Resources
Can an HR Manager Change Employee Pay Without Approval?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Many HR readers expect an approval workflow to stop a wrong pay change. It may not. In some HR systems, a person can change pay without approval. This is a segregation of duties question. Can one person both change pay and approve the change? An approval step often covers only one route to the pay field. Another route, such as a direct edit, can skip it. Check every route to the field, not just the policy.
What is segregation of duties?
Segregation of duties means no one person controls a sensitive task from start to finish. For pay, one person asks for a change and a different person approves it. A potential conflict is access that lets one person do both. It is a reason to look closer. It is not proof that anyone did something wrong.
Why can an approval step still be skipped?
An approval workflow only controls the route it is built into. Your system may have several workflows, and each may cover different changes. Say a manager submits a pay change and it goes to a director for approval. That route works as set up. But a role may also let a user edit the pay field and save it right away. That is a second route, and it goes around the approval. Policy documents often show only the first route.
How do I check every route to a pay field?
Pick one field, such as base pay. Then answer these questions.
| Question | Who can answer | What to look for |
|---|---|---|
| Who can ask for a pay change? | HR manager | The roles named in the process |
| Who approves it? | HR manager | A named approver and any limits |
| Who can save a change with no approval? | HRIS administrator | Roles with direct edit, admin or override rights |
| What does the change log show? | HRIS administrator | Who changed pay, when, and whether an approval was recorded |
| What would catch a direct edit? | HR manager and Finance | A monthly review by someone who did not make the changes |
Ask your HRIS administrator to check with an approved test account or a settings report. Do not test on live employee records.
Who does what?
HR decides which pay changes need approval and which safeguards to use. The HRIS administrator or IT confirms what each role can do and makes approved changes. Finance should join in if pay changes flow to payroll or the books. IT should not decide the business risk on HR’s behalf.
What if some direct edits are needed?
Some work is urgent, and some roles need to fix errors. Management can keep a direct-edit right and add a safeguard. Write down who may use the right, how each use is logged, who checks it afterward, and when a temporary right ends. Keep the reason for the decision.
Example (illustrative)
A new hire’s pay change goes to the HR director for approval. Separately, Pat, an HR manager, has a role that can edit pay and save it. Pat has not misused it. But nothing stops a change, and nobody reviews the log. The HR director asks the HRIS administrator for the list of roles that can edit pay. She chooses a safeguard: each month, the Controller or someone in accounting compares that month’s pay changes to the written offer letters, promotion letters or written approvals. This review happens after the fact. It finds a wrong entry. It does not stop one, or stop payroll from paying it. She writes down why she chose it and what the reviewer must check.
Questions people ask
Does an approval workflow stop all direct edits?
Not by itself. It covers the routes it is built into. Whether a direct edit is still possible depends on how your system is set up and what each role can do. Test it with an approved test account.
Should every manager lose edit access?
Not automatically. Match access to the work people must do, and add a safeguard where one is needed.
Does finding a direct-edit right mean someone changed pay improperly?
No. It means the access deserves review. Look at the logs before you draw a conclusion.
Is this the same as a user access review?
No. Segregation of duties focuses on conflicting responsibilities or access. A user access review asks whether access is appropriate more broadly.
Your next step
Map the routes to one pay field with the table above. Use the free How to Find Conflicting Duties: Highlight Conflicts Worksheet to list the pairs of rights that should not sit with one person, the roles that hold them, and which pairs to look at first.
Then read these articles:
- How Do I Find Conflicting Duties in Employee Access?
- What Should I Record After a Segregation of Duties Review?
About SOD Check
SOD Check helps you find where one person may have too much control, so you can decide what needs to change. SOD Check supports HR systems such as Workday, Rippling and ADP. Learn about the Workday review.
Top internal controls and SOX education for growing companies.