System Essentials

These days there are standards for everything, for buildings, for labelling foods, for technology, and so on. The British Standards Institute (BSI) produces and maintains some 36,000 British, European and international standards in conjunction with manufacturing and service industries, businesses and governments. Among these standards is BS7799, the British Standard Code of Practice for Information Security Management, which defines the arrangements that all organisations should have in place to protect their computer systems and the business-critical information they contain. Payroll processing is a business-critical system and deserves the full protection defined by BS7799. Organisations can obtain accreditation that their security arrangements meet the BS7799 standards through the c:cure scheme offered by DISC, a department of the BSI. It would not be unreasonable to expect your payroll developer or service provider to have c:cure certification.

Accreditation is also a feature of the UK IT Security Evaluation and Certification Scheme (ITSEC for short). This scheme evaluates computer products and certifies those that meet a range of security criteria. Among these products are a number of databases and operating systems that are commonly used for payroll and personnel systems. If you are looking for a new system, you should include ITSEC certification in your statement of requirements.

Knowing that a product or service meets a defined standard is reassuring. When you are looking for a new payroll system, you should properly be concerned that those under consideration offer the functionality you require. Often forgotten in a statement of requirements, however, is the need for the system to calculate tax and national insurance correctly. Are there standards for payroll systems, both in terms of the functionality they offer and their compliance with legislation? Yes there are.

Payroll Specifics

First, there are the well-established standards defined by the IMIS Software Evaluation Service. These have been developed over more than ten years in conjunction with the Inland Revenue, representatives of payroll suppliers and user groups.

They are defined at three levels: (1) minimum standards, (2) additional standards for SSP and SMP, and (3) full standards.

The standards cover all aspects of payroll processing, i.e. tax, NICs, SSP and SMP and year-end reporting, and more general functionality such as pay periods, additions and deductions, court orders, tax credits, handling starters and leavers, data validation and security. As would be expected, the requirement for all calculations to be accurate is included, and IMIS provide test data and expected results so that suppliers and users can check for accuracy. Suppliers of payroll systems can achieve accreditation under the scheme by submitting acceptable test results and, in the case of the full standards, undergoing further on-site tests. Once accredited, the supplier's details are published in a Register and the supplier can use the scheme's logo in its promotional material. The Register currently lists fifteen suppliers with systems meeting the minimum standards, eight of whom also meet the additional SSP and SMP standards. There are a further three suppliers with systems satisfying the full standards, with a further three in the pipeline.

Revenue requirements

Secondly, in March this year the Inland Revenue published its own set of Payroll Standards. They are a part of the Revenue's new services aimed at supporting small and new employers with their payroll requirements. If the Revenue meets its timetable, which appears increasingly unlikely, an accreditation process will begin in the "early summer" with the objective of listing most leading software systems by the start of the next tax year. The names of those suppliers with accredited systems will be circulated to new and small businesses, providing reassurance that their payrolls will operate legally and accurately.

There are some important differences between the Revenue's standards and those defined by the IMIS Software Evaluation Service. One is a matter of concept. The Revenue's standards concentrate on the ability of a system to handle PAYE, NICs and other statutory payments and deductions, and to make the necessary returns. In contrast, the IMIS standards are not always so specific in defining the tax and NICs calculations, but include functionality that is necessary for the total payroll operation, e.g. pay elements and non-statutory deductions, payroll re-runs, posting to an accounts system, payslip history, enquiry facility, access security and audit trail. In general, therefore, the Revenue standards concentrate on statutory compliance and the IMIS standards concentrate on payroll as a business function.

Another significant difference between the two sets of standards is the Revenue's requirement that an accredited payroll system must be able to (1) exchange data electronically using Electronic Data Interchange (EDI) or over the Internet, and (2) provide for electronic payments to the Collector. These requirements are clearly part of the Revenue's electronic business strategy, but go well beyond the capability of many existing payroll systems. However, they provide a clear statement of the Revenue's view of the future.

The Revenue has not yet announced how the accreditation process will work for these new standards, except that it will involve a formal testing process. Although the IMIS Software Evaluation Service, with its considerable expertise and understanding of payroll systems, tendered for the work, it is understood that the Revenue has decided to undertake the testing internally. To support the standards, the Revenue has published comprehensive test data covering a wide range of situations that arise in calculating tax, NICs, SSP and SMP, student loan deductions, and aggregation of earnings. These will help developers and users to check the accuracy of their systems.

Advice for users

How can these standards help you if you are looking for a new payroll system or service? The statement of requirements incorporated in an Invitation to Tender must be as comprehensive as possible, but suppliers often comment that prospective clients tend to concentrate on additional functionality and assume that the payroll will do all of the basics. That is a dangerous assumption. It would be better to include a requirement that the payroll system or service under consideration meet both the full standards of the IMIS Software Evaluation Service, and the Inland Revenue's payroll standards. This should ensure that all of the basics are met and allow the statement of requirements to focus on the additional functionality that you have identified as critical to your payroll operation.

There are currently only three suppliers with accreditation at the IMIS full standards, although others are working through the process. There is no certainty as to how many suppliers will obtain Revenue accreditation, although the general view is that most will feel it essential to be able to display the Revenue's "kitemark" on their promotional materials. The supplier has to pay for the accreditation process and this may deter some of the smaller suppliers. On the other hand, the major payroll suppliers have not sought IMIS accreditation on the basis that their systems and services well exceed the full standards. Whether they will take the same line with the Revenue's standards remains to be seen.

It does not follow, therefore, that, if a supplier's product is not accredited under one or both of the sets of standards, the product does not meet those standards. However, if a prospective supplier's tender states that the system or service meets both sets of standards, even though the supplier has not gone through the accreditation process, there is a clear benchmark against which you can measure the product's performance.

Must haves

From one perspective, the two sets of standards define the essentials of payroll processing. There is no doubt that every reputable payroll system or service must meet those basic standards. However, what is really "essential" to any organisation must go beyond the basics. In preparing your statement of requirements, it is vital to identify your organisation's present and future demands from the payroll operation, as detailed in the article "Catching the dream" in the January 2000 issue of Pay Magazine. Here are some areas of functionality to consider: full automation of court order deductions and tax credit payments>

• automated P45 checking
• comprehensive report-writing facilities
• net-to-gross calculation
• splitting net pay
• currency conversion and multi-currency payslips
• retrospective pay
• user-definable audit trail reporting
• integration with related systems, including HR, ledgers, time and attendance
• use of workflow techniques to streamline processes
• use of the payroll system over the Internet
• direct access to payroll information by managers and employees, using Intranet and kiosk technology

Contact information

DISC: 020 8995 7799, http://www.bsi.org.uk/disc
ITSEC: 01242 238739, http://www.itsec.gov.uk
IMIS Software Evaluation Service: 0118 934 5262
Inland Revenue Payroll Standard Unit: 0845 91 59146, http://www.inlandrevenue.gov.uk/ebu/payroll.htm>

Thanks to Carval Computing, Snowdrop Systems and Rebus software for their contribution to this article.