A Clock-In at Three in the Morning

The shift starts at six. The last night bus gets in at half past two, so one of the pickers drives instead, parks at the far end of the yard at 02:55 and sleeps in the car until the gate opens. At 03:01, half awake, they open the attendance app, press their thumb to the phone and tap Clock in. It works. The phone is theirs, the fingerprint is theirs, and the car park sits comfortably inside the two hundred metres the site was drawn with. At two in the afternoon they clock out with everyone else, and the record for the day reads a little under eleven hours.

Nobody lied about anything. Every check the system ran answered its question truthfully. The trouble is that none of those checks was asked the question that mattered, which was not “is this person here?” but “is this a time at which anyone expected them to start?”

This post is about that second question: why location controls cannot answer it, what it costs when nothing does, and how optional clock hours on an attendance site answer it for self-service clocking — and only for self-service clocking, which is the part of the design that matters most.

Where is a different question from when

A modern clock-in stacks several independent checks, and it is worth being exact about what each one proves. We have written about the oldest of the frauds they defend against in The QR That Changes Every Thirty Seconds, and about how the radius is judged in Near One of Them Is Enough. Here is the short version, with the column that usually goes unwritten.

The geofence is the one people most often mistake for a time control, because in practice nobody is near the building at three in the morning except the people who work there. That is true, and it is exactly why it fails. A radius has to be generous enough to cover the whole building plus the error of a phone’s GPS indoors, so it almost always takes in the car park, the loading bay and the pavement outside the gate. The people standing in those places are your staff, and some of them arrive early for perfectly ordinary reasons.

A geofence proves where someone was standing. It has nothing to say about whether anybody expected them to be standing there yet.

What three hours in a car park cost

It is tempting to treat an early clock-in as harmless, because the person did turn up and did work the shift. Follow the record instead of the person and the cost appears.

In AWRA OpsHub the hours worked on a day are measured from the clock-in to the clock-out. When overtime is derived for the month, any day on which those hours exceed the expected hours of the employee’s shift by a quarter of an hour or more becomes a pending overtime record for the excess. Lateness is flagged against the shift start; arriving early is simply present. So the 03:01 clock-in produces no warning on the day, and three weeks later it produces a request for nearly three hours of overtime.

Clock hours, set per site

Each attendance site in AWRA can carry its own clock hours. They are off by default, so a site behaves exactly as it always did until HR ticks Only allow clocking in/out here during set hours on the site and adds at least one time range. The form will not let the switch go on with no ranges behind it, and a site takes up to twenty.

A range has four parts: what it applies to (clock in and out, clock in only, or clock out only), the days of the week it covers, a start time and an end time. “Clock in, Monday to Friday, 05:30 to 06:30” is one range. A Saturday morning crew is another. Switching the hours off later keeps the ranges on the site and stops enforcing them, so a site can be relaxed for a stocktake week without being rebuilt afterwards.

The rule is enforced at one point, inside the verification every self-service clock-in and clock-out passes through, and that point has a deliberate place in the order of checks.

1. The device

   A registered device answers with the employee’s fingerprint or face. Without one, nothing further is checked.

2. The location

   The phone’s position is required, a reading less precise than a hundred metres is refused, and the employee must be inside the radius of at least one of their assigned sites.

3. The clock hours

   The site they are standing at is asked whether this event is open at this minute. If not, the attempt is refused here.

4. The QR code

   Only then, and only where the site requires one, is the scanned code checked.

Hours come after location because the hours belong to a site, and until the location is known there is no site to ask. They come before the QR code because a closed window is the true reason for the refusal: telling someone at 03:01 to scan the code on the wall would send them looking for a code that could not help. The refusal names the hours and the time instead — “Clock-in at North Depot is only open Mon–Fri 05:30–06:30 — it is now Mon 03:01. If you worked outside these hours, request a correction instead.” The mobile app receives its own refusal code for this case, so it shows that message rather than opening the camera to ask for a scan.

Three rules worth knowing before you draw a window

The rules live in one place in the code, read by the site form, the verification and every page that shows the hours to an employee, so the hours a person is shown are the hours they are held to. Three of them decide most of the questions people ask.

• Both ends count, to the minute. A range ending at 09:30 admits a clock-in at 09:30 and fifty-nine seconds and refuses one at 09:31.
• A night range belongs to the day it opens. A range from 22:00 to 06:00 ticked for Friday admits a clock-out at 05:30 on Saturday morning, even though Saturday is not ticked, and admits nothing on Saturday night.
• An event with no range of its own is open. Give a site clock-in ranges only and clock-out stays available at any hour, which is usually what you want: the early start is the costly event, and a late finish is rarely wrong.

Why the window never binds HR

Here is the decision that takes the most explaining. Clock hours bind self-service clocking — the web My Attendance page, the no-login time portal and the mobile app — and nothing else. HR entering a day in the attendance register is not bound. A spreadsheet import is not bound. An approved correction is not bound.

The reason is that a rule which can stop HR from recording the truth does not stay switched on. The first time a delivery arrives at five and the warehouse lead calls two people in early, the register has to say they started at five. If the clock hours refuse that, HR has two choices: switch the hours off for the site, or write 05:30 when the truth was 05:00. The first throws the control away. The second is worse, because the record is now wrong in a way that looks right, and a register that is quietly adjusted to fit a rule is the thing the rule was meant to protect.

The window stops an unattended tap from starting a paid shift. It must never stop the people accountable for the register from writing down what really happened.

The person who really did start early

Some early starts are real, and the refusal message already says what to do about them: request a correction. The correction form is on the web My Attendance page, on the no-login time portal and, for employees with permission to request one, in the mobile app. The employee gives the date, the clock-in and clock-out times they are asking for and a reason. HR approves or rejects it; an approval writes the times to the register and recalculates the hours, taking whether the day crosses midnight from the employee’s roster rather than guessing it from the two times.

The refused attempt does not disappear either. Every clock-in attempt, passed or refused, is kept with the site, the phone’s position and accuracy, the distance from the site and the reason. Refusals for a closed window appear under All failures in the attempt log. They do not appear under Needs review, which is kept for the narrower case of a valid site code alongside a failed location, as described in The Attempts That Never Became a Record. A run of 03:00 refusals from one person is a conversation worth having — about a bus timetable, perhaps, rather than about honesty.

Show the hours before anyone tries

A window nobody can see is a trap. Wherever an employee clocks in, the hours of their assigned sites are shown beside the button: “in: Mon–Fri 05:30–06:30 · out: any time”. The web page, the no-login portal and the app all read the same summary from the site, so the wording is identical in all three and in the refusal itself. The app keeps the hours on screen until both clock-in and clock-out are done for the day. HR’s site list on mobile shows each site’s hours read-only; the hours are set and changed on the web.

One thing to check before you draw ranges: the hours are read against the platform’s clock, which has one time zone for every site. If all your sites share that zone, you will never notice. If a depot sits several hours away, write its ranges in the platform’s time rather than the depot’s own.

Frequently asked questions