GPC cheat sheet

Payroll operating models: fully centralized (single global team), fully decentralized (country-owned), and hybrid (regional service centers with country specialists); selection hinges on headcount spread, statutory complexity, and data sensitivity.

Four common delivery structures: in-house with local payroll engines, in-house on a global aggregation platform, outsourced to a single global provider, or a managed multi-country model with one contract and local subcontractors.

Build a country complexity scorecard: number of statutory deductions, filing frequency, language requirements, collective agreements, and frequency of legislative change; use it to tier countries into standard versus complex.

Critical-path rule: statutory pay dates drive the calendar, not internal convenience; work backwards from the earliest country pay date to set a global cut-off.

Standardization versus localization: standardize data fields, approval workflows, and reporting; localize calculation rules, payslip content, and filing formats.

Total cost of payroll ownership includes license fees, headcount, bank charges, funding costs, penalty exposure, and internal audit effort - not just the vendor invoice.

Global process ownership model assigns one owner for end-to-end design, with country process experts accountable for statutory accuracy.

Business-case metrics: cost per payslip, payroll accuracy rate, on-time payment rate, cycle time from cut-off to payment, and exception volume per 1,000 employees.

Three-lines-of-defense model: operations owns controls, a risk/compliance function monitors, and internal audit provides independent assurance over payroll.

Segregation of duties rule: the person who maintains master data must not also run payroll, approve payments, or reconcile bank output.

Control types to document per country: input validation, calculation review, four-eyes approval, payment authorization, reconciliation, and statutory filing evidence.

Policy hierarchy: global payroll policy sets minimum standards; country addenda record statutory variations; both must be version-controlled with effective dates.

Regulatory change management: maintain a legislative watch calendar per country, assign an owner, and require documented impact assessment before each pay cycle.

Records retention: many jurisdictions require payroll records for 3–10 years; the global policy must apply the longest applicable local requirement.

Key performance and risk indicators reported monthly: accuracy, timeliness, open incidents, control failures, penalty amounts, and aged unreconciled items.

Delegation of authority matrix defines who may approve off-cycle payments, manual adjustments, and bank detail changes, with monetary thresholds.

Employer obligations typically attach where the employee physically works, even if the contract is governed by another country's law; assess economic employer and permanent establishment exposure.

Statutory employer contributions vary by country and include social security, pension, health insurance, unemployment insurance, accident insurance, and training levies.

Income tax withholding methods differ: cumulative (year-to-date recalculated), non-cumulative (period-by-period), and annualized; the method changes the correction mechanics for retro pay.

Statutory minimums that feed payroll: minimum wage, minimum notice, statutory sick pay, minimum holiday, overtime premiums, and severance formulas.

Collective bargaining agreements and works councils can add binding pay rules beyond statute; payroll configuration must reflect them.

Statutory reporting formats are country-specific (for example electronic filing schemas); each has its own validation rules and rejection handling.

Benefits with statutory treatment include paid annual leave, public holidays, maternity/paternity leave, and mandatory 13th-month or holiday pay in some jurisdictions.

Cross-border remote work creates withholding and social security questions; a documented position per employee location is required before processing.

Gross-to-net sequence: gross earnings → pre-tax deductions → taxable gross → employee taxes → post-tax deductions → net pay; ordering errors change tax outcomes.

Earnings codes should be classified by taxability, social security treatment, pensionability, and whether they are recurring; misclassification is a leading cause of corrections.

Gross-up formula for a target net amount: gross = net / (1 − total marginal deduction rate), applied iteratively when rates are tiered or capped.

Retroactive pay requires reprocessing prior periods under the rules in force then, or a defined correction method; document which approach applies per country.

Wage types: fixed salary, hourly, overtime (often 1.25×, 1.5×, or 2× depending on jurisdiction and timing), shift premiums, commissions, and bonuses.

Benefit deductions (pension, medical, life insurance) must be flagged for pre-tax or post-tax treatment per local tax law, not per global convention.

Off-cycle payments carry distinct approval, funding, and tax-reporting treatment; they should be tracked separately from the regular cycle.

Net pay reconciliation checks: gross total minus deduction totals equals net total, and net total equals the bank file total to the cent.

Shadow payroll records compensation and taxes in the host country without paying the employee there; the home payroll remains the paying entity.

Tax equalization: employee bears hypothetical home-country tax; the company bears actual host tax and any excess. Tax protection instead leaves the employee better or worse off on actual tax.

Hypothetical tax is calculated on home-country rules excluding assignment-related income; it is withheld from the employee and reconciled at year end.

Social security coordination: totalization agreements or EU-style rules determine which country's scheme applies; certificates of coverage must be obtained and retained.

Common assignment pay elements: host housing, cost-of-living allowance, mobility premium, home leave, school fees, and tax reimbursement - each with its own taxability.

