4.

The Human Resources Management and Payroll Cycle

The human resources management (HRM)/payroll cycle is a recurring set of business

Activities and related data processing operations associated with effectively managing the
employee workforce. The more important tasks include the following:
1. Recruiting and hiring new employees
2. Training
3. Job assignment
4. Compensation (payroll)
5. Performance evaluation
6. Discharge of employees due to voluntary or involuntary termination.

Tasks 1 and 6 are performed only once for each employee, whereas tasks 2 through 5
areperformed repeatedly for as long as an employee works for the company. In most
companies, these six activities are split between two separate systems. Task 4, compensating
employees,is the payroll system’s primary function. The HRM system performs the other five
tasks. In many companies, these two systems are organizationally separate: The HRM system
is usually the responsibility of the director of human resources, whereas the controller
manages the payroll system. However, as Figure 15-1 shows, ERP systems integrate the two
sets of activities.

HRM/Payroll Cycle Information System

The HRM-related activities (information about hiring, firing, transfers, training, etc.) and the
collection of information about the use of employee time occur daily. Payroll is one
application that continues to be processed in batch mode.
Overview of HRM Process and Information Needs
Organizational success depends on skilled and motivated employees because their knowledge
and skills affect the quality of the goods and services provided to customers. Indeed, in
professional service organizations, such as accounting and law firms, employees’ knowledge
and skills are the principal component of the company’s product, and labor costs represent
the major expense incurred in generating revenues. Even in manufacturing firms, where
direct labor costs represent only a fraction of total direct costs, employees are a key cost
driver in that the quality of their work affects both overall productivity and product defect
rates. Thus, it is not surprising to find that some stock analysts believe that employee skills
and knowledge may be worth several times the value of a company’s tangible assets such as
inventory, property, and equipment.

Figure 15-2 Portion of ERP System That Supports Human Resources Management and
Payroll

To more effectively use employees’ knowledge and skills, many organizations have
invested in knowledge management systems. Knowledge management systems not only serve
as a directory identifying the areas of expertise possessed by individual employees, but also
capture and store that knowledge so that it can be shared and used by others. Knowledge
management systems can significantly improve productivity. For example, professional
consulting firms often provide similar services to many different clients. Knowledge
management software enables consultants to store their solutions to specific problems in a
shared database. Oftentimes, those solutions can be used as a template to address the needs of
other clients. Such reuse of knowledge saves time on future engagements. Access to the
shared database also enables employees to learn from geographically dispersed colleagues
who have had prior experience in addressing a particular issue.
Recognizing the value of employees’ knowledge and skills can help companies better
understand the true costs associated with excessive turnover. In addition to the direct
expenses associated with the hiring process (advertising, background checks, interviewing
candidates, etc.), there are also the costs associated with hiring temporary help, training new
employees, and the reduced productivity of new employees until they fully learn how to
perform their tasks. Thus, estimates place the total costs to replace an employee at about 1.5
times the annual salary. Consequently, organizations that experience below-industry-average
turnover rates reap considerable cost savings compared to rivals with higher turnover rates.

Threats and Controls

Figure 15-2 shows that all HRM/payroll cycle activities depend on the integrated database
that contains information about employees, payroll, and use of employee time. Therefore, the
first general threat listed in Table 15-1 is inaccurate or invalid master data. Inaccurate
employee master data could result in over- or understaffing. It can also create inefficiencies
due.

