Who can do what: approvals and separation of duties
The approval rules that stop one person from preparing and approving the same payroll item.
Before you begin
This article is for payroll managers and administrators who assign roles. Every rule below is enforced by the system, not only by the screens. Nobody approves their own work.
The rules
| Item | Prepared by | Cannot be decided by | Message |
|---|---|---|---|
| Payroll run | Whoever created, froze or calculated it | The same person | 'A payroll run is approved by somebody other than the person who created, froze or calculated it.' |
| Manual input | Whoever entered it | The same person | 'A pay input is approved by somebody other than whoever entered it.' |
| Rule package | Its author | The author | 'A rule package is approved by somebody other than its author.' |
| Settlement policy | Its author | The author | 'A settlement policy is approved by somebody other than its author.' |
| Payment file | Whoever prepared it | The same person releasing | 'A payment file is released by somebody other than whoever prepared it.' |
| Final settlement | Preparer | Reviewer and approver and payer | 'A settlement is reviewed by a specialist other than the person who prepared or sent it.' |
| Provision run | Proposer | The same person posting | 'A provision is posted by somebody other than whoever proposed it.' |
For a final settlement four people take part: preparer, specialist reviewer, approver and payer.
Role conflicts
Try not to give one user both payroll.prepare and payroll.approve, both payroll.pay_prepare and payroll.pay_release, both payroll.configure and payroll.rules_approve, both payroll.prepare and payroll.settlement_review, or both payroll.settlement_review and payroll.approve. The Access review flags these. The company can choose to refuse such a grant.
Approving and posting a run are not treated as a conflict by the permission check. If you want them separate, assign them to different people.
Other controls
- Frozen after approval. An approved or posted run cannot be recalculated, sent back or cancelled. Use a correction run.
- Tamper checks. The system compares what you approved with what is stored, and refuses to post or release if the payslips, the rule package or a payment file changed.
- Stale screens. A command carries the revision of the record you are looking at. If it changed, you are asked to reload.
- Repeated commands. Repeating the same financial request returns the first answer and does nothing twice.
- Masking. Bank numbers are masked on screens.
- Features. A switched-off feature refuses changes at the server.
Good to know
- Switching the control rules is a company decision made through the application configuration, with a second administrator approving.
- All commands are written to the audit trail with the user and time.