Hiding is not an option when it comes to getting through a disaster. Dave Cooper, Managing Director at payroll bureau ESOS, explains why data security and disaster recovery must be considered a priority when outsourcing payroll.
Payroll is an area that is ideally suited to outsourcing. Not only does it remove payroll from the list of administrative duties, but it also allows valuable resources to be directed at more productive and profitable tasks. In fact most organisations would benefit from moving their payroll as a fixed cost to a variable one under an outsourcing arrangement.
For many businesses, the ever-increasing burden of the payroll process has become very problematic. With overtime payments, bonuses, tax calculations, National Insurance Contributions and the hassle of correcting errors to consider, not to mention the penalties from the HMRC for getting it wrong, it’s an administrative headache that many could gladly do without. Couple this with the complexities of maternity and paternity pay, and the increasing popularity of flexible working and job sharing schemes, it’s little wonder that firms choose to outsource.
Expertise and Resources
The major benefit of opting for a fully managed outsourced service is the level of expertise and resources provided by the third party. As specialists in payroll they are able to keep up-to-date with legislation, market trends and technology more easily than individual organisations can. Moreover, because the provider has a support team of skilled professionals to call on, the payroll operation is no longer vulnerable to the impact of holidays, sickness, training for new legislation, recruitment difficulties, the impact of maternity leave, limited office space, loss of skilled staff, career progression problems, and so on.
However, despite all the many benefits that outsourcing inevitably provides, many companies have been reluctant to dip their toes into the outsourcing arena. This may be due to a fear of losing control or handing over sensitive employee information to a third party. HR files contain a huge amount of personal information about employees, from salaries to working patterns and payment structures, and organisations need to be sure proper safeguards and security technologies are in place to protect the privacy of their employees.
Shifting the burden to an external source is not the proverbial silver bullet for every organisation, but firms need to consider other areas in which the outsourcing trend can help them strategically in their business; simply stressing the cost saving benefits is not enough to encourage some firms to outsource. Instead they need to be appealed to on other levels such as security.
Securing the Payroll
One area that is notably overlooked is the need for a disaster recovery strategy in case of an emergency, and the ability to keep the payroll process running smoothly, with limited impact on the business and its employees, should such an event take place.
Payroll is often an overlooked area of business continuity, yet should be considered as the highest-priority item on any disaster recovery list. After all, it is typically the biggest single expense for most businesses. Small business owners may assume that their employees hold a level of dedication to the business that is higher than the actual reality. They may assume that employees will continue to work without pay during or after a disaster out of a sense of loyalty. However, this assumption is often proven to be unrealistic. This doesn't imply that employees are not loyal to their employer, but is offered as a reminder that when disaster strikes and the payroll function is hit, most employees will consider the needs of their families first.
Most people live in a ‘just-in-time’ pay cheque lifestyle, and cannot go without a pay cheque for even one pay cycle without starting to experience difficulties with meeting life's numerous financial requirements. Just as employers should not rely on employee goodwill in the face of a financial hardship that may result from an unexpected disaster, employees should not assume that their creditors will be forgiving when unable to meet financial obligations due to a lack of pay.
Recovering from the Unthinkable
Almost total dependence on computer systems is a feature of modern business life. However, the greater the dependence on computers, the greater the risk of damage to the business when they fail.
Have you considered how you would address a crisis? Is your business prepared for the unthinkable? Have you ever considered the exposure you have from sensitive employee payroll information being stored on a computer in your office? What if the computer goes down due to a hardware malfunction? Or even more critical, what if someone steals the computer, or files from that computer? How secure is your employee’s information from theft, or accidental leaks?
Disasters come in many different forms, not just incidents such as fire and floods, they can also result more commonly from power cuts and IT system shut downs due to viruses, system failures or hacking attacks. In the event of an emergency happening the need to reconstitute the payroll data is often expensive and time consuming to do in-house.
