There are practical steps employers can take to protect payroll systems and processes but if you don’t have time, outsourcing can be a good option, says SARAH DALY.
These are scary times to run a business in our increasingly digital world! News of the recent HSE attack along with some high profile instances of alleged expenses fraud have heightened awareness of the ongoing need to protect critical business systems like payroll.
Phishing attacks that trick individuals into disclosing log-in details on fake websites are becoming more sophisticated, ransomware is on the rise, and new vulnerabilities are being discovered in operating systems and applications all the time.
GDPR raised awareness of the business risks associated with data breaches and the associated disruption of business processes. The cost of identifying the cause of these incidents and restoring systems can be substantial, as indeed are the potential fines where personal data has been exposed.
Raising internal awareness of these risks and keeping your teams alert has never been more important. But when we think about protecting payroll, it’s important to remember that not all risks are digital. There are plenty of other ways in which payroll can be manipulated by individuals with fraudulent intentions.
Examples of payroll fraud
- Employees claiming expenses for meetings or seminars that they did not attend
- Claiming personal expenses as business expenses
- Claiming more than an item actually cost
- Inflating commission payments
- Fraudulently increasing the number of hours worked
- Manipulating salary or wage rates
- Re-routing payments to someone else’s bank account
- Adding fake employees or failing to remove leavers from the payroll
Other payroll risks
As well as the risks associated with potential fraud, business risks can be created through payroll errors such as:
- Employees being put on incorrect tax bands
- Incorrect or late payments to employees
- Payslips not issued on time (or at all)
- Workers mistakenly labelled as ‘self employed’ when they should be classed as employees
All of these can be costly if they are not spotted and corrected on time.
So, what can you do to protect your payroll process?
It is very important to ensure that your payroll administrator has the appropriate skills, qualifications and training to process your payroll correctly. (Previously on this blog, I shared tips on checking if a payroll service provider is properly qualified). You also need to make sure that your processes comply with relevant legal, tax and statutory requirements.
The IT systems you use for payroll should be kept up to date and access to systems should be limited to authorised individuals only. Regular backups should be taken and you need to be confident that you can restore from these backups if you need to.
An approval system where claims for expenses, commission payments, overtime and so on must be authorised by an approved person is a good control. Regular payroll audits are also a good idea as they can catch potential problems before they escalate.
Interaction with other systems
Your payroll system probably interacts with your finance system. Depending on your business, it’s likely that running your payroll also involves interacting with various internal departments, individuals, Revenue, and third party service providers. You need to ensure that you understand how all of the links in this chain interact with each other and ensure that the flow of data is secure. It’s a good idea to document the entire payroll process so that you can identify any potential gaps in your controls and take remedial action.
Data protection
Data management is a key area to focus on because of the high level risks involved. Processing payroll requires a lot of sensitive personal information like names, PPS numbers, salary information and bank account details. Accuracy is vital. Check that you have good controls for adding new employees to the payroll, removing leavers and dealing with promotions and transfers. Limit the information that you collect so that you only hold essential information and only retain it for the necessary amount of time.
Monitoring your payroll system
Once you have identified and implemented your payroll controls, you need to monitor them on an ongoing basis and update them when necessary.
Too complicated to think about?
Payroll can be complicated. It’s not easy to keep up to date with constantly changing employment and tax requirements. This has been a bigger challenge than ever in recent times because of the various emergency measures that the Government introduced to help businesses cope with the financial impact of Covid-19. Even before the pandemic, though, I have seen many more businesses wanting to outsource their payroll administration to a specialist payroll service provider because they find it too complicated, time-consuming and stressful to manage in-house, particularly if they have to deal with a lot of employee queries.
If you decide to outsource, the important thing to remember is that you still have obligations as an employer so you need to make sure that the service provider has the necessary skills, knowledge and team to run your payroll in a consistent, reliable, secure and compliant manner. For tips on choosing payroll service providers, see our blog on outsourcing your payroll or contact me directly and I’ll be pleased to explain how the GroForth team can help you.
