The two pillars to a good Payroll Outsourcing Vendor are Compliance and Security. Without both, or even one of them, the Vendor becomes unreliable. Here is how you can make sure that the Compliance and Security check boxes are ticked when looking for a reliable vendor.
Before we dive into that, let us first define the two terms:
Security: Something that secures; measures taken to guard against espionage or sabotage, crime, attack, or escape
Compliance: The act of complying with a command. In the corporate world, it is defined as the process of making sure your company and employees follow all laws, regulations, standards, and ethical practices that apply.
Between the two, both are equally important. Security protects your data against potential data leak from external and internal sources. Compliance protects your organisation from falling out of the boundaries of law.
Here are 4 keys to look out for:
1. ISO 27001 Certification
ISO/IEC 270011 is the international standard for information security and sets out the specification for an Information Security Management System (ISMS). It addresses people, processes, and technology by setting guidelines that help organisations manage their information security.
By leveraging on companies with this certification, you can be assured that your data is safe. The certification process will check on where their data is stored and how it is protected. More than protecting your business from technology-based risks, but it also protects your business from other more common threats , such as poorly trained payroll officers or ineffective procedures.
One key thing about an ISO certification is that it is a framework that forces organisations to continually review and improve their processes in order to obtain this certification that requires an annual recertification. This ensures that organizations with this certification will not be stagnant or outdated with their security methods.
2. OSPAR Attestation
This term might only be familiar if you are working in an organisation governed under the Monetary Authority of Singapore (MAS). However, even if you are not, it is beneficial to look at vendors with this certification so you can leverage on the perks that the vendor implements to comply with this.
The Outsourced Service Providers Audit Report (OSPAR) offers credibility to the vendors and assures financial institutions that they maintain an equivalent level of governance, rigour, and processes. They investigate risk assessments, threat monitoring, human resources policies and even practices related to sub-contracting.
As an OSPAR payroll service provider, all payroll officers have to go through a background screening process, with requirements such as:
- Making sure that they are not a subject of any past or current proceeding of a disciplinary or criminal nature;
- Convicted of any offence (in particular, that associated with a finding of fraud, misrepresentation or dishonesty);
- Accepted civil liability for fraud or misrepresentation; and
- And financially sound
All these measures are taken so that customers can trust that their employee data is handled by a person with minimal temptations.
OSPAR also requires every company to take on the responsibility of vetting their sub-contractors thoroughly. This ensures that every vendor goes the extra mile of protecting their clients’ data.
3. Routine Penetration Testing on Payroll System
To effectively evaluate your system applications for vulnerability and susceptibility to threats like hackers or cyberattacks, organisations would initiate the process of penetration testing. Especially when highly sensitive data such as employee data and payroll information is being kept in the payroll system, penetration tests become a non-negotiable.
Having obtained certifications like ISO 27001 and OSPAR, a penetration test is the best way to test if the precautions made technically are strong enough to defend the organisation from attacks. It serves as a way to examine where the security policies are genuinely effective. It also can serve as a pre-emptive tool to close any loops should it be found during the test.
Every payroll vendor that uses a payroll system must ensure that the system goes through routine penetration tests in ensure that the system is up-to-date with the latest cybersecurity threats and have ready defensive tools in place!
4. IRAS Approved Vendor for AIS
Inland Revenue Authority of Singapore (IRAS) sets out 3 categories of software compliance – Category A, B and C. Software under Category A & B is compliant with at least 10 controls recommended by IRAS.
The controls cover sections such as tax reporting of CPF contributions and controls for data preparation such as Form IR8S
Being on this list helps to ensure that they are kept in loop with the latest updates by IRAS, ensuring compliance.
These 4 keys might sound complicated but with these, you can be fully assured that your vendor is well protected internally and externally.
To look for a vendor with such credentials, look no further than Frontier e-HR! Our track record of 22 years will give you that extra assurance that our Payroll Officers will provide you with the best support required for you to run your business without needing to think about your payroll. In addition, if you are a local SME in Singapore, you will be able to tap on the HRSS grant to engage our services! Feel free to contact us here for more information.
