Maker-checker: why one person shouldn't run AND approve payroll

The simplest control in payroll is also the most overlooked: the person who runs payroll shouldn't be the one who approves it. Here's why it matters.

Ask a payroll team where fraud and costly errors creep in, and the honest answer is rarely the maths. It's that one person controls the whole chain. They run the payroll, approve it, and release the payment, with no second pair of eyes.

What maker-checker means

Maker-checker is a simple separation of duties: the person who creates or runs something (the maker) cannot be the person who approves it (the checker). Two people, two roles, on the steps that move money.

Where it matters in payroll

• Approving the payroll run that locks everyone's pay
• Approving the payment batch before the bank file is generated
• Releasing any direct payout

On each of these, a different person should sign off. It's not about distrust. It's about catching the honest mistake before it reaches the bank, and removing the temptation that unchecked control creates.

Controls aren't there because you don't trust your team. They're there so a single slip never becomes a single point of failure.

Make it the default, not a policy on paper

A written policy that one person shouldn't run and approve payroll is easy to ignore under deadline pressure. Far better when the system simply won't let the same person do both. That's how Vintage People enforces maker-checker on payroll approval and disbursement.