Payroll Permissions

How payroll access works: payroll companies and pay runs, what payroll users can see and change, payroll reports, and fixing payroll access problems.

If your organisation uses AllWage payroll, payroll has its own scope and its own permissions. Everything on the other User Permissions pages still applies — this page adds what's specific to payroll.

What this page covers:

• Payroll access, payroll companies and pay runs

• How time and attendance and payroll access combine

• The payroll permissions, including reports

• Work that needs a whole company — filing, SARS submissions and company-wide reports

• Payroll in presets, with examples

• Troubleshooting payroll access

Who this is for:

Owners and payroll administrators who set up payroll access. Read User Permissions and Permission Presets first.

Payroll Access and Payroll Scope

Payroll access: yes or no

Every preset that could include payroll starts with Payroll access?

• No — no payroll at all: no pay runs, no payroll companies, no payroll reports and no payroll information on employees. Every payroll permission becomes No access. Any preset can be set to No.

• Yes — you then choose the payroll scope.

Two separate payroll scopes

Payroll has two scopes. They mean different things, and you usually only need one.

• Payroll companies — the whole company. Every pay run in the company, including pay runs added later. This is for someone who administers a company's payroll — including filing and SARS submissions, the OID return of earnings and the company-wide reports.

• Pay runs — specific pay runs only. Just the chosen pay runs, without the rest of their company. This is for someone who works on particular pay runs, not on a company as a whole.

Choose the one that matches the job

Job	Payroll companies	Pay runs
Administers the whole payroll for a company, including filing	That company	None
Works on certain pay runs only	None	Those pay runs
Administers one company, and also needs one pay run from a different company	That company	The pay run from the other company

Only combine the two scopes in the last case. A pay run can only come from a company that isn't already chosen — if a company is chosen, its pay runs are already included, and AllWage shows "Already included through" that company. If payroll companies is All, every pay run is already included.

Seeing vs Editing

A user can reach an employee in two ways: through their T&A teams, or through their payroll scope.

• What they can see: everyone on their teams, plus everyone in their payroll scope.

• What they can change in time and attendance: clocks, leave, activity items, hour overrides and the employee record — only for employees on their teams.

• What they can change in payroll: only for employees in their payroll scope, and only as far as their payroll permissions allow.

For example, a team manager's team has 20 employees, and their weekly pay run pays 60 employees across four teams. They see all 60. They can work on payroll for all 60, but can only change clocks, leave and records for their own 20.

"I limited this manager to one team, but they can see hundreds of employees." Check their payroll scope. A whole payroll company, or a pay run that covers many teams, brings everyone on it into view. To limit what they see, narrow the payroll scope too, or set payroll access to No.

Payroll only, no teams. A payroll administrator can have T&A teams set to None and a whole payroll company. They see everyone the company pays and work on their payroll, but can't change anyone's clocks or leave.

Employees not on a pay run. An employee who isn't on any pay run is visible to anyone with payroll access, so they can be put onto the right pay run. Their historic payroll information stays out of reach unless those pay runs are in the user's scope.

Payroll Permissions and Reports

Permission	What it covers	Levels
Employee payroll	Everything payroll-related on an employee: payroll details, earnings and deductions, recurring amounts, employment periods, leave balances, loans and savings.	No access, Read, Read / Write
Pay runs	Working on pay runs, including finalising them.	No access, Read, Read / Write
Payments	Preparing the payments that come out of a pay run.	No access, Read, Read / Write
Filing	Submitting statutory returns. Needs a whole company.	No access, Read, Read / Write
Reports	Each payroll report is its own permission.	No access, Read

Permissions that need another first

AllWage never switches the missing permission on for you. The preset editor shows what's needed, and the permission has no effect until you give it.

• Pay runs needs Employee payroll at least at Read.

• Payments needs Pay runs at least at Read.

• Payroll reports need at least Read on Employee payroll, Pay runs, Payments or Filing.

Editing is not the same as finalising

Employee payroll and Pay runs are independent, so preparing pay and signing it off can be different people.

Employee payroll	Pay runs	Within their scope, they can…
Read / Write	Read	Capture and correct employees' pay, but not finalise.
Read	Read / Write	Finalise the pay run, but not change anyone's pay by hand.
Read	Read	Check everything, and change nothing.

