The Payroll System Migration and the Missing Records
Chui Manufacturing is migrating its payroll from an on-premise system to a cloud provider. The IT manager proposes a 'big bang' cutover over a single weekend, with the old system decommissioned immediately to save KES 900,000 in licence fees. There is no documented data-mapping between old and new salary structures, and the migration will be done by a single contractor who is also the only person who understands the interface. The finance director is concerned because payroll for 1,200 staff runs on the 25th and the cutover is scheduled for the weekend of the 20th. The contractor has offered to 'test it live' on the first payroll run. There is no data backup taken since the previous month, and the payroll contains bank account details for all staff.
1. Identify the IT and control risks in the proposed migration and recommend a safer approach.
Read the worked answer
Risks identified.
- Big-bang cutover: A single weekend with no fallback concentrates all risk; if it fails, the 25th payroll is missed for 1,200 staff.
- No documented data mapping: Salary structures, deductions, statutory rates and bank details may be mapped incorrectly, producing wrong pay and compliance failures.
- Single point of knowledge: One contractor holds all interface knowledge; if unavailable, no one can fix a failure.
- Testing live: 'Testing' on the first real payroll is not testing - errors reach employees and statutory returns.
- Premature decommissioning: Removing the old system before the new one is proven eliminates the fallback and saves only KES 900,000 against the cost of a failed payroll.
- Backup gap: No backup since the previous month means a failure could destroy a month of data.
- Data protection: Bank details of 1,200 staff are sensitive personal data; migration to a cloud provider raises security and legal obligations (access controls, encryption, data-processing agreement).
Recommended approach.
- Phase the migration: run old and new systems in parallel for at least one full payroll cycle; compare outputs line by line.
- Document the data mapping and have it reviewed by finance, not only IT.
- Test in a sandbox with dummy data, including edge cases (leavers, arrears, statutory caps).
- Take a full backup immediately before cutover and verify restoration.
- Retain the old system until two clean parallel runs; the KES 900,000 saving is trivial against payroll risk.
- Second the contractor's knowledge: require documentation and a handover to an internal staff member.
- Put a data-processing agreement and security controls in place with the cloud provider.
2. Explain the controls you would require before the first live payroll on the new system, and how you would handle the backup and data-protection issues.
Read the worked answer
Pre-go-live controls.
- Reconciliation: a full parallel run where old and new system totals for gross pay, statutory deductions (PAYE, NSSF, NHIF), net pay and bank transfers agree to the shilling; any difference investigated and signed off.
- Segregation of duties: the person who runs the payroll must not also approve it or alter bank details; a second authorised reviewer signs off the payment file.
- Change control: all migration scripts and mappings version-controlled and approved.
- Access control: role-based access to the new system, with the contractor's access time-limited and logged.
- Audit trail: the system must log who changed what and when, retained for audit.
- Rollback plan: a tested procedure to revert to the old system within the payroll window.
- User acceptance sign-off: finance director and HR sign off before the first live run.
Backup. Take a full, verified backup before any migration step; store a copy offline/off-site; test that it restores. Do not rely on a single copy held by the contractor.
Data protection.
- Encrypt staff bank details in transit and at rest.
- Sign a data-processing agreement with the cloud provider covering confidentiality, breach notification and deletion on exit.
- Restrict access to bank details to named payroll staff.
- Notify staff of the change where required and keep a record of processing.
- Ensure the provider's location and sub-processors are known and acceptable under applicable data-protection law.
Timing. If these cannot be completed before the 20th, postpone the cutover by one payroll cycle. A delayed migration is recoverable; a failed payroll is not.