A payroll bureau separates preparation, review, and authorized submission by assigning each function to a different person, documenting the handoff between each step, and requiring a credentialed or authorized individual to approve the final filing. Preparation is the data assembly and form completion step. Review is the independent verification of every line against source records. Authorized submission is the act of filing the return with the agency under the proper authorization. Combining any two of these in the same person eliminates the control that catches errors before they reach the agency.
The operational problem
Payroll bureaus that serve multiple clients face a volume problem. Each client may have different filing frequencies, different state registrations, and different deposit schedules. When the same person who prepares the return also reviews it and submits it, errors that originate in preparation are unlikely to be caught before filing. The control weakness is not a matter of competence; it is a structural problem. A person who prepared the return knows what they intended to put on it, which makes them less likely to notice what they actually put on it.
The segregation of duties principle is straightforward: the person who creates a record should not be the same person who verifies it. In payroll tax compliance, this means the preparer assembles the data and fills in the form, the reviewer checks the form against the source records line by line, and the authorized submitter confirms that the filing is correct and submits it under the proper authority.
Consequences of combining functions
When a payroll bureau does not separate preparation, review, and authorized submission, the following problems tend to occur:
- Filing errors go unnoticed because the person who made the error is the same person checking for it. A transposed digit in a wage total or a wrong jurisdiction code in a state return may be invisible to the preparer but obvious to an independent reviewer.
- Deposits are made for the wrong amount or to the wrong account because the person who set up the deposit also confirmed it. An independent review of the deposit amount against the return liability would catch the mismatch.
- Audit trails are weak. When the same person performs all three functions, there is no documented handoff between steps. If the IRS or a state agency questions a filing, the bureau cannot demonstrate that an independent review occurred.
- Client trust erodes when errors surface. A client who receives a penalty notice because of a bureau filing error may question whether the bureau has adequate controls.
Workflow: Three-function separation model
| Function | Who performs it | What they do | Evidence to retain |
|---|---|---|---|
| Preparation | Payroll specialist or staff accountant | Assembles payroll register data, populates the return, calculates tax liability, prepares deposit instructions | Draft return, source data printout, preparer sign-off |
| Review | Different person, not the preparer | Compares each line on the return to the source payroll register, verifies deposit amounts and dates, checks jurisdiction codes and account numbers, confirms filing frequency is correct | Reviewer checklist with line-by-line verification, reviewer sign-off |
| Authorized submission | Person eligible to sign and submit under the applicable instructions and authorization | Confirms the return is correct, verifies that the RAF or POA authorization is current, approves submission to the agency | Submission confirmation, authorization verification log |
Practical implementation for small bureaus
A small bureau with fewer than five staff members may not have three separate people for each client filing. In that case, the minimum acceptable separation is two people: the preparer and the reviewer-submitter. The preparer assembles and fills in the return. The second person reviews the return line by line against the source data and, if the review is clean, submits it. If the bureau has a credentialed individual on staff, that person should perform the final authorization even if they did not prepare or review the return.
For sole practitioners with no other staff, the separation is not possible within the firm. In that case, the practitioner should document a self-review checklist that includes specific verification steps (such as confirming the EIN, the quarter, the deposit total, and the state account numbers) and retain the completed checklist as evidence of the review process.
What may be delegated and what remains with an authorized owner
Separate the assigned data work, professional review and submission authority. Compensated return preparation can trigger PTIN or other requirements depending on the work; mechanical assistance is a separate question. The return instructions and actual reporting-agent arrangement determine who may sign and submit. Neither an ordinary staff title nor a general professional credential settles every requirement.
Where Form 8655 applies, inspect its specified returns, starting periods and checked authorizations. It does not grant general audit or appeal representation. Representation and disclosure permissions require their own review.
Synthetic workflow example
SYNTHETIC EXAMPLE: The roles and events are an internal-control illustration, not a required staffing ratio or a delivered result.
A payroll operation assigns source assembly to a preparer, exception review to a second person and submission approval to the permitted signer. The preparer identifies the report versions and enters reviewer-directed fields. Their workpaper initials are not a tax-return signature.
The reviewer compares the relevant wage and tax categories, checks period and account mapping, and records differences between liability and payment evidence. The authorized signer confirms the applicable form instructions and reporting-agent scope before any submission. The file retains review notes and actual acceptance or rejection evidence. No role title alone establishes filing authority, and matching totals do not certify compliance.
