Every month, the Kenya Revenue Authority processes thousands of PAYE returns through iTax, and a growing number of employers find themselves flagged for deeper scrutiny. Payroll errors that once slipped through manual checks now trigger automated alerts in KRA's risk-management systems. For small and mid-sized companies juggling tight budgets and lean HR teams, a single miscalculation can cascade into penalties, interest charges, and the distraction of a full audit. Understanding which mistakes draw KRA's attention, and how to prevent them, keeps your business compliant and your finance team focused on growth rather than firefighting.
Why KRA Flags Certain Payroll Returns for Audit
KRA's audit-selection process is no longer random. It relies on risk-based algorithms that score each employer's filing history, consistency, and patterns against sector benchmarks. Late submissions, frequent amendments, and significant month-to-month swings in employee headcount or total PAYE all raise your risk profile. When your PAYE-to-gross-pay ratio falls outside the expected range for your industry, the system flags your file for human review. If you operate in a sector known for casual labour or high turnover, even legitimate fluctuations can look suspicious without proper documentation. Digital filing trails make these discrepancies easier to spot than in the days of paper returns, because every submission carries metadata that auditors can query in seconds.
A full payroll audit consumes far more than a few hours of spreadsheet work. Auditors will request employee contracts, payslips, bank statements, board resolutions approving allowances, and contemporaneous records of benefit valuations going back several years. Small and mid-sized companies rarely have dedicated compliance officers, so the finance manager or HR lead must drop everything to compile binders of evidence while normal operations stall. Beyond staff time, penalties for under-remitted PAYE accrue at 5 per cent of the unpaid tax, plus interest at 1 per cent per month, and those costs multiply quickly when errors span multiple pay periods. The reputational cost also matters. Suppliers and lenders who learn of an ongoing KRA audit may tighten payment terms or reconsider credit lines.
Error One: Miscalculating PAYE on Allowances and Benefits-in-Kind
Kenya's Income Tax Act distinguishes between taxable and exempt allowances, but the boundary shifts with each Finance Act and practice notes from KRA. Housing allowances are fully taxable when paid in cash, while employer-provided accommodation is valued at 15 per cent of an employee's other cash pay or the fair market rental, whichever is lower. Transport allowances are taxable unless they reimburse actual travel costs supported by receipts, and medical allowances paid as cash fall into the same bucket. Many payroll clerks apply a blanket exemption to all allowances labeled "medical" or "transport," missing the requirement that only reimbursements of actual, documented expenses qualify for relief. That gap becomes obvious when an auditor compares your payroll register against employees' P9 forms and discovers that every staff member received identical transport allowances regardless of their role or location.
Benefits-in-kind require a fair-market valuation, and the rules differ by asset type. A company vehicle used for both business and personal travel is taxed at the higher of 2 per cent of its initial cost per month or KES 3,000, while a fully personal vehicle is taxed at 3 per cent of cost. Employer-paid airtime, gym memberships, and club subscriptions all count as taxable benefits unless they are exclusively for business use, and the burden of proof lies with the employer. Many finance teams forget to include these items in the PAYE calculation or value them at historical cost rather than fair market rates. Our AI HR software handles this automatically, matching benefit codes to the latest statutory tables and flagging items that need manual valuation.
Error Two: Late or Incorrect iTax Filing and Payment
PAYE must reach KRA by the ninth day of the month following the pay period, yet cash-flow pressures, forgotten passwords, and last-minute payroll changes push many employers past that deadline. The penalty structure punishes both late payment and late filing. If you file your P10 on time but remit the funds two days later, you incur a 5 per cent late-payment penalty on the outstanding amount. If you miss the filing deadline altogether, you face an additional penalty of KES 10,000 or 5 per cent of the tax due, whichever is higher, and interest compounds at 1 per cent per month until you settle. These charges stack quickly, so a modest three-day delay on a KES 200,000 PAYE bill can cost you KES 10,000 in penalties plus interest that grows with each passing month.
Reconciling your payroll register with the P10 summary before submission catches mismatches that would otherwise trigger a query from KRA. Check that total gross pay, total PAYE, and employee counts match between your payroll export and the iTax form line by line. Verify that you have not duplicated any employee PIN numbers or omitted statutory deductions for employees who joined mid-month. A single typo in a PIN can cause the entire return to bounce, and re-filing eats into your nine-day window. Automating iTax filing eliminates manual entry errors and schedules submissions well ahead of the deadline, so your finance team never has to scramble on the eighth of the month.
