Access ended on Friday. The direct deposit ran on Tuesday.
What looked normal
The employee left. HR closed the file. IT revoked systems access. On the next payday, salary still cleared to the same bank account.
No one stole a check in the mail. The payroll run simply never learned what the badge system already knew. That gap—between HR status and payroll payment—is where ghost pay and post-termination leakage live.
Why people should care
Payroll is often the largest operating expense line. A small rate of “still paid after exit” compounds quietly across months and locations.
Classic reviews sample a few terminations and check the final payslip. They rarely join termination date, last physical/system activity, bank details, and every subsequent payment across the full population.
Eight payroll analytics that catch silent leakage
These tests use employee master, bank details, pay results, and—where available—access or time data. In SAP-style landscapes that often means Employee Master (PA0000 / PA0001), Bank Details (PA0009), Basic Pay (PA0008), and Payroll Results (PCL2 / RT).
-
Payments after termination date
Flag pay results posted after the employment end date—excluding documented final settlements.
Business impact: Direct cash leakage from delayed or missed offboarding in payroll.
-
Paid with no recent activity signal
Join payroll to badge, VPN, SSO, or timesheet activity. Surface employees paid with zero recent presence.
Business impact: Ghost-employee and shelved-headcount patterns that master status alone misses.
-
Shared bank accounts across employees
Detect two or more active employees remitting to the same IBAN / account (PA0009).
Business impact: Possible family proxy, identity sharing, or diversion setup.
-
Employee bank matches a vendor bank
Compare employee bank details to vendor bank master (LFBK) for exact IBAN / account matches.
Business impact: Classic payroll–AP diversion and related-party payment risk.
-
Bank detail change just before payday
Flag bank account changes close to a pay run, especially for high earners or recent joiners.
Business impact: Account-takeover and insider diversion window.
-
Duplicate national ID, tax ID, or contact
Match employees on national ID, tax ID, phone, or email—exact and near-duplicate.
Business impact: Duplicate personas on payroll under different employee numbers.
-
Off-cycle / manual payment concentration
Cluster manual, off-cycle, or adjustment payments by initiator, cost center, and employee.
Business impact: Override paths that bypass standard payroll controls.
-
HR status vs payroll status mismatch
Compare HR employment status to payroll payability. Catch “inactive in HR, active in pay.”
Business impact: Process break between HRIS and payroll that keeps ghost pay alive.
Why offboarding reviews miss this
Final payslip check
Confirm last day, unused leave, and one final payment. Assumes the next cycle will stop automatically.
Status + pay + bank joins
Every payment after exit, every shared bank, every HR–payroll mismatch— across the full population, not a sample of leavers.
Deactivating a badge is not the same as stopping a salary. Join HR status to payroll results and bank details—and post-termination pay stops looking invisible.
How foretale.ai helps
foretale.ai runs payroll risk analytics across employee master, bank details, and pay results— payments after termination, shared employee banks, employee–vendor bank matches, off-cycle concentration, and HR–payroll status mismatches—with explainable evidence for every finding.
Payroll, HR, and audit teams review prioritized leakage across the full population—not only a sample of leavers.
Who was still paid after they left?
Termination dates and pay results often sit in data you already have. Continuous AI analytics can surface post-termination pay before the next cycle clears again.
Request a demo