Shadow payroll inputs must reconcile to the home payroll and to the assignment letter; a three-way match prevents double taxation and missed withholding.

Year-end reconciliation closes the gap between withheld hypothetical tax and actual liability, producing a settle-up payment or recovery.

Permanent establishment and payroll registration risk rises with assignment length; track days and trigger thresholds per country.

Standard payroll journal: debit salary expense and employer contribution expense; credit net pay payable, tax payable, social security payable, and deduction payables.

Cost allocation splits gross and employer costs to cost centers, projects, or legal entities using documented drivers; allocation must balance to the control total.

The payroll control total is the gross-to-net report total; every GL posting, bank file, and statutory return must trace back to it.

Reconciliation cycle: payroll register vs. GL, GL vs. bank statement, statutory payable accounts vs. filed returns, and accruals vs. actuals.

Accrual rules: record payroll expense in the period earned; reverse and rebook when the pay date falls in the following period.

Aged balance review on payroll clearing and suspense accounts; any item older than one cycle requires an owner and resolution date.

Bank reconciliation matches net pay credits to employee accounts and identifies rejects, returns, and duplicate payments.

Sign-off evidence per cycle: preparer, reviewer, date, control total, variances explained, and exceptions approved.

Master data domains: employee identity, contract, compensation, bank details, tax identifiers, dependents, and organizational assignment; each needs an owner and change rules.

Data quality controls: mandatory fields, format validation, cross-field rules, duplicate detection, and effective-dated changes to preserve history.

Bank detail changes require independent verification (callback or portal confirmation) because payment redirection fraud is a common attack.

Effective dating is essential: a change must apply from its true date, and retroactive corrections must recalculate affected periods.

Interface design: use a defined file specification, reject-and-return error handling, and idempotent loads so a rerun does not duplicate data.

Reporting layers: operational (cycle status), management (cost, headcount, overtime), statutory (filings), and audit (change logs, approvals).

Role-based access with least privilege; production payroll access limited and reviewed quarterly, with logging of all manual adjustments.

Data privacy: payroll data is sensitive personal data; apply purpose limitation, retention limits, and cross-border transfer safeguards.

Selection criteria: country coverage, local statutory depth, integration capability, data security certifications, service levels, exit provisions, and total cost.

Scoring model: weighted criteria with mandatory pass/fail gates (for example data protection certification) before commercial scoring.

Contract elements: scope per country, service level credits, change control, data ownership and return, subcontractor disclosure, audit rights, and termination assistance.

Implementation phases: discovery, design, parallel run, cutover, hypercare, then steady state; each phase needs exit criteria.

Parallel run rule: run legacy and new systems together for at least one full cycle per country and reconcile to the cent before cutover.

Service level examples: payroll delivered on time, accuracy above an agreed threshold, incident response time, and query resolution time.

Governance cadence: weekly operational calls during hypercare, monthly service reviews, and quarterly strategic reviews with the provider.

Exit planning: data extraction format, transition assistance period, and knowledge transfer obligations should be agreed at contract signature.

Cycle calendar design: global cut-off, country input deadlines, calculation windows, review windows, approval gates, payment dates, and filing deadlines.

Exception management: a single intake channel, priority classification, owner assignment, and root-cause tagging for every manual adjustment.

Team structure options: country payroll specialists, regional leads, and a global process owner; span of control and coverage for absence must be defined.

Cross-training matrix ensures every country has a named backup; single-person dependency is a key-person risk.

Change management for payroll projects: stakeholder mapping, training, communication plan, and readiness checks before go-live.

Knowledge management: country procedure documents with screenshots, contacts, statutory calendars, and escalation paths, reviewed annually.

Performance management uses measurable payroll metrics, not attendance; targets should be set per country complexity tier.

Handover discipline during transitions: documented checklist, shadowing period, and sign-off by the receiving team.

Payroll risk register categories: statutory non-compliance, payment failure, data breach, fraud, key-person loss, vendor failure, and system outage.

Fraud controls: segregation of duties, bank detail verification, duplicate payment detection, ghost employee checks, and anomaly reporting on net pay changes.

Business continuity: documented manual payroll procedure, offline copies of registers and bank templates, alternate approvers, and tested recovery time objectives.

Continuity testing should occur at least annually and include a simulated system outage covering one full pay cycle.

Audit readiness: retain calculation evidence, approval records, change logs, filing confirmations, and reconciliation sign-offs for the retention period.

Common audit findings: undocumented manual adjustments, missing review evidence, unreconciled suspense balances, and excessive privileged access.

Incident management: classify severity, notify affected parties and authorities where required, remediate, and record lessons learned.

Penalty and interest exposure should be quantified and reported to management as part of the risk profile.