Finalising still makes the updates a pay run needs, such as leave balances and loans and savings. Permissions never override a pay run's own rules — a finalised or locked pay run stays locked.

Reports only show the employees in your scope

Every report is filtered by the employees in your scope, and never shows someone you can't see. A payroll administrator with the whole company sees everyone the company pays; a user with one pay run sees only that pay run's employees.

Work that needs the whole company

These are only available to users with at least one whole payroll company — chosen under payroll companies, not just some of its pay runs:

• Filing

• SARS Code Summary

• OID Report

• Employment Tax Incentive (ETI) Breakdown

• Skills & Equity

• BIBC

• Accounting Journal Export

The Overall Usage Report covers every company, so it's only available with payroll companies set to All.

Every other payroll report — such as the Pay Run Template Summary, Leave Liability, UI-19, Certificate of Service, Cost Report and Nett Pay Report — works with any payroll scope, filtered to the employees in it.

If the preset fixes the payroll scope to specific pay runs, the editor won't allow Filing or the company-wide reports. If the scope is Set per user, each user gets what their own scope supports, and the Resolved access preview explains anything they can't use under Why some access is limited.

Payroll in Presets

Preset	Payroll
Admin — Full	Every company: every pay run, filing, all reports and all payroll setup.
User — Full (unscoped)	Reads all payroll. Changes nothing.
User — Full (scoped)	The payroll chosen for each user. With a whole company, that includes filing and the company's own setup. Also reads and manages employees' documents within their scope.
Admin — T&A only, User — T&A only	No payroll access.

User — Full (scoped) leaves teams, payroll companies and pay runs on Set per user. When you add a user to it, AllWage asks Payroll access?, then their payroll companies, then their pay runs, along with their teams.

Payroll setup

Payroll setup is always at least Read for anyone who works on payroll. Who can change it follows the same rule as the rest of AllWage — you can change what's inside your scope; only Admins change what's shared by everyone.

• Pay run settings, payslip settings and company settings belong to one company. A scoped user with that whole company can change them. A user with only specific pay runs can read them but not change them.

• Leave policies, input templates and input variables — the earnings and deductions everyone's pay is built from — are shared by the whole organisation. Only Admins change them.

• Company documents are shared by every payroll company, so they need payroll companies set to All.

Example: the regional payroll administrator

Runs the whole payroll for one company, North, including filing, and manages time and attendance for the teams in their area.

• Preset: User — Full (scoped)

• Scope: teams in their area · payroll companies: North · pay runs: None

They get every North pay run, filing and North's reports, and can manage North's pay run settings, payslip settings and company settings. They read leave policies and input templates.

Example: the pay-run clerk

Works on the Weekly Casuals pay run only. No filing, no company-wide reports.

• Preset: User — Full (scoped) — no custom preset needed

• Scope: payroll companies: None · pay runs: Weekly Casuals

Filing and the company-wide reports simply aren't available, because the clerk doesn't have a whole company.

Example: maintaining earnings and deductions

Someone like the regional payroll administrator who is also responsible for the organisation's input templates. Input templates are shared by everyone, so a scoped user can't change them. Build a custom preset upward from User — Full (scoped), raising Input templates from Read to Read / Write, and name it after the job. Any change they make affects every company and every employee.

Troubleshooting Payroll Access

Complaint	What to check
"This manager can see far too many employees."	Their payroll scope. Everyone in it is visible. In Explore employee access, these employees show a payroll reason instead of a team.
"I can see this employee but can't fix their clock."	The employee is probably visible through payroll only, and isn't on the user's teams.
"Filing is greyed out."	Filing needs at least one whole payroll company. A user with only specific pay runs can't file.
"A report is missing."	Does the preset give the report? Does it need a whole company, or all companies? Does the preset give a payroll permission for the report to work from?
"Payments doesn't do anything."	Payments needs Pay runs at least at Read, and Pay runs needs Employee payroll at least at Read.
"I can't change the pay run settings."	Managing pay run settings, payslip settings and company settings needs a whole payroll company.

Use the Resolved access preview and Explore employee access to confirm the reason before changing anything. See Designing and Troubleshooting Access.