HR-Glossar

Qualitätssicherung in der Entgeltabrechnung (payroll quality assurance)

Which control points secure a German payroll run, what the duties rest on and which classes of error actually surface in audits.

1. What is Qualitätssicherung in der Entgeltabrechnung (payroll quality assurance)?

Quality assurance in payroll is the totality of the controls by which a payroll run is checked before it is released – and the evidence that those controls took place.

It is not a voluntary extra. Several provisions presuppose it without using the term: Section 28f SGB IV requires records from which the contribution calculation can be traced; Section 41 EStG requires the same for wage tax withholding; Section 42d EStG makes the employer liable for errors. Not checking does not reduce those duties – it only makes them impossible to demonstrate.

What distinguishes it from quality assurance generally is how errors behave. An error in payroll is rarely an isolated case: it arises in a rule, a wage type or a piece of master data maintenance – and then works across every person affected and every subsequent month at once.

2. Origin and development

As long as pay was calculated by hand, control meant recalculation. An error concerned one person and one month. With system-based payroll that has reversed: the individual calculation is practically always right, because a machine performs it. What is wrong is not the result but the rule – a wage type with the wrong indicator, a badly maintained master record, a threshold that was never updated.

With that, the meaning of control has shifted too. Recalculation has become pointless; what helps is comparison: month against previous month, person against the population, totals against expectation. What stands out is not the wrong amount but the unexplained variance.

Audit practice has reinforced this. The payroll tax audit and the pension insurance employer audit now analyse data across every employee and every month. A systematic error is therefore found in full – no longer, as formerly, by sample.

3. Core principles and how it works

Control the run, not the individual payslip

What is checked is the payroll run as a whole: comparisons of totals, variances against the previous month, anomalies in the distributions. The individual payslip is examined only where the run shows something conspicuous.

Variance analysis rather than recalculation

Every variance against the previous month must have an identifiable cause – a joiner, a leaver, a one-off payment, a collective pay change. Anything that cannot be explained is to be resolved before the run is released.

The four-eyes principle at release and for master data

Whoever changes bank details, pay components or wage types should not release the run alone. This is at the same time the most effective control against manipulation.

Demonstrability is part of the control

A check that took place but is not documented does not help in an audit. The step, the person, the time and the result belong recorded.

Separating tax law from contribution law

A payment can be free of tax and subject to contributions. Controls that examine only one side miss precisely the cases that become expensive later.

Deadlines are part of quality

The contribution statement, the payroll tax return and the social security reports have fixed deadlines. A payroll that is correct in substance but late produces late payment surcharges – and in the extreme, the question of Section 266a StGB.

4. Who is Qualitätssicherung in der Entgeltabrechnung (payroll quality assurance) relevant for?

- Payroll teams – they carry out the controls and own them technically. - HR leadership and management – liability under Section 42d EStG and responsibility under Section 28f SGB IV sit with them, not in the specialist department. - Companies with outsourced payroll – the provider calculates, the duty stays with the employer. Whoever releases carries the responsibility. - Internal audit – payroll is one of the few processes with a monthly outflow of money to many recipients. - Works councils – incorrect payslips are a frequent cause of complaints and bear directly on trust.

5. How it differs from related terms

- Quality assurance and the internal control system – the control system is the overarching frame for the whole company; payroll quality assurance is its part for this process. - Quality assurance and the four-eyes principle – the four-eyes principle is a single control, not the whole concept. - Quality assurance and a test run – the test run is a tool. It does not replace variance analysis, because it only shows what the system calculates, not whether it calculates the right thing. - Quality assurance and third-party audits – the payroll tax audit and the employer audit are downstream controls with a different purpose. They do not replace your own control but assess it.

6. Variants and adaptations

Control points can be ordered by when they happen:

- Upstream controls – master data changes under the four-eyes principle, checking new wage types for their tax and contribution indicators, retrieving the ELStAM change list. - Controls within the run – variance analysis against the previous month, checking for zero payslips and extreme values, reconciling headcount against the staff list. - Controls before release – reconciling totals of gross pay, contributions and taxes against the accounts, checking the payment runs, release by a second person. - Downstream controls – reconciling the social security reports, checking the contribution statements and the payroll tax return, following up corrections. - Annual controls – updating changed thresholds and values, checking the annual payroll tax records, reconciling the annual totals.

