Payroll audit: getting ready for a URSSAF inspection

Quick answer. Auditing your payroll before a URSSAF inspection means reproducing the inspector's approach in-house: pull a sample of payslips, reconcile payroll against the DSN and the accounts, check rates, ceilings and exemptions, and verify the supporting evidence for expenses and benefits in kind. The goal: fix any gaps before they turn into an assessment.

A URSSAF inspection is not an exceptional event: it is a normal milestone in the life of any business that employs staff. The difficulty is not the inspection itself, but reaching it without ever having reviewed your own payroll with a critical eye. Many directors discover their weaknesses on the day the inspector asks questions, whereas an internal audit a few months earlier would have secured everything.

This article is aimed at directors, HR managers and finance leaders of SMEs who want to understand what URSSAF checks, how the procedure works, and above all how to audit their payroll beforehand using a concrete checklist.

A URSSAF inspection has a simple objective: to verify the accuracy of the social security contributions declared and paid. In practice, the inspector reconstructs what the company should have paid and compares it with what it actually declared. Any gap in URSSAF's favour translates into an assessment, sometimes over several years.

The internal payroll audit means doing this work before URSSAF does, on your own file. You identify the weak spots, you document what can be documented, and you correct what needs correcting. That is the difference between enduring an inspection and preparing for one.

The underestimated risk#

The most frequently overlooked risk is not the isolated rate error. It is the systematic error repeated on every payslip, every month, across the entire reviewable period. A mishandled bonus, an unreported benefit in kind or a wrong reduction calculation costs only a few euros per payslip, but multiplied by the number of employees and months, the amount becomes significant. The limitation period covers, as a rule, the current year and the three preceding calendar years, which mechanically amplifies any structural gap.

The inspection follows a regulated procedure that gives the company time to prepare. URSSAF sends a prior notice of inspection, by a means that allows receipt to be proven, at least 30 days before the operations actually begin. The one notable exception: the fight against undeclared work, where this prior notice does not apply.

At the outset, URSSAF hands over the charter of the inspected contributor, an official document describing the process, the contributor's rights and the available remedies. The inspection rests on dialogue, and the company may be assisted by the adviser of its choice, for example its chartered accountant.

Those 30 days are valuable: this is the window during which a targeted audit can still gather supporting evidence, document practices and identify the topics to explain to the inspector.

A useful payroll audit reproduces the points URSSAF looks at first. Frequent checks cover:

• Liability and the contribution base: anything that constitutes remuneration must fall within the base.
• The calculation of the degressive general reduction (RGDU), a classic source of discrepancies. To understand the mechanism, see our article on the single degressive general reduction in 2026.
• Professional expenses and benefits in kind: supporting evidence, valuation, social treatment.
• Exemptions and their justification: a scheme applied without proof of eligibility is fragile.
• CSG-CRDS and the social package (forfait social): bases and rates.
• The treatment of severance payments: exempt portion, taxable portion.
• Reclassifications, for example of expenses into salary where the supporting document is missing.

URSSAF control points and risk#

Here is an operational checklist to run the internal audit. It follows the inspector's logic, from the general to the detail.

• Pull a representative sample of payslips (different profiles, bonuses, part-time, joiners and leavers).
• Reconcile payroll against the DSN: do the declared amounts match the payslips?
• Reconcile payroll against the accounts: staff costs, contribution accounts, balances.
• Check the rates and ceilings applied over the period (social security ceiling, brackets).
• Re-check the RGDU calculation on several payslips.
• List the benefits in kind and verify their valuation and reporting.
• Gather the supporting evidence for professional expenses and verify that no expense should be reclassified as salary.
• Document each exemption applied with proof of eligibility.
• Check the social treatment of severance payments made during the period.
• Verify the consistency of CSG-CRDS and the social package.
• Identify any systematic error likely to be repeated across the whole period.

Once the notice is received, or ideally before, here are the preparation steps:

1. Read the charter of the inspected contributor as soon as it is handed over, to know your rights and the process.
2. Appoint a single point of contact on the company side and, if needed, mandate your chartered accountant to assist you.
3. Centralise the documents: payslips, DSN, employment contracts, agreements, expense evidence, conventions.
4. Launch the self-audit based on the checklist above, prioritising the high-stakes items.
5. Document or correct the gaps detected before the inspection rather than letting them surface.
6. Prepare the explanations for sensitive points, with their supporting evidence.

Up-to-date payroll software makes these reconciliations easier. For choosing a tool, see our comparison of Lucca, PayFit and Silae and the Silae profile.

In payroll files, the most frequent sticking points are not fraud but approximations: an unvalued benefit in kind, a reduction calculation never re-checked since it was set up, expenses reimbursed without a filed receipt. The internal audit is not meant to rebuild everything: it should target high-leverage items, the ones that repeat on every payslip. That is where most of an assessment is decided.

We also recommend not waiting for the notice of inspection. The logic of the preventive audit echoes that of the compliance review on the tax side: a cold diagnosis is better than a correction under pressure.

A common case#

An SME has for several years applied a contribution reduction whose parameters were never re-checked after a regulatory change. Each payslip shows a tiny gap. During the self-audit, the reconciliation on a sample reveals the anomaly; the company documents the situation and corrects the calculation before any inspection, turning a potential multi-year catch-up into a managed adjustment.

• The standard limitation period remains 3 years (the current year plus the three preceding calendar years), extended to 5 years for undeclared work: any structural error adds up fast.
• The 30-day prior notice does not apply for undeclared work: the regularity of declarations must therefore be permanent, not only as an announced inspection approaches.
• The RGDU calculation remains a sensitive item: its parameters change and a frozen calculation quickly becomes wrong.