An audit notice from the Inland Revenue Authority of Singapore (IRAS) is not always the result of something going wrong. Sometimes, it is the result of something looking inconsistent. IRAS cross-references payroll data across multiple systems. When the numbers do not align, a company gets flagged for review, whether or not the discrepancy was intentional.
Understanding the selection patterns is how businesses stay off that list. This article breaks down how an IRAS audit is done and what operational gaps trigger review.
What Does an IRAS Payroll Tax Audit Actually Cover?
A payroll tax audit reviews how a company reports employee income and statutory contributions. IRAS runs two types:
- Desk audits: Conducted through written correspondence. IRAS requests specific documents and reviews them remotely
- Field audits: More comprehensive. Involve on-site visits and direct interviews with staff
The core data under review is Form IR8A submissions, Auto-Inclusion Scheme (AIS) data, Central Provident Fund (CPF) contribution records, and Benefits-in-Kind (BIK) declarations.
For companies building or reviewing their Singapore payroll system, understanding what IRAS looks at during a review is the starting point for building audit-ready records. Investigation audits, which are more serious, are reserved for cases where IRAS suspects deliberate tax evasion. Routine compliance reviews make up the majority.
How Does IRAS Identify Employers for Review?
IRAS uses data analytics to cross-match submissions and flag anomalies before an auditor is assigned. It compares three sources: AIS submissions, CPF Board contribution records, and employer-filed tax data.
Differences between employment income reported to IRAS and payroll contribution records can increase the chance of review, especially where they indicate inconsistent reporting .
Some sectors face more scrutiny by default. Construction, food and beverage, and retail businesses are reviewed more often because cash-intensive operations carry a higher inherent risk of underreporting.
Staying current on Employment Act updates is one way employers can ensure their payroll structure reflects the obligations IRAS expects to see.
IRAS also monitors AIS registration compliance. Employers with five or more employees are legally required to submit employment income electronically via AIS. Failure to register once that threshold is crossed triggers escalating reminders and, for repeat non-compliance, fines under the Income Tax Act.
What Payroll Patterns Raise a Red Flag?
The triggers below are what IRAS’s analytics routinely surface. Each one signals a gap between what a company is paying and what it is declaring.
| Audit Trigger | What It Signals to IRAS |
| AIS figures don’t match CPF records | Salary figures may be understated for tax purposes |
| Late or incomplete IR8A submission | Poor payroll controls or deliberate omission |
| Undeclared BIK exceeding S$200 | Taxable benefits passed off as non-taxable |
| High-value irregular reimbursements | Disguised salary components to reduce tax liability |
| ESOP/ESOW gains not reported | Taxable share option income omitted from employee filings |
| No audit trail on payroll calculations | Inability to verify reported figures against actual payments |
Employers using payroll outsourcing Singapore with managed AIS submission reduce several of these exposure points structurally.
Manual payroll processes leave more room for errors behind these triggers, particularly around Annual Wage Supplement (AWS), performance bonuses, and variable allowances that compound across a reporting year.
The IR8A submission deadline is 1 March each year. Missing the deadline or filing incomplete data increases compliance exposure and may lead to penalties or follow-up from IRAS.
What Changes After IRAS Finds Something?
The outcome depends on who found the issue first.
In January 2024, IRAS changed how it handles voluntary disclosure. Previously, under-reported tax could be settled through a “Global Settlement,” a single employer-level adjustment that didn’t involve individual employees directly.
That option is gone. IRAS now issues Notices of Assessment (NOAs) directly to each affected employee. A payroll discrepancy found during an IRAS audit no longer stays at the company level. Employees get direct correspondence from IRAS, which adds HR and reputational risk on top of the tax issue.
Employers who self-report through the Voluntary Disclosure Programme (VDP) before IRAS finds the issue keep access to reduced penalties. Those discovered during audit face the full penalty framework.
Singapore law requires all payroll and tax documentation to be retained for a minimum of five years. That includes payroll registers, CPF statements, IR8A appendices, and employment contracts relevant to reported income.
Understanding how global payroll compliance breaks down at the operational level is part of the risk picture for companies managing multi-country teams from Singapore.
How Managed Payroll Execution Reduces Audit Exposure
The conditions that trigger an IRAS audit, AIS mismatches, CPF gaps, missing BIK declarations, are almost always structural. They come from how payroll is set up and maintained, not from a one-off mistake.
Managed payroll addresses this at the source. When CPF contributions are calculated against current statutory rates, AIS submissions are verified before filing, and BIK is classified at the employee level, the data IRAS receives is consistent across all three cross-check points. There’s nothing left to flag.
Procloz manages Singapore payroll as a compliance and reporting function including covering CPF submissions, IR8A preparation, AIS filing, and levy management under the Skills Development Levy (SDL) framework. For businesses expanding into Singapore or managing a local workforce alongside global operations, this managed execution layer removes the audit exposure that typically builds up in manual or fragmented Singapore payroll services.
Contact us for assistance now.
IRAS Audit Frequently Asked Questions
Q: What triggers an IRAS payroll tax audit in Singapore?
CPF-AIS mismatches, late IR8A filings, undeclared Benefits-in-Kind, or irregular high-value reimbursements. IRAS data analytics flag these discrepancies automatically.
Q: How long must Singapore employers retain payroll records?
Five years minimum. This includes payroll registers, CPF statements, IR8A forms, and employment contracts supporting reported income figures.
Q: What changed with IRAS’s Voluntary Disclosure Programme in 2024?
From January 2024, IRAS discontinued the employer-level Global Settlement. Notices of Assessment go directly to employees, raising HR and reputational risk.
Q: Which industries face higher IRAS payroll audit risk in Singapore?
Construction, food & beverage, and retail face higher audit risk. Cash-intensive operations increase income underreporting risk, which IRAS data analytics routinely flag.
Q: Can Procloz manage AIS submission and IR8A filing in Singapore?
Yes. Procloz manages end-to-end Singapore payroll compliance, including CPF, AIS, IR8A, and BIK classification, ensuring consistent data across IRAS cross-check points.
