Your payroll doesn’t need another employee to get more expensive.
It only needs a time record that never arrived, a rate change that overwrote history, or a payment file that drifted away from the approved register. Flat headcount isn’t an explanation. It’s the start of the investigation.
Call the control point the payroll evidence chain. Approved work and worker data become a frozen calculation. The calculation becomes a payment. The payment becomes a ledger posting, a liability, a remittance, and an accepted filing.
If any link is owned by the same person who can change the previous link, a rising payroll total becomes a debate instead of a diagnosis.
Payroll software is quite good at multiplying the inputs it receives. That isn’t the comforting part.
The Clocks
Start by separating the dates you all call “payroll date.” One run has at least a work-period start, a work-period end, a time-entry cutoff, and a payment date. It also needs a workweek boundary for overtime, an approval deadline, a payment-release moment, and a remittance calendar. Those clocks overlap, but they don’t mean the same thing.
Pay frequency makes this less cosmetic than it sounds. Canadian deduction tables distinguish 52 weekly, 26 biweekly, 24 semimonthly, and 12 monthly pay periods.
Biweekly and semimonthly aren’t synonyms. One follows seven-day weeks, the other follows calendar positions. British Columbia currently requires wages at least semimonthly and within 8 days after the pay period ends, and pay frequency doesn’t decide the remittance cadence either.
Close your time by workweek as well as by pay period. Under the U.S. federal FLSA, the overtime workweek is a fixed recurring 168-hour interval, and covered nonexempt employees generally receive at least 1.5 times the regular rate after 40 hours in it. A biweekly total of 80 hours can therefore look ordinary while one constituent week carries overtime. State, provincial, territorial, collective-agreement, and industry rules can change the treatment, so keep the applicable jurisdiction and rule boundary.
British Columbia’s general rules show the field set your time records need: overtime after 8 hours in a day or 40 in a week, double time after 12 hours in a day, and valid averaging agreements spanning 1 to 4 weeks.
The point isn’t to export B.C. rules into your payroll. The point is that a single hours total can’t carry the date worked, start and end time, unpaid break, workweek, rate assignment, earning code, jurisdiction, and averaging-plan identifier needed to explain the result.
The Split
Make your route visible before you make the schedule prettier. The relevant roles are capabilities, not job titles:
- Time capture records what happened; a manager or designated approver approves it. Compare every expected time submitter with received time records, then every record with an active worker and the correct pay period.
- Master-data authority approves an employee, rate, deduction, or bank change; payroll applies it with an effective date. A rate beginning July 1 has to coexist with the rate used through June 30.
- Payment authority releases only the file tied to approved control totals; an independent reconciler afterwards compares payment, bank, ledger, liabilities, and authority evidence.
That’s the authority–custody–accounting division in the GAO’s 2025 Green Book applied to payroll. One person may hold several roles in a small business, but the same person shouldn’t authorize, hold custody, and account for an entire route. Two or three independent identities across a high-risk capability chain beat two people with different titles and the same permissions.
Shared credentials are worse.
The log displays a name but can’t establish who acted.
Effective dating is your practical test. Keep legal identity, work location, employing entity, start date, pay group, rate or salary, tax profile, benefits, leave, bank instructions, and authorized deductions as dated fields.
Don’t overwrite the old rate and call the new screen a history. An audit needs the old value, new value, event type, timestamp, source, outcome, affected object, initiator, approver, release identity, and override reason.
NIST SP 800-171 Revision 3 identifies the core audit-record fields. Financial changes need the before-and-after values as well.
Bank-account changes deserve their own route. Your payroll operator verifies the authenticated change, records who approved it, and applies it to a specified pay date.
Ordinary approval of a payroll record doesn’t silently authorize a new payment destination. A late edit is exactly how a reviewed payment file becomes a different payment file.
The Register
Freeze a control record before your money moves. It identifies the legal employer, pay group, pay-period dates, payment date, currency, run identifier, calculation version, employee count, and input-close timestamp. The preliminary register then separates regular earnings, overtime, bonus, commission, leave, and taxable benefits; pretax, statutory, and after-tax deductions; employee withholding and employer contributions; net pay by delivery method; and off-cycle payments, reversals, voids, and year-to-date balances.
Review in triads:
- Expected change — approved hire, termination, rate change, bonus, benefit election, or leave event — must appear in the run.
- Surprise change — new bank account, duplicate bank account, negative or zero net pay, new or missing deduction, or payment to a terminated worker — requires a named explanation.
- Run movement — headcount, gross pay, deductions, employer charges, and net pay versus the prior comparable run — is explained as joiners, leavers, overtime, bonuses, unpaid leave, or correction.
