Payroll runs
/hcm/payroll is the HR-admin surface for running payroll. Each
pay run moves through four states — prepared → generated
→ transmitted → closed. AxisSynapse generates the NACHA file
for direct-deposit ACH transmission and routes it under a strict
4-eyes Separation of Duties: the admin who generates the run
cannot be the admin who transmits it. The transmit step itself
is step-up-protected — fresh phishing-resistant MFA at the moment
of click. Real money moves. The audit footprint is correspondingly
deliberate.
TL;DR — Open HCM → Payroll. Create or open the current period's run. Review the prepared totals. Generate pay slips. A different admin reviews + transmits the ACH file (step-up required). Close the run. Repeat per period.
Before you start
- You must be an HCM payroll admin to prepare, generate, or transmit a run. The 4-eyes rule is enforced server-side; the UI hides the wrong button for the wrong admin.
- Have your payroll calendar finalized for the workspace — pay periods, pay dates, and the lead-time required between generation and transmission. Ad-hoc runs (off-cycle, bonus, correction) are supported but follow the same workflow.
- For garnishments: orders must be loaded into the workspace before the run prepares; the engine applies CCPA / IRS Pub 1494 precedence automatically.
- For multi-state employees: verify the state W-4 + reciprocity routing in Multi-state payroll.
The four states
| Field | What it does | Accepted values / default |
|---|---|---|
| Prepared | Earnings + hours + deductions gathered for the period; ready for review. | Reversible. Re-prepare reloads from the source data; no payslips exist yet. |
| Generated | Pay slips computed for every active employee; NACHA file queued; not yet sent to the bank. | Reversible via cancel; cancel emits a paired audit event. |
| Transmitted | NACHA file sent to the bank. | Irreversible at the bank; AxisSynapse keeps the run open for void / correction at the workspace level. |
| Closed | Run finalized; recorded against the workspace's payroll history. | Reopening is supported with logging; a reopen + reclose pair is recorded. |
Prepare the run
Click "+ New pay run"
Pick the period (current, off-cycle, bonus, correction).
Pull source data
Hours from time-tracking, salary from comp records, bonus + comp adjustments approved during the period, garnishments, benefits-elections changes, FSA / HSA / 401(k) contributions.
Review the prepare report
Highlights variance from the prior run: new hires, terminations, leaves of absence (paid → unpaid), comp changes, garnishment starts / ends, FSA / HSA contribution updates, retro-adjustments from back-dated lifecycle changes.
Resolve any flagged exceptions
Examples: an employee with no active direct-deposit account, a garnishment exceeding CCPA caps, a back-dated comp change that fell outside payroll's reasonable-retro window. Each exception names what to fix.
Confirm prepare
Audit log records
HCM_PAYROLL_RUN_PREPARED. The run advances to Prepared.
Generate pay slips
From the Prepared run, click "Generate"
Pay slips compute for every active employee.
The engine runs
Federal + state + local + FICA + pre-tax deductions + post-tax deductions + garnishments + voluntary contributions + direct- deposit splits per /hcm/direct-deposit.
Review the generate report
Per-employee summary + workspace totals (gross / taxes / deductions / net / employer-paid FICA + benefits). Spot-check for outliers.
Confirm generate
Audit log records
HCM_PAYROLL_RUN_GENERATED. The NACHA file is built but not transmitted.
Transmit (4-eyes + step-up)
A different admin opens the run
The generate-admin cannot transmit. The 4-eyes rule is enforced; the Transmit button is hidden for the generate- admin.
Review the transmit summary
Total dollars going out + count of accounts + ACH effective date + remittance detail.
Click "Transmit"
Step-up modal opens — phishing-resistant (passkey or hardware key required by the platform's step-up policy for
PAYROLL_TRANSMIT_ACH).Complete step-up
On verify, the file is sent to the bank. Audit log records
HCM_PAYROLL_RUN_TRANSMITTEDat critical severity.Watch confirmation
The bank typically confirms receipt within minutes; the receipt is recorded on the run. ACH effective date is the next business day or per the file's date marker.
