Lesson 2.6: Payroll Security Best Practices

Because nonprofit payroll involves the management of highly sensitive Personally Identifiable Information (PII)—including salaries, bank account details, and Social Security Numbers—establishing robust security protocols is critical. FastFund Payroll Online includes several built-in features that help you maintain data integrity, comply with internal controls, and protect your organization from both internal and external threats.

To ensure your system is as secure as possible, we recommend implementing the following payroll security best practices:

1. Enforce Strict Segregation of Duties Even if your nonprofit is relatively small, no single person should have complete control over every aspect of the financial and payroll cycle. Proper segregation of duties prevents errors and fraud.

• Use User Groups to restrict access based on specific job categories. For instance, the person entering the payroll hours should ideally not be the same person printing the physical checks or authorizing the final direct deposit transmission.
• Be extremely protective of Company Administration rights. Only assign this top-level permission to personnel with proper managerial, fiscal, and organizational authority, as it grants the ability to edit core company data and override locked balances.

[INSERT SCREENSHOT: The ‘Groups & Permissions’ tab emphasizing a restricted profile, showing standard payroll entry permissions assigned, but Company Administration rights left unchecked]

2. Protect Sensitive PII & Social Security Numbers The employee tax area contains highly sensitive data. FastFund inherently protects this by limiting access: the employee’s Social Security Number (SSN) will not appear and cannot be accessed if a user does not have the specific Payroll permission assigned to their user profile. Always perform a periodic audit of your user list to ensure only necessary HR and payroll staff hold this permission.

3. Secure Direct Deposit Distributions Paying employees via ACH Direct Deposit reduces the risk of lost or stolen paper checks. However, it requires careful data handling:

• Always require employees to complete a signed Direct Deposit Authorization Form accompanied by a voided check or official bank deposit slip before entering their routing and account numbers into the system.
• When utilizing the automated Email Payroll Notification feature, FastFund protects employee privacy by sending the direct deposit pay stub as a secure, encrypted PDF attachment. Employees can only open this document by entering the last four digits of their Social Security Number as the password.

[INSERT SCREENSHOT: A preview of the automated ‘Direct Deposit Email Notification’ template, highlighting the text that instructs the employee to enter the last 4 digits of their SSN to open the attached PDF]

4. Maintain the Audit Trail for Departing Employees If an employee leaves your organization, you must immediately revoke their system access. However, for internal control purposes, you should never share login credentials or attempt to delete a user who has previously posted transactions.

• Disable, Do Not Delete: Navigate to the departing user’s profile and check the Disabled box. This immediately revokes their ability to log in while permanently preserving their historical data entry records in the system’s Audit Log.

5. Regularly Review the Audit Log As an administrator, make it a habit to regularly review the Audit Log. Use the filter tools to isolate actions like “Delete” or “Update” within the Payroll and Employee data types. Monitoring the before-and-after data helps you proactively spot unauthorized changes to employee pay rates, tax setups, or security groups.