Error Three: NSSF Tier-One and Tier-Two Contribution Mix-Ups
The National Social Security Fund now operates a two-tier structure, with Tier I covering pensionable earnings up to KES 7,000 and Tier II covering earnings from KES 7,001 to KES 36,000. Each tier has its own contribution rate, currently 6 per cent of pensionable pay split equally between employer and employee, and both must be remitted separately through the NSSF portal. Many payroll systems still use the old flat-rate calculation, applying 6 per cent to the first KES 18,000 and ignoring the split, which leaves higher earners under-contributed and exposes the employer to compliance risk. Other teams apply the 6 per cent rate to total pensionable pay without respecting the KES 36,000 ceiling, over-deducting from employees and complicating refunds.
The most common error is omitting Tier II contributions entirely, either because the payroll clerk did not update the formula after the law changed or because the software vendor has not released a patch. When an employee earns KES 50,000 per month, the correct NSSF calculation caps pensionable pay at KES 36,000, splits that into KES 7,000 for Tier I and KES 29,000 for Tier II, and applies 6 per cent to each band. The employer then remits KES 420 for Tier I and KES 1,740 for Tier II as the employer's share, plus matching employee deductions. Missing one tier means your remittance is half what it should be, and NSSF audits are just as disruptive as KRA audits. Ensuring your payroll system calculates both tiers automatically and files them separately keeps you compliant and saves your team from manual spreadsheet gymnastics every month.
Error Four: SHIF Deductions and the NHIF-to-SHIF Transition
When the Social Health Insurance Fund replaced the National Hospital Insurance Fund, contribution bands and rates changed, but many employers continued deducting the old NHIF amounts because they did not update their payroll tables. SHIF uses a progressive rate structure tied to gross monthly income, with contributions ranging from KES 300 for employees earning below KES 10,000 to 2.75 per cent of gross pay for those earning above KES 100,000. NHIF used fixed bands capped at KES 1,700, so high earners now pay significantly more under SHIF, and payroll systems that hard-code deduction amounts will under-remit. Auditors comparing your payroll register against SHIF receipts will spot the discrepancy immediately and assess penalties for every month you used outdated rates.
Mistakes during the transition period are especially common because employees moved from one fund to the other mid-year, and some payroll clerks applied hybrid logic that mixed NHIF and SHIF rules. If an employee's income fluctuates, perhaps due to a mid-year promotion or variable commission, they may cross into a higher SHIF band partway through the financial year. You must recalculate their band each month based on that month's gross pay, not an annual average, and adjust the deduction accordingly. Keeping your payroll system updated with the latest statutory rates and band tables is not a one-time setup task. It requires monitoring government notices and applying patches as soon as new rates are gazetted.
Building an Audit-Ready Payroll Process
Monthly reconciliation is the discipline that separates audit-proof employers from those who scramble when KRA comes knocking. Before you file each P10, compare your payroll register against individual P9 forms to confirm that every employee's PAYE, NSSF, and SHIF match the totals you are about to remit. Download your NSSF and SHIF contribution statements from their respective portals and cross-check that employee counts and amounts align with your payroll exports. If you discover a mismatch, perhaps an employee was omitted from NSSF or a deduction was keyed incorrectly, correct it in the same month rather than deferring the adjustment, because amendments filed months later raise red flags. This checklist should be a non-negotiable step in your month-end close, scheduled before the finance manager signs off on the P10.
Maintaining a digital audit trail for every pay run, amendment, and statutory filing turns a potential nightmare into a straightforward evidence review. Store timestamped exports of each payroll batch, approval workflows showing who authorized salary changes or one-off bonuses, and confirmation receipts from iTax, NSSF, and SHIF. Tag each document with the pay period and employee group so you can retrieve everything within minutes if an auditor requests records for a specific month. Paper payslips and manual spreadsheets are harder to organize and easier to lose, and they do not carry the metadata (user login, edit history, system-generated calculations) that proves your process was consistent and controlled.
AI-assisted payroll flags anomalies before they reach KRA, catching duplicate employee records, negative deductions, and mismatched totals that would otherwise slip through manual review. If your payroll software detects that an employee's PAYE suddenly drops by 80 per cent while their gross pay remains flat, it prompts you to verify the allowance entries before finalizing the batch. When an employee appears twice in the register under slightly different PIN numbers, the system highlights the duplication so you can merge the records rather than filing a return that triggers an immediate query. Setting calendar reminders and automated alerts for statutory deadlines ensures you never miss the ninth-of-month cutoff, even during holiday periods or when the finance manager is traveling.
Running compliant payroll in Kenya demands more than arithmetic. It requires staying current with evolving tax bands, contribution tiers, and digital-filing requirements that change with each Finance Act. Small errors compound into large penalties when they repeat across multiple pay periods, and the cost of an audit extends far beyond the monetary fines. By understanding the specific mistakes that draw KRA's attention and building systematic controls around PAYE calculation, statutory filing, NSSF splits, and SHIF bands, you transform payroll compliance Kenya from a monthly gamble into a predictable, auditable process. Employers who invest in automated, audit-ready systems today protect their cash flow, their reputation, and their team's time for the years ahead.