Table 15-1 Threats and Controls in the Payroll/HRM Cycle

Activity Threat Controls (first number refers to the

corresponding threat)
General issues 1. Inaccurate or invalid 1.1 Data processing integrity
throughout entire master data controls
HRM/payroll 2. Unauthorized disclosure 1.2 Restriction of access to master
cycle of sensitive information data
3. Loss or destruction of 1.3 Review of all changes to master
data data
4. Hiring unqualified or 2.1 Access controls
larcenous employees 2.2 Encryption
5. Violations of employment 3.1 Backup and disaster recovery
laws procedures
4.1 Sound hiring procedures,
including verification of job
applicants’
credentials,
skills, references, and employment
history
4.2 Criminal background
investigation checks of all
applicants for financerelated
 positions
5.1 Thorough documentation of
hiring, performance evaluation, and
dismissal
procedures
5.2 Continuing education on
changes in employment laws
Update payroll 6. Unauthorized changes 6.1 Segregation of duties: HRM
master data to payroll master data department updates master data, but
7. Inaccurate updating of only
payroll master data payroll department issues paychecks
6.2 Access controls
7.1 Data processing integrity
controls
7.2 Regular review of all changes to
master payroll data
Validate time and 8. Inaccurate time and 8.1 Source data automation for data
attendance data attendance data capture
8.2 Biometric authentication
8.3 Segregation of duties
(reconciliation of job-time tickets to
time cards)
8.4 Supervisory review
Prepare payroll 9. Errors in processing 9.1 Data processing integrity
payroll controls: batch totals, cross-footing
of the payroll
register, use of a payroll clearing
account and a zero-balance check
9.2 Supervisory review of payroll
register and other reports
9.3 Issuing earnings statements to
employees
9.4 Review of IRS guidelines to
ensure proper classification of
workers as
either employees or independent
contractors
Disburse payroll 10. Theft or fraudulent 10.1 Restriction of physical access
distribution to blank payroll checks and the
of paychecks check
signature
machine
10.2 Restriction of access to the
EFT system
10.3 Prenumbering and periodically
accounting for all payroll checks
and
review
of all EFT direct deposit
transactions
 10.4 Require proper supporting
documentation for all paychecks
10.5 Use of a separate checking
account for payroll, maintained as
an
imprest
fund
10.6 Segregation of duties (cashier
versus accounts payable; check
distribution
from hiring/firing; independent
reconciliation of the payroll
checking
account)
10.7 Restriction of access to payroll
master database
10.8 Verification of identity of all
employees receiving paychecks
10.9 Redepositing unclaimed
paychecks and investigating cause
Disburse payroll 11. Failure to make 11.1 Configuration of system to
taxes and required make required payments using
miscellaneous payments current
deductions 12. Untimely payments instructions
13. Inaccurate payments from IRS (Publication Circular E)
12.1 Same as 11.1
13.1 Processing integrity controls
13.2 Supervisory review of reports
13.3 Employee review of earnings
statement

Payroll Cycle Activities

Update Payroll Master Database

Figure 15-3
Context Diagram of the Payroll Portion of the HRM/Payroll Cycle
 Figure 15-4
Level 0 Data Flow Diagram for the Payroll Cycle
Process Figure 15-2 shows that the HRM department is responsible for updating the payroll
master database for internally initiated changes related to employment, whereas the payroll
department updates information about tax rates and other payroll deductions when it receives
notification of changes from various government units and insurance companies. Although
payroll is processed in batch mode, the HRM department has online access to update the
payroll master database so that all payroll changes are entered in a timely manner and are
properly reflected in the next pay period. Records of employees who quit or are fired should
not be deleted immediately, however, because some year-end tax reports, including W-2
forms, require data about all employees who worked for the organization at any time during
the year.
Threats and Controls Unauthorized changes to payroll master data (threat 6 in Table 15-1)
can result in increased expenses from unjustified payments to employees. Proper segregation
of duties (control 6.1) is the key control procedure for dealing with this threat. As shown in
Figure 15-2, only the HRM department should be able to update the payroll master file for
hirings, firings, pay raises, and promotions. HRM department employees in turn should not
directly participate in payroll processing or paycheck distribution. This segregation of duties
prevents someone with access to paychecks from creating fictitious employees or altering pay
rates and then intercepting those fraudulent checks. In addition, all changes to the payroll
master file should be reviewed and approved by someone other than the person
recommending the change. To facilitate this review, the system should be configured to
produce a report listing all payroll-related changes and send the report to each affected
department supervisor for review.
Controlling access to the payroll system (control 6.2) is also important. The system should be
configured to compare user IDs and passwords with an access control matrix that (1) defines
what actions each employee is allowed to perform and (2) confirms what files each employee
is allowed to access.
Another threat is inaccurate updating of payroll master data, which can result in errors in
paying employees and fines for not remitting proper amounts of payroll taxes to the
government. To mitigate this threat, appropriate processing integrity controls discussed in
Chapter 10, such as validity checks on employee number and reasonableness tests for the
changes being made, should be applied to all payroll change transactions (control 7.1). In
addition, having department managers review (control 7.2) reports of all changes to
employees in their department provides a timely way to detect errors.

Validate Time and Attendance Data

Process How employee time and attendance data is collected differs depending on the
employee’s pay status. For employees paid on an hourly basis, many companies use a time
card to record the employee’s daily arrival and departure times. Employees who earn a fixed
salary (e.g., managers and professional staff) seldom record their labor efforts on time cards.
Instead, their supervisors informally monitor their presence on the job. As discussed in
Chapter 14, manufacturing companies also use job-time tickets to record detailed data about
how employees use their time (i.e., which jobs they perform). The job time ticket data are
used to allocate labor costs among various departments, cost centers, and production jobs.
Professionals in such service organizations as accounting, law, and consulting firms similarly
track the time they spend performing various tasks and for which clients, recording that data
on time sheets (see Figure 15-5 for an example of a data entry screen to track time). Their
employers use the time sheets to assign costs and accurately bill clients for services provided.