Why a shared admin login in HR and payroll systems is a problem

HR and payroll systems hold Social Security numbers, bank accounts, pay rates and tax forms. An admin login is one with the strongest permissions in the system, including the right to change other people’s access. When several people share it, the system can no longer show who viewed that data or who changed it. Three sets of rules ask who can reach that data: state laws on Social Security numbers, the CCPA’s security duty, and SOX audits at public companies.

Where admin logins get shared

Admin logins get shared in a few familiar ways. The payroll system has one admin login, and someone in HR and someone in IT both use it. An outside accountant or bookkeeper gets the owner’s login because adding them seemed slow. During benefits enrollment or a hiring rush, a temporary helper is told the admin password for a few weeks.

An admin login reaches every employee’s record and the permission settings themselves. So sharing it exposes more than sharing an ordinary user’s login.

Social Security numbers and state law

Some state laws deal with Social Security numbers (SSNs) directly. In New York, General Business Law 399-ddd(4) applies to anyone holding an individual’s SSN for business. It requires reasonable measures so that no officer or employee can see a number unless they have a legitimate or necessary business reason. It also requires safeguards against unauthorized access.

A shared admin login works against both parts. Everyone who knows the password can open every SSN in the system, whatever their job. And because the system records one account, you can’t show afterward which person looked, which leaves you without evidence if access is questioned. Check the law in each state where your employees live.

For employees and applicants who live in California, the CCPA adds a general duty for businesses it covers. Its definition of personal information includes employment-related information, and an SSN is sensitive personal information (Civil Code 1798.140(v) and (ae)). A covered business must use “reasonable security procedures and practices” to protect it from unauthorized access (1798.100(e)). Who the CCPA covers is in Managing HR and recruiting accounts.

What security controls ask of admin accounts

NIST SP 800-53, the federal catalog of security controls, spells out what limiting and identifying access means for accounts.

What a SOX audit asks about payroll

Under Section 404 of the Sarbanes-Oxley Act (15 U.S.C. 7262), a public company’s annual report includes management’s assessment of its internal control over financial reporting. The SEC’s 2007 guidance for management lists “access to programs and data” among the areas of IT general controls a company may need to evaluate. Its list of control types includes “segregation of duties” and “review and approval authorizations.”

If payroll is in scope for your assessment, a shared admin login weakens the evidence. Someone sets up a pay change, and someone else approves it, but the record shows the same account both times. What auditors ask for, and which records to keep, is in What a SOX audit asks about admin accounts, and which records to keep.

How payroll and HR tools split admin rights

Gusto, ADP RUN and Rippling all let you give each person their own login and limit what it can do. Check four things in any system’s help center: the roles, how to narrow them, how use is recorded, and how to remove someone.

Gusto

Gusto has one Account owner (Primary admin) per company, and only that person can add, remove or edit roles for others. An All access admin has full rights in the account, except for managing roles. Gusto advises keeping that role to a few people. On Plus and Premium plans, a Custom admin gets only the functions you pick, such as payroll or benefits. A People manager handles tasks like approving time off and never sees SSNs, bank account info or tax returns.

Gusto warns that one report permission shows SSNs to anyone who holds it, even with other permissions limited. Check what each permission shows before you grant it. Outside accountants, bookkeepers and brokers can be added as collaborators with their own admin role. The Account owner can remove that role when the work ends.

Gusto also has a payroll approval feature. One admin prepares a payroll and requests approval, which locks it until a full access admin approves or declines it. The Pay history page also has a payroll activity log for admins. Both depend on each admin having their own login.

ADP RUN

ADP’s getting-started guide for RUN lists four roles. An Owner can reach every payroll area, add, change and remove users, and reset their passwords. A Payroll Admin handles payroll tasks, Client Update maintains company and employee information, and CPA View can only view payroll information and reports. The person who buys RUN becomes the first Owner. Because only an Owner can reset passwords, ADP suggests giving that role to at least two users.

Rippling

Rippling builds access from permission profiles. Each profile sets whose data it covers, such as a reporting line or a department, and which types of data, usually tied to an app like Payroll. It also sets what the holder can do with that data, such as view, edit or approve. Profiles attach to employee attributes like level or department, so permissions update when those attributes change.

Splitting a shared admin login in these tools

All three tools support a login for each person with limited rights, so a shared admin login in them can be split. Give each person their own login, limit full admin rights to a few people, and remove a person’s login on their last day.

When one admin login can’t be avoided

Some HR portals offer only one admin login. Then keep three things outside the system: who may use it, a record of who used it and when, and a password change when someone leaves. When shared accounts can’t be split into personal ones shows how. For the record of use, the options are compared in Comparing ways for several people to use one shared account.