Many organisations make the recovery process even harder for themselves - or even impossible - by not planning ahead for disaster recovery. While they may take steps to try to prevent disasters, they ignore the reality that prevention may not always work - a serious disruption or failure always happens when you least expect it!
No matter what term you use – ‘Disaster Recovery’, ‘Business Continuity Planning’ or ‘Crisis Management’ - it is now more important than ever for organisations to have a contingency plan in place in the event of a catastrophic occurrence.
No one likes to imagine worst-case scenarios, but there are many things that organisations can do to plan their HR and payroll for a catastrophic disaster or unexpected event. Experience shows that few companies have adequate backup procedures in place for their payroll information, and this is a fine line to tread, especially when the entire company payroll is at stake.
The Plan in Action
When choosing a payroll provider, organisations should ask about the disaster recovery plan and how often it is tested. Are back-ups taken at critical points in the processing cycle, i.e. just before the payroll is run and then just after? How long are the back-ups stored and where are they stored? Are critical pieces of hardware such as computers, servers and printers all duplicated at a secure, remote site? When the payroll software is updated for legislative changes is there a plan in place to ensure the recovery applications are updated as well? How long does it take for the recovery site to be up and running? In a payroll environment, 24 hours is too long if disaster happens on the day the BACS file has to be sent.
Nearly all suppliers work with tried and tested systems that are replicated at a disaster recovery site away from the main processing office. Should a failure take place they should be able to move to the recovery site almost immediately and continue from the point of shut down. This should cause minimal disruption to the organisation as they return to normal business operations.
Data backups that occur at regular intervals during the day normally support this; allowing suppliers to restore the system to the last back up. This means the data can be reconciled almost immediately and no more than a couple of hours work should have to be re-keyed into the system. Daily back-ups are usually retained for one week, weekly for six weeks and monthly back ups are retained for 12 months. A year-end back up should also be taken and retained as per the HMRC guidelines to safeguard payroll data.
Test, Test, Test
The process of producing a continuity plan ready for a disaster is probably as important as the plan itself; and its benefits will be evident even if the plan is never needed. Much like the so-called ‘Millennium Bug’ in 2000, business-continuity planning requires that both the client and provider work together to assess potential risk and prioritise HR and payroll tasks that could be affected.
The best time to coordinate the disaster recovery plan is at the implementation stage.
An experienced provider should be able to make recommendations to the client regarding business continuity planning for the processes that lead up to the point of submission of time-sensitive payroll data to the bureau. How will the overtime be compiled if the client’s own systems go down? How will starter and leaver information be transmitted if there is a power cut at a critical time? The planning process should document exactly how these possible scenarios will be addressed should they occur at a critical time in the payroll cycle.
Having well-managed processes that include full and incremental backups of payroll data and that utilise offsite storage is, however, no indication that a company is ready for a disaster. If the plan sits on a shelf, it does no good. Testing the payroll provision should be seen as an ongoing project and a responsibility that must be taken seriously. If backup systems have never been tested, they may not work at a critical recovery point, and data may not be restored. If the payroll process is not routinely tested, what price might the company pay in the event of a disaster?
Outsourcing has often put off many firms, as they believe it is an expensive option. Yes there are some minimum charges but the cost of investing is typically much less than the cost of trying to recover from an unplanned disaster. If things go very wrong, the cost to the organisation’s reputation cannot be underestimated.
Weather the Storm
Even with proper planning and focus on the right business priorities, the road to recovery from a crisis is still a difficult one to tackle. But, sound disaster recovery/business continuity plans combined with the right outsourcing supplier can provide a clear path forward to get the business functioning properly again. It is more professional to anticipate problems and consider what actions could be taken than to just "think on your feet" when something does go wrong.
Planning for the unexpected is a reality every organisation must embrace, especially in the case of payroll and the effect it could potentially have on its employees.
As many companies have found out, outsourcing payroll can save a significant amount of money and free up their staff members to provide more value-added services to the company.
But perhaps more importantly, payroll providers can also help companies weather unexpected storms - either those created by inefficient business processes or natural storms brewed up by Mother Nature.