Education, experience, and systems considerations
The bureau should establish the following competencies for each role:
Preparer:
- Can read a payroll register and identify which fields map to which Form 941 lines
- Understands the difference between monthly and semiweekly deposit schedules
- Can calculate Social Security and Medicare tax using current rates and wage bases
- Knows which state returns are required for each client based on employee work states
Reviewer:
- Can independently recalculate the Form 941 liability from the register
- Understands that Schedule B daily liability must total to the Form 941 total for semiweekly depositors
- Can identify when a state return is missing for a jurisdiction where wages were paid
- Knows how to verify deposit timing against the deposit schedule (monthly deposits are due by the 15th of the following month; semiweekly deposits are due Wednesday for Wednesday-Thursday-Friday paydays and Friday for Saturday-Sunday-Monday-Tuesday paydays)
Authorized submitter:
- Holds an EA, CPA, or attorney credential, or is an authorized officer of the client entity
- Can verify that the Form 8655 authorization is current and covers the filing period
- Understands the difference between RAF authorization (filing and deposits) and POA authorization (representation)
- Can sign and submit returns electronically through the bureau's filing system
Engagement and jurisdiction considerations
The three-function workflow is a proposed internal control, not a universal legal staffing requirement. State submission and authorization rules must be checked with the relevant agency. Do not assume federal authorization or a provider contract settles state permissions.
For clients with local tax obligations (such as Ohio school district tax, Pennsylvania local earned income tax, or New York City withholding), the same three-function separation should apply to local returns.
Privacy considerations
Access should be limited to approved people and systems. Before sharing records, the engagement owner and counsel determine which privacy, confidentiality, consent and security rules apply to the information and the proposed activity. IRC Section 7216 and the FTC Safeguards Rule have defined scopes and exceptions; neither should be applied to every payroll record solely because an outside provider is involved. This is general information, not legal advice. Official consent rule.
Proposed measurement guidance
These are proposed internal review measures to agree for an engagement, not agency deadlines, guaranteed results or verified performance. Applicable deadlines must be confirmed separately.
- Each filing has three documented handoffs: preparation, review, and authorized submission
- No filing is submitted by the same person who prepared it
- Review checklist retained for every filing with line-by-line verification
- Authorization status (Form 8655 or POA) confirmed before each filing
- Filing error rate reviewed quarterly with root cause analysis for any errors that reached the agency
FAQs
Can the same person prepare and submit if they are credentialed?
They can, but it defeats the purpose of segregation. The credential authorizes submission and representation; it does not replace the independent review step. A credentialed person who prepares and submits without independent review is performing two functions in one, which means any error they made in preparation will likely survive to submission.
What if my bureau only has two staff members?
The minimum acceptable separation is two people: preparer and reviewer-submitter. The second person reviews the return against source data and, if it is clean, submits it. Document the review step even if the same person reviews and submits.
Does the reviewer need to be credentialed?
No. The reviewer needs to understand the return well enough to verify each line against the source data, but they do not need to hold an EA, CPA, or attorney credential. The credential matters for the authorized submission step and for any representation that may follow.
What records should the bureau retain from each filing?
The draft return, the source data printout, the review checklist with reviewer sign-off, the authorization confirmation, the submission confirmation, and any agency response or acknowledgement.
How does this apply to state returns?
The same three-function separation should apply to state withholding and SUI returns. State returns should be reviewed independently against the payroll register's state-level wage breakdown and against the state deposit history.
Can we use software to automate the review step?
Software may flag differences, but the engagement must define who evaluates exceptions and approves results. This guide proposes human review for the stated workflow; it does not assert a universal legal ban on automated checks or certify any product's capabilities.
This guide provides general educational information. Your qualified adviser must assess the facts, current instructions and applicable jurisdiction before a tax or legal decision.
Explore related support
Explore enterprise quality reporting or discuss your support scope.
Sources
- IRS, Outsourcing Payroll Duties
- IRS, About Form 941-X
- IRS, About Form 941
- IRS, Reporting Agents File (RAF)
- IRS, Publication 15 (Circular E)
- IRS, Understanding Tax Return Preparer Credentials
- Official records guidance
- Official source for the current correction
- Official source for the current correction
