The Payroll Operational Risks That Never Reach the Partners' Meeting
Payroll is regulated, deadline-driven and data-heavy, and in most firms its controls are one person's memory. The exposures that never make the risk register.
Ask a firm to name its biggest operational risks and the answers come quickly. Cyber. Losing a major client. Regulatory change. Professional indemnity.
Payroll rarely features, and where it does it appears as a line about compliance rather than about the operation itself.
That is a curious omission. Payroll is a regulated service, delivered to a fixed date that cannot move, handling the most sensitive personal data a firm holds, for clients who would notice an error within hours. In most firms its controls are one person’s memory, a shared inbox and a spreadsheet.
The five exposures a partner would assume are covered
An audit trail on changes
Can the firm demonstrate, for any given payroll change, what was requested, by whom, when it arrived, who approved it and when it was applied?
In an email-based operation the answer is usually yes in principle and no in practice. The evidence exists, scattered across several inboxes, retrievable in an afternoon by somebody who knows where to look. That is not an audit trail. That is an archaeology project, and it is only ever attempted after something has gone wrong.
A record of approval
Where a change carries a material cost, somebody on the client side approved it. Where is that recorded, and would it survive a dispute?
The commonest failure is not the absence of approval but its informality. A verbal confirmation in a phone call is an approval right up until the moment somebody disputes it.
Documented client-specific handling
Every payroll client has quirks. A different cut-off. Directors paid from another entity. A report the client wants in a particular format. Multiply that by the client list and a firm is carrying several hundred pieces of operational knowledge.
If that knowledge exists only in the heads of the people who run those clients, the firm does not have a process. It has a set of individuals, which is a different thing with a different risk profile.
Access control
Who can see which client’s payroll data, and how would the firm evidence that if asked? Shared inboxes and shared drives are convenient precisely because they do not enforce this, which is also why they are difficult to defend.
Continuity cover
Not whether somebody could cover. Whether somebody could cover on Monday, for the largest client, without the knowledge being transferred verbally first.
Why these never reach the risk register
Three reasons, and none of them is negligence.
They have never produced an incident. Risk registers are largely populated by things that have gone wrong somewhere, and payroll teams are extremely good at absorbing near-misses invisibly. The catch that prevented an overpayment generates no paperwork.
They are described as personnel issues rather than control issues. “Only one person knows how that client works” gets discussed as a training matter. It is a single point of failure in a service line with a deadline that cannot move.
Nobody outside payroll can see them. The people who understand these exposures in detail are the people running the operation, and they are generally not in the room where the register is reviewed.
The question that surfaces all five
There is one question that does the work of a full audit, and it takes a minute.
If the person who runs our largest payroll resigned on Friday, what happens on Monday?
Not eventually. Monday. Somebody would find the calendar and the logins. Then they would meet the part that was never written down, and the firm would discover how much of a regulated, deadline-bound service was living in one person’s memory.
What closing the gap actually involves
Not more checking. Checking is the instinctive response and it adds cost without reducing exposure, because the problem is not attention, it is that information arrives through routes nobody controls.
What reduces the exposure is fewer places for a change to hide. One route in for client instructions, with the required information enforced at the point of capture. One place where the state of every payroll is visible. Documented client handling that lives in the system rather than in a person. Approvals recorded where they happen, with a time stamp, as a by-product of the work.
Changepen provides that operational layer alongside the payroll software a firm already runs. It does not calculate pay and it does not replace anything. It records the operation around the calculation, which is precisely the part that currently has no controls.
“Managing over 300 payrolls is so much easier with Changepen.” Harriet Gibbs, Operations Manager, LitE Payroll.
If it is useful to see how other firms have approached this, our customers page sets out what they run and why.