A new executive walks into a mandate with a board already waiting on a plan. The pull is toward strategy: market position, cost structure, where the next twenty percent of growth is supposed to come from. The executives who survive the mandate usually resist that pull for the first several weeks and do something considerably less interesting. They audit the machinery underneath the numbers they’ve been handed.
The reasoning is practical. A strategy built on reporting nobody can trace, or on a balance sheet that doesn’t yet reflect a liability accruing quietly inside the payroll system, will fail during execution regardless of how good the thinking was. Worse, that failure gets attributed to the executive who wrote the plan rather than to the conditions they inherited.
This applies with particular force to interim and turnaround work. interim executives on compressed turnaround mandates arrive with weeks rather than quarters, and they usually land at companies where something has already gone wrong. Establishing what, precisely, is the entire first phase of the job.
Payroll Tells You More Than the P&L Does
Payroll sits at the intersection of tax, employment law, time tracking, benefits administration, and cash. Because it touches all of those at once, it’s the fastest read available on how disciplined a company actually is.
The first question is whether federal and state deposits are current and whether anyone in the building can prove it. The exposure is not small. The IRS reported civil penalties assessed against businesses in 2024 of $20.9 billion, and failure-to-deposit penalties run on a clock that starts at the original due date rather than the day a notice arrives. A company can be several quarters into a problem before anyone outside it says so.
The second question is error rate. An Ernst & Young survey commissioned by Paycom, covering 508 payroll professionals at US companies with 250 to 10,000 employees, found that roughly one in five payrolls contained an error, that the average organization made 15 corrections per pay period, and that each correction cost about $291 to resolve. Those numbers come from a vendor-commissioned study of mid-market firms, so treat them as directional rather than precise. The underlying pattern still holds. Correction volume is a proxy for how much manual intervention payroll requires, and manual intervention is where compliance failures originate.
The third question is architectural, and it’s the one most incoming executives skip. Payroll either runs on a system built for payroll or it runs as a module bolted onto accounting software, and those two behave differently under pressure. The divergence shows up in multi-state tax registration and filing, contractor payments and year-end forms, benefits administration, and how much of the compliance burden the platform absorbs rather than handing back to a finance team that may be two people. payroll-native platforms compared with accounting-bundled payroll is worth working through before deciding whether the current setup is a cost line to optimize or a risk to remove, because that answer determines whether the fix is a configuration change or a migration, and those carry very different timelines.
Classification Exposure Accrues Whether Anyone Looks or Not
Nearly every growing company has people doing employee work under contractor agreements. Some of those arrangements are defensible. Plenty were set up quickly, often by someone who has since left, to get around a headcount approval that would have taken a month.
This exposure behaves unusually because it compounds backward. A reclassification finding doesn’t begin on the date of the finding. It reaches back across the working relationship and carries unpaid employment taxes, penalties, and interest with it, plus unpaid overtime and benefits in many states. The IRS common-law test for worker classification weighs behavioral control, financial control, and the nature of the relationship, and none of those factors turn on what the agreement calls the person.
For an incoming CFO the audit item is narrow and answerable. List everyone paid on a 1099 or against an invoice, and for each one establish who sets their hours, who supplies their tools, whether they work for anyone else, and how long the arrangement has run. Anything that looks like employment and has been running for years goes to the top of the list.
For executives operating outside the United States, the same audit runs under different names. The United Kingdom tests contractor arrangements through the IR35 off-payroll working rules, and the EU Platform Work Directive requires member states to put a rebuttable presumption of employment into national law by 2 December 2026, shifting the burden of proof onto the engaging party. Most developed markets apply some version of a substance-over-form test, weighing what the working relationship looks like in practice against what the contract calls it. The audit logic holds regardless of jurisdiction.
Insurance Bought for a Company That No Longer Exists
Commercial insurance gets bought once, usually early, and then renewed on autopilot. In the meantime the company adds headcount, opens in new states, changes what it sells, signs customer contracts with indemnity clauses, and starts putting employees behind the wheel. The policy schedule doesn’t update itself.
The audit question is whether current coverage matches current operations, and the gaps are rarely where people expect. A company that placed its first employees in a new state may have inherited an obligation nobody flagged. California is the sharpest illustration, since Labor Code section 3700 requires coverage from the first employee with no small-employer exemption and the state treats non-compliance as a criminal matter. California workers’ compensation coverage penalties include a misdemeanor charge carrying a fine of at least $10,000, civil penalties reaching $100,000, and a stop order barring the use of employee labor until coverage is in place.
Workers’ compensation is only the statutory floor. What a company actually needs depends on what it does and what it has signed, and California business insurance requirements by coverage type separate along lines that matter once a claim tests the policy, running across general liability, professional liability, commercial auto, and employment practices coverage. An executive auditing this should be reconciling three lists: what the law requires in every state where the company has people, what customer and lease agreements obligate the company to carry, and what actually sits on the current policy schedule. The space between those three lists is the finding.
Reporting You Can’t Trace Is Reporting You Can’t Use
Every incoming executive receives a management pack. Far fewer ask where each number originates, how long it takes to produce, and how many hands touch it between the source system and the slide.
The answer is diagnostic on its own. If the revenue figure requires someone to export three reports and reconcile them in a spreadsheet, that number is late, fragile, and dependent on one person who may be on holiday during board week. operating systems that fall behind company growth tend to surface in exactly this shape, as reporting that technically arrives but arrives too slowly and with too much manual handling to support a decision anyone would want to defend.
Trace two or three numbers end to end during the first month. Each takes an afternoon and tells you more about the finance function than any org chart will.
Contract Obligations Sitting With Nobody
Vendor agreements and customer contracts accumulate obligations that no single function owns. Auto-renewal dates pass unnoticed. Indemnity clauses commit the company to exposure that was never priced into the deal. Customer contracts routinely specify minimum insurance limits and additional insured status, which is where the coverage audit and the contract audit turn out to be the same exercise.
Ask for the complete contract register. If nobody can produce one, that itself is the finding, and building it is a cheap early win that pays back across every other workstream.
Sequence the Findings Rather Than Fixing Everything
A thorough audit surfaces more problems than any executive can resolve in a quarter. The sorting rule is whether the exposure grows while nobody is watching it.
Statutory exposure comes first, because unpaid deposits, missing coverage, and misclassified workers all accrue penalties and liability with every week that passes. Reporting comes second, since everything downstream depends on numbers people can rely on. Everything after that is optimization, and optimization can wait for the strategy the audit exists to inform.
What the Board Actually Wants at Day 90
Boards ask for a plan, but what they’re buying is confidence that the person they hired understands what they’re standing on. An executive who arrives at day 90 with a strategy and no diagnostic has offered an opinion. An executive who arrives with a strategy, a documented list of what’s broken underneath it, and a sequenced remediation plan has offered a position that survives contact with the business.
Treating the audit as a delay before the real work begins gets the sequence backwards. The audit is what makes the real work worth doing.