When I ask about payroll controls in a small business, I usually get the same answer, delivered as reassurance: "Sandra's done it for fifteen years — never a problem." I understand why it comforts. But listen to what the sentence actually says: one person, unreviewed, undocumented, with full system access, whose error rate is unknown because nobody has ever checked. That's not a control environment; it's a single point of failure with tenure. Payroll governance — the unglamorous architecture of checks around the function — exists to protect three parties at once: the business, the employees, and, genuinely, Sandra herself. Here's what it looks like at SME scale.
Why payroll specifically
Three properties make payroll the highest-stakes routine process in the building. It's where the money moves on a schedule — large, regular outflows with bank access attached, which is why payroll features so prominently in small-business fraud cases (the trusted long-tenured bookkeeper is the recurring character, precisely because trust replaced controls). It's where compliance is densest — awards, super, tax, STP, leave — and errors compound silently across every pay run until an underpayment review prices them in years and multiples. And it's where single-person knowledge concentrates hardest: the quirks, the manual adjustments, the "I just know" classifications. Governance isn't an accusation against the person doing the work. It's the recognition that any system whose integrity depends on one human's perpetual accuracy and honesty is badly designed — and unfair to the human.
The controls that fit a small business
Big-company segregation of duties doesn't map onto a five-person office, but its principle does: no single person should be able to create, approve and pay without anyone else looking. The SME translation:
Separate preparation from approval. Whoever runs the pay doesn't authorise the bank file alone. The owner (or a second person) reviews and releases — and "reviews" means a two-minute scan of the exception report, not a ritual click: headcount this run, gross versus last run, anyone new, anyone terminated, any number that moved oddly. Variance review is the single highest-value control in payroll, and it costs two minutes a cycle.
Control the standing data. The quiet fraud and the quiet error both live in master-file changes — bank account details, pay rates, new employees. Any change to standing data gets second-person sign-off, and a monthly change report (every system can produce one) gets a glance. An "employee" whose bank details changed twice this year is either having a complicated time or is the finding.
Reconcile to something independent. Payroll reports to the general ledger, monthly; STP totals to the BAS labels, quarterly; super liability to what funds actually received — per pay run now, in the payday-super era. Reconciliation is how errors surface in weeks instead of audits.
Document the process and cross-train one deputy. The full run, written as a checklist someone else could follow; a second person who runs it (supervised, then solo) at least twice a year. This is leave cover, resignation insurance, and a control — processes that survive observation by a second person tend to be cleaner processes.
Keep access honest. Payroll system permissions matched to roles, the owner retaining bank authority, former employees and former bookkeepers actually removed. The annual five-minute access review finds something surprisingly often.
The conversation, handled right
Owners delay all of this for one reason: introducing controls feels like accusing the trusted person. Handle it the opposite way — as protection and professionalisation: "Nothing's wrong; we're putting standard controls around every key process, starting with payroll. It protects you as much as us — variance reviews and second sign-offs mean no one can ever question your work unfairly, and documented processes mean you can take real holidays." Every honest payroll person accepts this gladly; many are relieved. The reaction worth noting is strong resistance to oversight of a function someone insists only they can touch — in the case files, that resistance is itself the earliest finding.
Run this way, payroll governance costs perhaps ten minutes a pay run and an afternoon's setup. Against it: wage-compliance exposure measured in years of back-pay, fraud cases that average years before discovery precisely in environments without these controls, and the operational fragility of a function one resignation away from chaos. "Never a problem" is what every business says right up until the audit, the claim, or the unexplained transfer. Governance is how you get to keep saying it — with evidence.
Payroll controls are part of what our free Business Health Check examines. Five minutes to find out what's resting on trust alone.
About the author
Nick Lucock
Chief Executive Officer, Valont
Nick leads Valont's day-to-day operations across Finance, People, Operations and Growth. He writes about how the work actually gets done, the processes, systems, and tools that keep Australian SMEs compliant and growing.
LinkedIn →