Service noteapplication-controls
Application controls and access
Who can change a salary, approve a batch, and post a reversal — and whether those rights still match the names on your authorisation matrix.
A focused review of roles, maker-checker, and master-data screens.
Financial audit of a payroll suite is not only about the numbers. It is about who is allowed to change the numbers.
We map the live role catalogue to your written authorisation matrix. We look for shared logins, dormant HR accounts that still hold “salary master” rights, and consultants whose temporary access was never withdrawn after go-live.
Control points we walk
- Hire, transfer, and termination workflows, including who can edit bank accounts
- Maker-checker on the pay run, and whether checker can also edit the batch
- Direct table updates and “emergency” adjustment screens that skip the workflow
- Segregation between HR master data, payroll operations, and finance posting
- Audit-trail reports: whether they are complete, retained, and actually reviewed
Where the suite cannot enforce a control, we say so plainly and describe a compensating check that finance can run before the bank file is released.