Before payroll software goes live, a review of PAYE, pensions, data and rollback

A launch review decides whether a defined product version can support a specific customer safely. It is not a demonstration or a meeting where unresolved risks disappear into minutes. Give every gate an authorised owner who can stop release.

Customer and product scope

• Name the target role, employer model and payroll pattern.
• Record supported employees, frequencies, schemes and tax year.
• Put exclusions in sales, contract, onboarding and support material.
• Confirm the exact build, infrastructure and dependencies.
• Resolve every pilot difference or document authorised acceptance.

PAYE readiness

• Map applicable HMRC specifications and effective dates.
• Confirm recognition wording for the exact product where relevant.
• Pass ordinary, boundary, invalid, migration and correction tests.
• Preserve submission acknowledgements and errors.
• Assign monitoring for official change.

HMRC's PAYE developer collection is the primary index for current technical resources. Reopen it before the decision.

Pension readiness

• Test assessment, contributions and tax-relief configuration.
• Verify the named provider format or connection.
• Exercise worker requests, communications and records in scope.
• Confirm acceptance, rejection handling and reconciliation.
• State employer and supplier responsibilities clearly.

Data and security

• Approve controller, processor and sub-processor analysis.
• Verify access, authentication, logs, retention and export.
• Complete required security and privacy reviews.
• Close temporary accounts and remove test data.
• Confirm incident contacts and decision rights.

Operations and recovery

• Run a full backup restoration and verify payroll completeness.
• Rehearse failed import, dependency and submission scenarios.
• Prevent duplicate processing during retry.
• Staff support around the selected customers' pay schedules.
• Publish service status and escalation routes.

The NCSC's cloud security guidance provides official prompts for authentication, logs, joiners and leavers, backups and incident preparation.

Commercial and communication readiness

• Match order forms and claims to supported scope.
• Verify pricing, billing units, renewal and exit.
• Check data-processing and service commitments against operations.
• Train sales and support on limitations.
• Prepare customer and employee communications.

Cutover decision

Name the live authoritative system, approval time, rollback trigger, rollback owner and point after which reversal needs another plan. HMRC's FPS guidance makes reporting timing and correction material to the decision.

Record pass, fail, unknown or accepted risk for every item with evidence. After launch, hold enhanced reviews over several payrolls. Check outcomes at HMRC and pension providers, corrections, access events, support work and customer understanding. Close the launch phase only when unresolved issues have ordinary owners and the promised workflow is stable.

People and capacity

• Name payroll, product, engineering, quality, pensions, privacy and security owners.
• Confirm trained cover for every deadline-critical role.
• Verify access and escalation contacts before the launch window.
• Compare customer payroll schedules with support capacity.
• Run an incident exercise with actual decision-makers.

Evidence pack

• Store requirements, sources, tests, defects and approvals together.
• Record the product build and configuration under review.
• Link each marketing and contract promise to supporting evidence.
• Preserve pilot reconciliations and customer acceptance.
• Give volatile sources and controls a review date.

First-run monitoring

Track prepared, approved, transmitted, acknowledged, rejected, corrected and reconciled states separately. Watch for unusual access, duplicate action, pension mismatch, failed documents and support escalation. Restrict non-essential configuration changes while the service stabilises.

Hold a review immediately after each early payroll. Decide whether to continue, narrow, roll back or add controls. A green technical dashboard cannot overrule an unresolved customer payroll difference. Document the decision and communicate material effects through the approved route.

Record when temporary launch access, heightened monitoring and project-only data copies will end. Confirm their removal rather than assuming normal operations inherited them safely.