Insider risk in payroll is a workflow problem, not a watching problem

A payroll operations centre is an unusual workplace. On any working day, several hundred specialists in our company can see the salaries, tax numbers, bank accounts and home addresses of people who will never know their names. They are trusted with that information because the work cannot be done without it. A pay run that misses a promotion, a resignation or a court order to deduct maintenance harms a real person, and the specialist is the one who prevents it.

That trust is also the risk. When security vendors talk about insider threat, they usually describe it as a detection problem: collect enough signals about what employees do, score the unusual ones and investigate the highest scores. I have sat through many of those presentations, and in 2023 I came close to buying one of the products. I now think that for a payroll business the framing is mostly wrong. The decisive controls sit in the design of a handful of workflows, and in how much of the client base each person can open on an ordinary day. Monitoring has a role, but it is the last line, not the first.

Where one person can act alone

In February 2023 we found that a specialist had changed the bank details of seventeen employees at two client companies in the days before their pay runs. Over two monthly cycles, S$231,400 went to accounts he controlled. An employee whose salary did not arrive told her HR team, who told us. We repaid every affected employee within two working days and reported the matter to the police.

The most uncomfortable finding of our review was not that someone had been dishonest. It was that our process made dishonesty easy. A specialist could receive a bank-detail change by email, enter it and run the payroll that paid it, without anyone else touching the transaction. Our quarterly access reviews had confirmed, accurately, that he held the permissions his role required. The role was the problem.

When I ask other payroll and HR operations leaders where one person can act alone, most can answer within minutes, which tells me the knowledge exists. The list is short. Changing where money goes. Adding a person to a payroll. Changing a pay rate outside an approved file. Approving an off-cycle payment. Exporting a full employee file. For each of those, the useful question is not whether the person doing it is honest. It is whether the workflow needs a second, independent fact before it completes.

We redesigned all five. Bank-detail changes now come only from the employee, through our self-service app with verification, or from a named client HR officer, confirmed by a call to a number we already hold. A change made within three working days of a pay cut-off waits for the following run unless the client approves an exception in writing. New starters added outside an approved client file wait for the same confirmation. Off-cycle payments need a client approval and a second specialist. Full-file exports are disabled for specialists and run only through a scheduled, logged job.

None of this is sophisticated, and all of it slows the work. Clients felt the cut-off change most. One manufacturer with 4,200 employees, many without smartphones, left us at renewal because its workers could no longer hand their bank details to a supervisor on the factory floor. I understand why. We had not designed an assisted route for people without our app, and we built one only afterwards.

Access that expires with the pay run

The second change concerned scope. Before 2023 a specialist in our Malaysian team could open the records of every Malaysian client, roughly 1,600 companies, at any hour. Most specialists worked on fewer than forty. We had granted country-wide access because rotas change, colleagues fall ill and pay runs cluster at the end of the month, and it was simpler to let anyone help.

We replaced that with access that opens for the clients a specialist is rostered to, during the window in which their pay run is prepared, and closes afterwards. Cover for an absent colleague is requested through the same tool and approved by a team leader in minutes. Across our five operations centres the number of standing paths from a specialist to a client's records fell by about 96 per cent.

The objection from our head of payroll operations was serious: a specialist who cannot see a client's history cannot answer that client's question quickly. She was right about the cost. Response times for ad hoc queries rose in the first quarter, and we added a read-only view of the previous three pay runs that opens with a logged reason. The lesson for me was that narrowing access works only when exceptions are quick and visible. A slow exception process teaches people to share credentials, and then a company has lost both the control and the evidence.

What monitoring is still for

I did not, in the end, buy the behavioural scoring product. We do monitor. Every access to a client's records is logged against the assignment that allowed it, and exports, bulk views and access outside rostered hours raise alerts that a small team reviews each day. Those alerts are useful precisely because the workflows are narrow. When most access is expected, the unexpected list is short enough to read.

What I resist is the idea that monitoring can stand in for design. A product that scores keystrokes and the tone of messages tells employees they are suspects, and in a workforce of 1,450 people who handle other people's pay, that message carries a cost in morale and retention that never appears in a vendor's business case. It also tends to look in the wrong place. In our review, nothing in the specialist's behaviour would have seemed unusual, because changing bank details was his job.

There is a regulatory side as well. Singapore's personal-data law expects organisations, and those processing data on their behalf, to make reasonable security arrangements to protect it, and our bank and insurer clients add audit rights of their own. I find it easier to show any of them that a specialist cannot reach most of our clients than to argue that we would have noticed if one did.

For boards, I would put the matter simply. Ask management to list the actions where one person can move money or extract personal data without a second, independent fact. Ask how many people can open each client's or customer's records on an ordinary day, and how that number has changed over a year. Ask how long an exception takes to approve. Those three answers describe insider risk more truthfully than any score, and they point directly at what to fix.