Ghost employees
Employees present in payroll but absent from HR master, access systems, or organisational hierarchy — including fictitious and no-show workers.
RISK COVERAGE
Payroll & Workforce Risk Analytics
Payroll is usually the largest recurring cost in the business and the least frequently tested. These analytics close that gap.
Payroll leakage does not announce itself. A leaver's salary keeps clearing because the termination date never reached the payroll master. Two employee records share one bank account. An employee exists in payroll but in no other system — no badge, no email, no manager.
foretale.ai reconciles payroll against the systems that should corroborate it: HR master data, joiner and leaver records, access logs, and bank details. Where those records disagree, it produces a finding with the supporting evidence attached.
WHAT WE DETECT
Risks tested in this domain
Post-termination payments
Salary, allowances, or benefits paid after the recorded termination or last working day.
Duplicate employee records
The same individual paid under two employee identifiers, or two records sharing a bank account, tax identifier, or contact details.
Payroll master data gaps
Missing or invalid bank details, tax identifiers, and dates of birth; records with no manager or cost centre; unexplained mid-cycle master changes.
Unauthorised pay changes
Salary, grade, or allowance changes made outside approval workflow, or entered and approved by the same user.
Overtime and allowance abuse
Overtime inconsistent with attendance or access records, and allowances claimed outside eligibility rules.
HOW IT RUNS
Understand → Plan → Execute → Explain
foretale.ai maps your data and relationships, plans the analytics for this domain, tests the full population, and returns findings with evidence attached. Your team keeps every judgement.
DATA USED
What we need from your systems
- Payroll registers by period
- Employee and HR master data
- Joiner, mover, and leaver records
- Bank account details
- Attendance, access badge, or system login logs
- Payroll master change history
Related reading
Frequently asked questions
What is a ghost employee and how is it detected?
A ghost employee is a payroll record that receives payment without a corresponding real, currently employed worker. Detection works by reconciling payroll against independent systems: HR master data, badge or system access logs, email accounts, and organisational hierarchy. A record paid by payroll but absent from all of those is the strongest indicator, as are shared bank accounts across employee identifiers.
How do payments after termination happen?
They usually result from a timing gap rather than fraud. The termination is recorded in the HR system but reaches the payroll master after the cut-off for the pay run, so one or more further payments clear. Testing every pay run against leaver records finds these, including cases where the termination date was later amended.
Can payroll analytics run without exposing salary data broadly?
Yes. Analytics run inside your organisation's isolated workspace with role-based access, so payroll findings can be restricted to authorised reviewers while the underlying detail remains protected.
How often should payroll analytics run?
Per pay run is the most effective cadence, because post-termination payments and master data gaps are correctable while still recoverable. Monitoring continuously is materially more valuable than an annual review.
NEXT STEP
See it on your data.
Request a focused walkthrough—usually within one business day.