AWRA OpsHub Search
Advanced Certificate on pass

HR: Payroll

Run payroll safely: per-country statutory rules that are versioned configuration, the run lifecycle from calculate to post, frozen payslips and the Kenya P9A, and posting net pay into the cross-module Payments Register.

4 lessons 48 min 5-question assessment 80% to pass

What you’ll learn

  • Explain why statutory rules are versioned, effective-dated config and never hard-coded
  • Run the calculate → approve → post lifecycle, including skip-and-report and locked-timesheet prerequisites
  • Describe the gross-to-net calculation order and why payslip figures are frozen
  • Explain payslip and P9A self-service and how posted runs reach the Payments Register

Course content

4 lessons · 48 min of reading
01
Lesson 1 of 4 Reading 10 min

Multi-country by design

Payroll is deliberately the last HR area to set up, because it touches money and carries statutory and legal liability — get employee and attendance data clean first, or you compute wrong salaries from wrong inputs. The defining architectural choice is that statutory rules — income tax, social security, health, and local levies — are region-scoped, versioned, effective-dated configuration, never hard-coded. Adding a country is a set of configuration rows, not a code change, and the calculation engine itself stays generic and jurisdiction-agnostic.

Versioning is what makes this trustworthy over time. Once a payslip has referenced a particular rule-set version, that version is frozen; a rate correction is published as a new version with its own effective date, and the old version stays exactly as it was. This is why a correction can never retroactively alter a closed run — the payslip keeps pointing at the rules that were actually in force when it was calculated. Kenya is the launch jurisdiction (PAYE bands and personal relief, NSSF, SHIF, and the Housing Levy), and it is the first data set, not the scope.

The practical consequence for an operator is that you resolve each employee's rule set from their work country and the pay period, and you never edit a published version's numbers in place. When rates change, you add a new version and set the previous one's end date. Carry this model forward: the engine is generic, the country is data, and versions are frozen once used.

Key takeaways

  • Payroll is last because it touches money and statutory liability — clean employee/attendance data first.
  • Statutory rules are per-country, versioned, effective-dated config; the engine is generic, the country is data.
  • A published version referenced by a payslip is frozen; corrections are new versions, never edits.
  • Kenya (PAYE, NSSF, SHIF, Housing Levy) is the launch data set, not the scope.
02
Lesson 2 of 4 Practice 12 min

The run lifecycle

A payroll run is scoped to one organisation, one period, and one work country — one run is always exactly one country, because tax authority, currency, and often legal entity differ per country. You create a run (the currency is derived from the country/contracts, not typed), then calculate it. Calculation needs each employee to be ready: a locked timesheet for the period and an active contract. Anyone not ready is skipped and reported — listed with the reason — rather than aborting the whole run, matching the platform's "skip and report" convention for bulk work. You fix each skipped person and recalculate.

The lifecycle then runs draft → calculated → approved → paid, one-way except that approved can be reopened to calculated, and nothing can change once paid. Two separate permissions guard the money-sensitive transitions: one to approve the numbers, and a distinct one to post (pay), because reviewing figures and authorising money movement are different decisions. A lock service enforces this so every mutating action checks state rather than scattering status comparisons.

The operator's loop is therefore: create → calculate → read the skipped list and fix → recalculate → approve → post. The skip list is persisted on the run, not just flashed once, so revisiting a run later still explains why someone was left out. Treat the skipped report as the run's to-do list; a clean run is one where everyone either has a payslip or a stated reason they do not.

Key takeaways

  • One run = one organisation + one period + one work country; currency is derived, not typed.
  • Calculation requires a locked timesheet and active contract; others are skipped and reported, not blocking.
  • Lifecycle is draft → calculated → approved → paid (approved can reopen; paid is final).
  • Approving and posting are separate permissions; the persisted skip list is the run's to-do list.
03
Lesson 3 of 4 Reading 13 min

Gross to net, and frozen payslips

Net pay is computed in a fixed, documented order because that order is the actual legal logic, not an implementation detail. First, basic pay is prorated for unpaid-leave days (multiplying before dividing so repeating fractions do not lose cents). Then cash allowances and benefits are added to form gross. Statutory rules are applied in their configured computation order, with some flagged to reduce the taxable base as they go (for Kenya, NSSF, SHIF, and the Housing Levy reduce it). Income tax is applied last against that reduced base, with personal relief subtracted. Finally voluntary deductions come off to give net.

Every figure on a payslip is a frozen snapshot taken at calculation time — not a live join. The payslip stores its own computed breakdown line by line, plus which statutory rule-set versions it depended on. That is why a PDF regenerated months later reproduces byte-identical numbers regardless of any later rate change: the payslip is a record of what was actually paid, not a re-derivation. Line items are typed (earning, statutory deduction, employer contribution, voluntary deduction) so the breakdown is both human-readable and queryable for remittance totals.

This freezing is what makes downstream documents safe. The Kenya P9A tax certificate, for instance, aggregates a full year of these frozen payslips and reconstructs each month's figures from them — chargeable pay, gross tax charged, personal relief, and net PAYE — so the certificate agrees exactly with what was withheld. The lesson: because payslips are immutable snapshots, every report built on them inherits that immutability.

Key takeaways

  • Order: prorate basic for unpaid leave → add cash allowances → statutory (some reduce the tax base) → income tax last → voluntary deductions → net.
  • Basic proration multiplies before dividing to avoid losing cents on repeating fractions.
  • Every payslip figure is frozen at calculation time and records the rule-set versions it used.
  • A regenerated payslip PDF is byte-identical later; the Kenya P9A aggregates these frozen payslips for the year.
04
Lesson 4 of 4 Practice 10 min

Payslips, P9A, and the Payments Register

Employees see their own payslips in self-service and can view or download each as a PDF; in Kenya they can also download the annual P9A tax certificate. Self-service only ever shows payslips from an approved or paid run, because a draft or still-calculating run's figures could still change and are not final enough to show. In this release payslip self-service is for logged-in employees and the no-login PIN portal (the same token used for leave and attendance), with only finalised payslips exposed either way.

Posting a run is where payroll meets the rest of the finance system. On post, each employee's net pay is recorded as a money-out entry and appears in the cross-module Payments Register alongside vendor payments, giving one reconciliation surface for everything leaving the business. The posting also writes balanced journal entries — recognising the payroll expense and payable, then settling it — so the general ledger trail is complete. Bank and mobile-money numbers on those postings are masked, with a full number available only through a single audited reveal.

The end-to-end story to carry away is that payroll is not a silo: locked timesheets flow in, a run is calculated, approved, and posted, and the result lands in the same Payments Register and ledger the rest of the organisation already uses. That integration — payroll as money-out reconciled next to vendor money-out — is the point, not a side effect.

Key takeaways

  • Self-service shows only approved/paid payslips as PDF; Kenya adds the annual P9A certificate.
  • Payslip self-service covers logged-in employees and the no-login PIN portal; only finalised payslips are shown.
  • Posting records each net pay as money-out in the cross-module Payments Register, next to vendor payments.
  • Posting also writes balanced journal entries; payout numbers are masked with a single audited reveal.

Finished the material?

Take the 5-question assessment and earn your certificate — 80% to pass.

Take the assessment

Help Center

Need a quick answer while you read?

Run inventory, procurement, assets, sales, and field work with approved AWRA guidance for setup, migration, integrations, security, pricing, and support.

Search all approved AWRA public help articles.

Open Help Center