If payroll is managed in-house, review a system-generated access report to assess whether appropriate employees have access. If payroll is processed by an external bureau, check for evidence of communication to the bureau stating who is authorised to approve payroll changes and that they should only process changes if authorised by these individuals. Check a sample of changes to ensure compliance with instructions.