7. Advantages and challenges

Advantages

  • Systematic errors are found in the month they arise, not years later in an audit
  • A documented control system helps on the question of intent or carelessness
  • Corrections within the current year are incomparably easier than retrospective reruns
  • Trust in payroll reduces queries and takes pressure off HR
  • With outsourced payroll, it is what makes your own release defensible at all

Challenges

  • Controls cost time in a process already under deadline pressure
  • Variance analyses produce many false alarms at first, until the expected values are right
  • A four-eyes principle is hard to achieve in very small teams
  • Documentation is experienced as bureaucracy for as long as no audit has happened
  • The control checks the system — it does not help against an error of legal interpretation

8. Best practices for implementation

Define expected values rather than merely looking at variances

A variance is conspicuous only once it is clear what was expected. Joiners, leavers, collective pay steps and one-off payments belong recorded before the run – what then remains is a short list of real anomalies instead of a long list of explicable ones.

Treat a new wage type as a legal question

Every new wage type carries tax and contribution indicators. An error in them works from first use across everyone affected – the most expensive class of error there is, and reason enough for a release step of its own.

Check tax and contributions separately

Two bodies of law, two yardsticks. A control that secures only the tax treatment leaves the contribution side open – and that side is audited later.

With outsourced payroll, take the release seriously

Release without a check is not a release but a signature. A variance report from the provider belongs agreed in the contract and actually read.

Document the controls while nothing has happened

Evidence does not arise retrospectively. Starting only when an audit is announced means documenting precisely not the periods that will be audited.

9. Tips for employers and employees

For employers

  • **Variance analysis rather than recalculation** – systems calculate correctly, rules are wrong
  • **Release new wage types separately** – a wrong indicator works across the whole workforce
  • **Deadlines are a quality criterion** – late payment of contributions can engage Section 266a StGB
  • **Outsourcing moves the work, not the responsibility** – Section 28f SGB IV stays with you

For employees

  • **Check your payslip** – particularly in the month after a change to your contract or master data
  • **Report discrepancies promptly** – corrections within the current year are easier for both sides
  • **Keep your payslips** – they are your evidence towards the tax office and the pension insurance
  • **Ask where something is unclear** – an explained payslip prevents the suspicion that otherwise remains

10. Conclusion

Quality assurance in payroll is not recalculation. The machine calculates correctly; what is wrong are the rules it executes – a wage type with the wrong indicator, a faulty master record, a threshold that was never updated. Comparison is therefore the tool: month against previous month, person against the population, total against expectation.

From that follows the second peculiarity: errors in this process are almost never isolated. They work across everyone affected and every subsequent month – and because the payroll tax audit and the employer audit now analyse complete data sets, they are found in full as well. That is the commercial reason for controls, ahead of the legal one.

Legally they rest on Section 28f SGB IV, Section 41 EStG and the liability in Section 42d EStG. A documented control system does not merely satisfy those duties – it also shows, when it matters, that the work was done carefully. Outsourcing changes nothing here: the work moves, the responsibility stays.

For an international group one point deserves to be taken out of the technical register entirely. Withholding employees' social security contributions is a criminal offence under Section 266a StGB, and it attaches to the managing director personally. A late contribution payment in Germany is therefore not only a question of interest and surcharges, and a payroll calendar that treats the German due date as flexible is creating a different kind of exposure than it appears to.

A note on sources: the Criminal Code has an official English version, cited below. The Income Tax Act and SGB IV do not (checked on 2026-09-27); their German texts govern.

Sources

Related terms

Our promise

Software supports. People take responsibility.

Let us talk about your payroll – no strings attached, specific, and with a dedicated contact from day one.

Schedule a conversation +49 30 166 389 700
Set up fail-safetrue to detail, e.g. shadow payroll
Four-eyes reviewbefore every approval
Hosted in GermanyISO 27001 · GDPR