Use both currency and proportional movement, but don’t promote your own review setting into a statutory accuracy threshold.
A reviewer records the exception, supporting record, decision, reviewer, and decision time. “Looks good” isn’t a control artifact. It proves the reviewer could type.
Approval freezes that calculation version. Record the approver, timestamp, run identifier, control totals, and input version. If an input changes after approval, reopen and rerun before payment release, or use an off-cycle or later run.
An off-cycle run still needs a run identifier, calculation, review, approval, payment acknowledgement, liability posting, and remittance treatment. Calling it an advance or a manual cheque doesn’t remove it from cumulative records.
The Exception Log
Don’t ask one payroll total to explain itself.
Reconcile each run by identifier through four boundaries: payroll to cash, payroll to general ledger, payroll liabilities to remittances and authority statements, and payroll to the authority’s accepted data.
“File generated,” “bank accepted,” and “employee paid” are three different states. A rejected deposit changes delivery, not the underlying earnings obligation.
| Person | Scheduled versus observed time | Rate change | Approver | Payment status | Liability | Filing confirmation |
|---|---|---|---|---|---|---|
| Each affected worker | Scheduled hours, daily observed entries, missing punches, overlap, leave, and manual override | Old rate, new rate, effective date, and source evidence | Named approver, decision time, and input version | Instruction created, bank accepted, settled, rejected, reversed, or off-cycle | Withholding and employer contribution by authority, run identifier, and remittance allocation | Authority account or accepted submission matched to register and year-to-date amounts |
Age each exception by count, amount, affected worker, detection date, owner, and status. Keep employee-impacting, authority-impacting, accounting-only, and documentation-only exceptions separate.
A dashboard that says 99.5% accurate can hide an acute underpayment. Conversely, ten rejected test records can make a harmless count look dramatic. The evidence describes the exception before anybody declares it fraud.
The filing boundary is where your confidence gets expensive. In Canada, a T4 Summary compares employee-slip deductions with remittances, and the CRA generally neither charges nor refunds a difference of C$2 or less.
That’s a reporting treatment, not permission to leave an internal variance unexplained. UK PAYE’s Full Payment Submission carries current-period and year-to-date amounts. Compare the accepted submission with the register, not merely the preview screen.
Find the Broken Link
Use the pattern to find your broken stage before you change providers, staff, or tax settings.
Payroll rises with flat headcount, and observed time shows missing punches or recurring manual overrides → time capture or effective-dated pay change is broken
Reconcile expected workers to received time, retain daily entries, inspect the effective date and the old and new values, then isolate the change.
Payroll rises only when a biweekly run crosses a boundary → workweek grouping or pay-code configuration is broken
Preserve the 168-hour workweek and the earning-code attributes rather than testing only the pay-period total.
A corrected payment leaves the register, year-to-date totals, ledger, liability, or filing wrong → correction history is broken
Preserve the original run, link the reversal or adjustment, confirm the additional or recovered payment, amend reporting where required, and reconcile the cumulative record.
Net pay agrees to the payment file but the bank shows a rejected deposit → payment settlement is broken
Keep the payroll obligation open and investigate the delivery exception. Don’t declare success at file generation or bank acceptance.
Contractor invoices rise while the person has a company ID, approved leave, company tools, and recurring identical payments → worker status conflicts with the label
Assess the actual relationship, not the payment channel you chose. In Canada, the CRA examines control, tools, ability to hire assistants, financial risk, investment, opportunity for profit, and the parties’ actual arrangement.
Employees are paid and liabilities posted, but authority receipts or accepted filings don’t agree → the statutory close is broken
Your payment to a provider isn’t government-side confirmation. In common U.S. payroll-service-provider arrangements, you remain responsible if the provider defaults.
The Close
Monday begins with your latest final register.
Match approved time and master-data changes to the register. Match net pay to payment instructions, bank acceptance, and settlement. Match withholding and employer contributions to liabilities and remittance allocation. Match the filing to authority acceptance.
Every difference gets its own row. Don’t net a correction against a missing deposit and call the run reconciled.
Retain your final register, approval evidence, input version, payment acknowledgement, pay statements, remittance allocation, reconciliation, and correction trail. U.S. employment-tax records generally require at least 4 years, and specified credit-support records have a 6-year period. Other jurisdictions can require different retention.
If a record can’t reconstruct the run, it can’t prove the run.
A higher payroll total is a symptom. An evidence chain identifies the cause. A corrected payment fixes cash to one worker. A reconciled run fixes the payroll record.
Separate the roles. Freeze the run. Reconcile every boundary.