Payroll a school can defend: who runs it, who approves it, who files

The risk is not fraud. It is that nobody can reconstruct it

Ask a school office to reproduce last April's salary run and you usually get a spreadsheet that has been edited since, a bank file nobody kept, and a set of deductions somebody remembers deciding. Nothing dishonest happened. But nothing can be demonstrated either — and payroll is precisely where a trustee, an auditor or a departing employee will ask you to demonstrate.

The controls below are unremarkable in any organisation that pays people. They are worth writing down because schools tend to run payroll as an extension of the HR register, where none of them exist by default.

Four separations that do the work

1. Preparing a run is not approving it. The person who computes the salaries must not be the person who marks them paid. This is the single control that most cheaply prevents both error and temptation, and it costs nothing but a second login.
2. Editing the staff directory is not running payroll. An HR clerk who maintains records, leave and documents does not need the right to compute or disburse salary. Two permissions, not one.
3. Approving a run is not releasing the money. The bank disbursal is a separate act with its own approval, because that is the step where money actually leaves.
4. Changing a bank destination is its own controlled event. The classic payroll fraud is not a fake employee; it is a real employee whose account number changed last week. Re-verify the new destination, notify the employee through a channel other than the one that requested the change, and let the change sit before it is usable.

Lock the run, then derive everything from it

A payroll run is a point-in-time statement: these people, these components, these deductions, this month. Everything downstream — payslips, the provident-fund file, the insurance contribution file, the annual tax statements — has to be derived from that frozen statement rather than recomputed later from current data.

The reason is concrete. An employee's salary changes in September. If the annual tax worksheet is computed from today's salary rather than from what each locked run actually withheld, it will disagree with the payslips the employee already has. Whichever number you defend, one of them is wrong.

Where software stops

This boundary is worth being blunt about, because it is the one most often blurred in a sales conversation.

• Software can compute the withholding, produce the payslip, and generate the upload file in the format the portal expects.
• Software can keep the evidence — what was deducted, from whom, in which month, under which participation setting.
• Filing is a school action. Submitting on the provident-fund, insurance or tax portals, paying the challan and holding the acknowledgement is done by your finance team with your credentials. A vendor claiming to file returns for you is claiming something you should ask to see performed.

How this works in Vidyapeeth360

Payroll is its own permission, separate from the staff directory — an HR clerk can maintain records without being able to run or release salary. The person who creates a run cannot mark it paid, and disbursing through a bank batch requires a separate approver again, so no single account both computes and releases.

Destinations are verified before money can move: a payout account is confirmed by a small-value check with a mandatory name match, and an account that fails the match cannot be paid. A change to an existing destination re-enters verification, notifies the person through an independent channel, and waits out a cooling-off window before it is usable — the sequence exists specifically for the fraud pattern where a real employee's account is quietly replaced.

Tax withholding is computed month by month with a remaining-months true-up rather than a flat twelfth, and the run stores what it actually withheld along with the statutory participation in force at the time. The provident-fund and insurance files, the payslips and the annual tax statements all derive from those locked runs, so they agree with each other and with what the employee was paid.

On settlement, the bank reference is captured against each line, the run is marked paid only when its items have actually settled, and the accounting entry posts the full picture — salary cost at gross, bank at net, and the withheld amounts as liabilities — rather than a net-only entry that understates the cost. A reversal posts a compensating entry rather than erasing the original, and a run cannot be dated into a closed accounting period. The payroll workspace, the staff register and the accounting reports therefore reconcile without a manual bridge.

Payroll never pays itself. Filing stays with your team, and the platform's contribution is that every figure it hands you can be traced back to a run somebody approved.