Nobody should be able to run payroll alone
Separation of duties is not bureaucracy. It is the control that makes payroll fraud hard, and most HR software quietly skips it.
Apex Product · 22 October 2026 · 4 min read
In a lot of HR software, one person with the right role can prepare a payroll run, approve it, and mark it paid. That is not a feature. It is a single point of failure with a salary attached.
Three roles, three people
A payroll run in Apex moves through three hands:
- HR prepares it. Attendance shortfall, unpaid leave, claims, allowances and recoveries are pulled together into a draft.
- An executive approves it. They see the totals and the exceptions, not a single netted figure.
- Accounts disburses it against a bank reference.
None of those steps can be done by the person who did the previous one.
Bank details are the real target
Payroll fraud rarely involves changing an amount. It involves changing where the money goes. So a salary bank-account change needs three different people: the employee requests it, HR verifies the proof, and Accounts clears the banking details. The requester can never sign their own, whatever role they hold.
Why the exceptions stay visible
A payslip that shows one net figure hides the interesting part. Attendance shortfall, unpaid leave and tax appear as separate lines, so an employee can see why a number changed and raise it before it becomes a grievance.
The second gate
Payroll, bank details and the credentials vault need a Financial Security PIN as well as a password. It is not a second password for everything — that would just train people to type it everywhere. It is a gate on the handful of places where the consequence of a borrowed browser session is money leaving the company.