Governance and Compliance
Governance and Compliance covers the control framework that makes multi-country payroll defensible to auditors, regulators and the board. The exam tests whether you can assign accountability, define controls, evidence their operation, and show how regulatory change is captured before it becomes a penalty.
The governance stack
- Policy: global payroll policy, data retention, approval authority, payment controls, expense versus pay definitions.
- Accountability: process owner (end-to-end), control owner (performs and evidences), country owner (statutory accuracy). Documented in a RACI.
- Three lines model: operations (first line), risk and compliance oversight (second), internal audit (third). Payroll sits in the first line and does not audit itself.
- Segregation of duties: whoever creates or changes master data must not also approve, release payment or reconcile the account.
- Compliance calendar: every statutory filing with owner, deadline, evidence and penalty exposure.
Regulatory change management
Maintain a change log fed by provider bulletins, local advisors and government alerts. Each item needs an impact assessment, configuration change, testing evidence, communication and effective date. Undocumented change is the most common audit finding in global payroll.
Worked example
A payroll analyst can create a new hire, change bank details and release the payment file. Reasoning: this is a classic segregation-of-duties conflict, because one actor can divert funds. The fix is not simply a second review of the file; it is to separate master-data entry from approval, enforce dual authorisation on bank-detail changes with independent call-back verification, and add independent reconciliation of payments to the register. Evidence would be the system role matrix, the approval log and the monthly reconciliation sign-off.
Traps that cost marks
- Claiming the provider's SOC 1 report covers your control environment. It covers theirs, for a defined scope and period only.
- Treating a written policy as a control; auditors want operation and evidence.
- Leaving regulatory change unowned on the assumption that the provider handles it.
- Confusing monitoring (dashboards, KRIs) with assurance (independent testing with samples and conclusions).