the four-eyes principle seriously** – an approval without a check shares the responsibility
10. Conclusion
An internal control system is not bureaucracy but the answer to a simple question: how would anyone notice that something is going wrong? In payroll the answers are manageable – segregation of duties, the four-eyes principle at the risk points, reconciliations, reviewed authorisations. Two things decide effectiveness: that the controls sit where errors are expensive, and that they are evidenced.
For an international group two points are worth separating out. First, three different auditors ask about controls here, and a group framework built for financial reporting does not automatically answer the two that are specific to Germany – the pension insurance employer audit and the payroll tax audit look at German procedures. Second, in a small German subsidiary segregation of duties is usually impossible to staff; a second pair of eyes from outside is more honest than a separation that exists only on the organisation chart.
A note on sources: the Commercial Code has an official English version, cited below. The Fiscal Code and SGB IV do not (checked on 2026-09-27); their German texts govern.
Sources
- Section 238 HGB – Duty to keep books (official English version of the Commercial Code) (opens in a new tab)
- Section 146 AO – Rules of order for bookkeeping (German original; no official English version) (opens in a new tab)
- Section 28p SGB IV – Employer audits (German original) (opens in a new tab)
- Financial reporting and auditing (opens in a new tab)
- Internal audit standards (opens in a new tab)
Related terms
Our promise
Software supports. People take responsibility.
Let us talk about your payroll – no strings attached, specific, and with a dedicated contact from day one.