The Payroll Only the CFO Can See

The office is empty by the time he opens the file. Month-end, somewhere past seven, a CFO with a hundred-odd people on the payroll below him. His payroll team pays everyone in the building, every cycle, without him touching a thing.

Then there's the other payroll. He runs it himself: a dozen rows, executives only, in a spreadsheet his own payroll team has never seen. He works the deductions out by hand, keys in the payments, and puts the file back where nobody will find it. Every month, for years.

He told us all of this on a discovery call. Then he said the part we haven't stopped thinking about: he wants this month's run to be his last one.

Why is a CFO doing payroll by hand?

Not because he misses spreadsheets.

Because executive compensation is the one number in the company that cannot leak. Your payroll team sees everything: every salary, every bonus, every adjustment. That's the job. So if a dozen salaries have to stay invisible to the people who process pay, most systems give you one lever. Take those salaries out of the system.

Which is exactly what he did. And the uncomfortable part: the instinct is correct. Executive pay doesn't leak as a rumour. It leaks as a screenshot, and every salary conversation in the building afterwards starts from that screenshot instead of from a budget. Watch it happen once and you will spend years making sure it never happens again. So he put those numbers in a file only he could open.

That's not discretion. That's a workaround.

What the spreadsheet costs

Start with the errors.

Buyers describe manual side-processes with the same phrase, and we've seen it surface in deal after deal: "too much room for error". Hours in one place, rates in another, a human moving numbers between them by hand. The executive spreadsheet is that pattern at its purest: one person, no reviewer, by design. The one payroll nobody is allowed to check is the one no system checks either.

Then the single point of failure. A payroll only one person can run stops when that person is away and disappears when that person leaves. We've written before about what happens when the only person who knows the payroll retires. Now make that person the CFO, and the process a file nobody else is allowed to know exists.

There's no trail, either. When pay lives in a system, every change carries a date and a name. When pay lives in a private file, the answer to "when did this number change, and who approved it" is whatever the file says today. For the most scrutinized salaries in the company, that is exactly backwards.

Then it collides with the calendar. Every remittance has to include people the system doesn't know about. And at year-end, the executives' slips have to reconcile with what the spreadsheet paid, and the payroll team can't see the spreadsheet. He stitches every one of those seams by hand, at night.

So why not put them in the system?

The fix is a permission model, not a second payroll

Because "in the system" always meant "visible to the payroll team". That assumption held when payroll access was one switch: in or out. Scoped access retires it.

In Workzoom, a role decides more than which screens open. It decides which employees a person can see. A role sees a defined group and nothing else: a location manager sees their own site, corporate rolls up across all of them, and HR and payroll sit behind separate permissions. The same model covers an executive group. It lives in the same system as everyone else, under a scope only the people cleared for it can open. The confidentiality survives. The spreadsheet doesn't have to.

How fine you cut it is up to you. What opens is set by suite or by module: payroll without talent, one module inside a suite. Who it opens for is the role. Manager access is typically established by role, admin permissions by role or by a named person, and anything established by role is inherited: promote or transfer someone, and the permissions arrive with the new role instead of waiting on someone to remember them. The executive scope is the same machinery, set narrow. The cleared roles open the executive group. For everyone else, it isn't there. Configuring those scopes is part of implementation, which is included rather than sold separately. If you're evaluating systems, put it on your demo question list: ask to see the scope model, not a description of it.

He wasn't careless. He was the opposite: careful enough to spend years of month-end evenings protecting a dozen numbers. His software made that carefulness look like Excel. If keeping a salary confidential means keeping it out of your payroll system, the system has failed a basic test. And if you're the one running a file like his, you're not the problem. Companies running multiple payrolls across multiple entities hit the same wall in a different shape. The tool decides what's possible, and people build around the tool.

If your month-end includes a payroll only you can run, we should talk. A payroll system that can keep a secret runs $4 to $16 USD per employee per month, depending on how much of the platform you take. No setup fees, no contracts, implementation included. Bring the spreadsheet. You won't have to show us the numbers, which is rather the point.

He asked us, near the end of that call, whether this manual run could be the last one. It can. And the rule is short: if a number is too sensitive for your payroll system, fix the system, not the number.