Payroll master data controls: stop unauthorised changes before payment

Published by SESAY · 2026-10-07 · General Australian payroll guidance

What to understand first

Master data changes can redirect a correct calculation to the wrong destination or silently alter future pay. The controls here are practical governance recommendations: separate instruction, entry, review and release wherever feasible, with a documented compensating check for small teams.

Practical checks

• Verify bank changes through a trusted channel independent of the change request.
• Require effective dates and authorised evidence for salary changes.
• Compare the change report with approvals before releasing payroll.
• Remove obsolete access and review privileged accounts regularly.

Fictional example

A fictional employee emails new bank details. Rather than replying to the same email for confirmation, payroll uses an established contact method. The employee says no change was requested. The team freezes the requested amendment and follows its incident process without circulating the employee’s banking details unnecessarily.

Your next step

Inspect your last change report. Can each item be traced to a legitimate instruction and reviewer? If the software has no suitable report, define a controlled change register and independently compare sensitive fields. A checkbox completed by the same person who made the change offers limited assurance.

How SESAY can help

SESAY can help design a maker-and-reviewer workflow and change register. Client approval rights, verification channels and release permissions should be explicitly agreed.

Official sources

• Fair Work — Record-keeping
• OAIC — Sending personal information overseas

Sources researched 2026-10-07. Examples are fictional and use stated assumptions. Confirm current rules and your circumstances before acting. This is general information, not individual tax or legal advice. SESAY is independent of the regulators linked here.