Restrict a payroll group to specific HR users

When to use this

A common setup is one HR officer per plant, cycle or principal. For example:

• Branch or plant HR who handles payroll for one site only, and should not see or process employees from the other sites.
• Split HR by payroll cycle on the same company, for example one HR officer on the monthly head-office group and another on the daily plant group, each blind to the other's register.
• Confidential payroll, such as executive pay, that should not appear on the general HR officer's register or reports.

The mechanism is the payroll group's access list. Put each employee on the right group through their contract, then restrict the group to the HR officer who runs it.

Before you start

• The groups must exist. See Create a payroll group.
• Each employee's current contract must point to the correct group. The Payroll Group field is on the contract, not the employee record.
• The HR officer must already be a user. See Set up roles and permissions.
• You need the payroll settings permission to open the page.

Open the access list

1. Go to Settings, then Payroll, then Payroll Groups.
2. On the group card, select the lock icon in the footer. The dialog is titled Access: group name.

A group with the icon shown in warning colour is already restricted. A group with the icon in grey is open to anyone with the payroll permission.

Restrict the group

1. Turn on Restrict this payroll group. The Users and Roles lists become active.
2. In Users, pick each person who should see the group. Hold Ctrl, or Cmd on a Mac, to pick several.
3. In Roles, pick each role whose holders should see the group. Anyone in a listed role gets access.
4. Include yourself or one of your roles. The page refuses to save otherwise, because you would lose access to the group you just locked.
5. Select Save.

The dialog is explicit about what restriction does: "A restricted group is visible only to the people and roles below. Others do not see it in the Pay Register, approvals, reports, files or the payslip API, and it is not counted in their totals. There is no administrator bypass."

Pick users when a named individual owns the group. Pick a role when the access should follow the role, not the person. A role is the better choice when you expect turnover: swap users in the role and the access follows.

Lift the restriction

Open the dialog, switch Restrict this payroll group off and save. The warning icon goes back to grey and the group is visible again to anyone with the payroll permission.

What a restricted HR officer sees

• Pay Register: periods and runs for allowed groups only. Totals exclude the hidden groups.
• Payroll approvals: nothing from a hidden group reaches the queue.
• Payroll reports and the payslip API: hidden groups are left out of the row set.
• Bank files: generated per run, so a run in a hidden group is not offered.
• Employee pay history on the employee record: payslips from a hidden group are not shown.

The audit log records every change to the access list, so you can see who restricted which group and when. See View the audit log.

Worked example: a plant-based HR officer

A Plant HR should see one plant's employees only, not the whole company masterlist.

1. Create a payroll group for the plant, with its cutoff schedule.
2. Open each plant employee's active contract and set Payroll Group to the plant's group.
3. On the group's Access dialog, turn on Restrict this payroll group, add the Plant HR as a User and add yourself (or your Admin role), then save.

From the next sign-in, the Plant HR sees only that plant's pay register, approvals, reports and bank files. The head-office HR continues to see every other group as before.

Related

• Create a payroll group
• Set up roles and permissions
• Set up an employment contract
• View the audit log