Start here
Five rules for a safe first handoff
- Give the assistant preparation work, not payment authority.
- Require source evidence for every employee or bank-detail change.
- Keep named company owners for approvals, funding, and release.
- Reconcile the approved register against the final output.
- Remove access and return open items through a written exit list.
Task map
Split admin work from owner decisions
| Work lane | Philippines team | Company owner | Useful check |
|---|---|---|---|
| Time and attendance intake | Collect approved files, check names and dates, and list missing items. | Approve time, leave, corrections, and exceptions before they enter the payroll file. | Source file, owner, date, and approval are visible |
| Employee change list | Prepare additions, departures, status changes, and approved deductions from source records. | Approve every change that affects employment, pay, benefits, tax treatment, or access. | Old value, new value, source, and approver match |
| Payroll register draft | Enter approved inputs, run the working calculation, and flag unusual results. | Review totals, exceptions, and sensitive employee changes before approval. | Totals tie to approved inputs and prior-cycle review |
| Payment file support | Prepare the approved output and hand it to the named release owner. | Control bank details, funding, final authorization, and payment release. | Preparer and releaser are different people |
| Closeout records | Save the approved register, exception list, confirmations, and open-item note. | Confirm the final output, resolve differences, and set retention rules. | Final record matches the approved register |
Evidence snapshot
Why careful access and review matter
Define payroll preparation before assigning it
Payroll preparation is the work that turns approved time, employee changes, deductions, and other source records into a register that a company owner can review. It does not include deciding a person's pay, changing bank details without approval, funding the account, or releasing the payment.
Write the first scope as a short list of inputs and outputs. A useful line says where the time file arrives, which fields the assistant checks, where exceptions go, who approves the register, and what evidence closes the cycle.
Separate preparation from approval and release
One person should not be able to create an employee change, approve it, alter the payment destination, and release funds. NIST control AC-5 tells organizations to identify duties that need separation and define access rights that support that split.
For a Philippines support role, the assistant can prepare the working file and exception list while named company owners approve employee changes and the final register. A different authorized person should control funding and release, with reconciliation completed after the output is available.
Treat change requests as evidence, not email instructions
A request to add an employee, change a deduction, or replace bank details needs a known source and an approved path. The assistant should record the old value, proposed value, request source, approver, date, and status instead of acting on a forwarded message alone.
Business email compromise makes this rule practical rather than fussy. AFP reported on April 14, 2026 that 74% of 465 surveyed United States organizations were affected by business email compromise during 2025, so a separate verification step is sensible even though that figure is not a Philippines incident estimate.
Use fraud research as context, not a forecast
The same AFP release says 76% of surveyed United States organizations experienced attempted or actual payments fraud in 2025, and 58% said checks were subject to fraud. Those results describe United States treasury teams; they do not measure a Philippines-based assistant or predict what will happen in one payroll process.
ACFE's 2024 global study covered 1,921 occupational fraud cases from 138 countries and territories, with more than $3.1 billion in total losses and a $145,000 median loss per case. It also found that 43% of cases were detected by tips, which supports a clear reporting path and owner review without turning the article into a claim about any worker or location.
"Fraud prevention today is an operating model, not a single control. The best outcomes come from strengthening the fundamentals — verification, disciplined approvals and timely detection — and using technology to reinforce trust as payments move faster. At Truist, that’s how we show up: with simplicity, speed, safety and smart execution."
Copy-ready scripts
Make the stop points easy to say
Provider call question"Please show how your Philippines-based payroll assistant would handle one missing time record and one request to change employee bank details. Name the source evidence, the stop point, each approval owner, and the record left after the cycle closes."
Assistant stop rule"You may prepare the register from approved source records and list exceptions. Stop and tag the payroll owner before changing employee details, resolving a pay dispute, accepting new bank instructions, approving the final register, funding an account, or releasing a payment."
Run the first cycle with visible checkpoints
Use a real cycle with redacted training examples and a narrow employee group. Check each input before entry, review every exception, compare the draft totals with approved source records, and hold release until the owner signs off.
The 30-day chart below is a setup example for teams that need time to map, test, run, and close one preparation lane. It is not a claim that every payroll calendar takes 30 days or that the support role should control the full process.
Planning chart
First 30 days of payroll preparation review
Each bar ends at a planned control check, not a promised result.
Launch path
A five-step HR outsourcing workflow
- 01
Map the source files
List each input, its owner, arrival time, required fields, and approved storage place.
- 02
Mark approval points
Name who approves employee changes, exceptions, the final register, funding, and release.
- 03
Test named access
Give the assistant only the systems and fields needed for preparation, then test removal.
- 04
Review one live cycle
Check every exception and compare the draft register with approved source records.
- 05
Close and reconcile
Match the final output to the approved register and save the evidence and open-item note.
Process graphic
Payroll preparation control path
Preparation moves forward only from approved evidence, while decisions and release stay with company owners.
Keep records that explain what happened
A good closeout pack shows the approved inputs, change list, exception decisions, reviewed register, confirmation, and unresolved items. The assistant can assemble this pack, but the company owner sets the retention schedule and decides who may correct or delete a record.
The IRS says United States employers should keep employment tax records for at least four years after filing the fourth quarter for the year. That is a United States rule rather than a Philippine retention period, so use it only as an example and ask the right company owner or adviser to set the schedule that applies.
Ask the provider to show the control path
A useful provider answer walks through an ordinary time-file correction and a risky bank-detail request. It names the source, assistant action, approval owner, system record, stop rule, final check, and the person who removes access when the work ends.
Ask to see the first-cycle plan, not a promise that the team can handle everything. The plan should show sample files, named accounts, review times, exception categories, backup coverage, open-item reporting, and the handback process if the assigned worker changes.
Buyer FAQ
HR outsourcing questions
What can a Philippines payroll assistant prepare?
The role can collect approved time records, check missing fields, prepare employee change lists, enter approved inputs, build a draft register, list exceptions, and assemble closeout records. The exact scope should match the company's systems and owner rules.
Which payroll duties should stay with the company?
Keep decisions about employment and pay, employee master-data approval, bank-detail verification, final register approval, funding, payment release, dispute handling, and legal interpretation with qualified company owners.
Should the assistant have access to the bank account?
Preparation normally does not require payment-release authority. Use the smallest access needed, keep preparer and releaser duties separate, and have the company's system and finance owners approve access.
How should bank-detail changes be checked?
Use a known request channel and a separate verification step with an authorized owner. Record the old and new values, source, verifier, approval, date, and status before the change enters the approved payroll file.
Does this guide set a legal retention period?
No. It gives an operating checklist and cites the IRS rule as a United States example. The company owner or adviser must set the employment, tax, privacy, and cross-border record rules that apply.
Sources
Source notes
- AFP: 2026 Payments Fraud and Control Survey releasePublished April 14, 2026; United States survey of 465 treasury practitioners and source for the 76%, 74%, and 58% figures and the Chris Ward quote.
- ACFE: Occupational Fraud 2024, A Report to the NationsGlobal study and source for the case count, countries and territories, total loss, median loss, and tip-detection share.
- NIST SP 800-53 Rev. 5: AC-5 Separation of DutiesPublished September 2020 with later updates; source for the separation-of-duties control used in this guide.
- IRS: Employment tax recordkeepingReviewed June 12, 2026; official United States guidance used only as a recordkeeping example.
- Lawphil: Republic Act No. 10173, Data Privacy Act of 2012Philippine privacy-law text for readers who need to discuss cross-border personal-data duties with qualified owners or advisers.