Why the step-up matters
A session-hijack attack that captures your normal sign-in still can't transmit payroll because the step-up at the moment of click requires a fresh phishing-resistant proof. The token is single-use and IP-bound. See Step-up authentication for the full pattern.
Voiding and reopening
| Field | What it does | Accepted values / default |
|---|---|---|
| Void a transmitted run | Reverse a pay slip that's already gone out (rare). | Step-up protected. The audit row is critical-severity; downstream artefacts (year-end YTD, garnishment counters) are reconciled. |
| Void selected pay slips | Reverse one or more slips without voiding the whole run. | Used for an erroneous employee inclusion or amount. |
| Reopen a closed run | Open a closed run to add a missing payment or correct a slip. | Emits a reopen / reclose audit pair. |
| Off-cycle adjustment | Create a new run with a small set of corrections. | Preferred over reopening for transparency. |
Garnishments
The engine applies CCPA percentage caps + IRS Pub 1494 protected minimums in the correct precedence order:
- Child support / spousal support — first; CCPA caps at 50%, 55%, 60%, 65% per family-status + arrears-status.
- Federal tax levy — second; IRS Pub 1494 protected-amount table preserves the minimum.
- Other levies (state tax, defaulted student loans) — next.
- Voluntary wage assignments — last.
- Creditor garnishments — last; CCPA caps at 25% / 30% per state law.
Audit log records HCM_PAYROLL_GARNISHMENT_APPLIED per applied
order per slip.
Every field, explained
| Field | What it does | Accepted values / default |
|---|---|---|
| Period | Pay period the run covers. | Current / off-cycle / bonus / correction. |
| ACH effective date | When funds arrive in employees' accounts. | Per NACHA spec + bank cutoff. |
| Prepare report | Variance from prior + new flags. | Read before confirming the prepare. |
| Generate report | Per-employee + workspace summary. | Read before confirming the generate. |
| Transmit step-up | Fresh phishing-resistant proof at the moment of transmit. | Always required; cannot be loosened. |
| Void / reopen | Reversal paths. | All audit-trailed; transmit reversal is critical-severity. |
Audit codes
For SIEM ingestion + compliance review, this surface emits:
See Reference → Audit codes for the
canonical description of each. HCM_PAYROLL_RUN_TRANSMITTED is
the critical-severity row — real money moves.
Common gotchas
- "I prepared a run but employees show $0 net." Direct-deposit prenote pending: the engine generates the slip but the ACH routes to a hold account until the prenote verifies. See Direct deposit.
- "Variance report shows a comp change I didn't approve." The comp review cycle's calibration-finalize event may have applied changes you weren't the proposer for. The variance row links to the audit detail.
- "Transmit button is greyed out for me." You're the generate-admin; a different HCM payroll admin must transmit.
- "My step-up failed twice in a row." Failed step-up emits
ACCOUNT_STEPUP_FAILED; repeated failures auto-pause the transmit button for ~10 minutes. Wait and retry with a fresh challenge. - "I reopened a run and the YTD shifted." Year-end totals reconcile against currently-active slips. A reopen + re-close preserves a coherent YTD; consistency is verified before the reclose accepts.
Troubleshooting
| Error code | What it means | Fix |
|---|---|---|
PAYROLL_PREPARE_INCOMPLETE_INPUT | Hours / earnings / deductions data missing. | Backfill the source data; rerun prepare. |
PAYROLL_GENERATE_BLOCKED_BY_EXCEPTION | An unresolved exception blocks generate. | Fix the named exception; retry. |
PAYROLL_TRANSMIT_4EYES_VIOLATION | The same admin who generated tried to transmit. | A different HCM payroll admin transmits. |
PAYROLL_TRANSMIT_STEPUP_REQUIRED | Step-up not completed. | Complete the prompt. |
PAYROLL_TRANSMIT_ACH_REJECTED | The bank rejected the NACHA file at submission. | Inspect the rejection reason; correct and resubmit. |
PAYROLL_REOPEN_YTD_INCONSISTENT | A reopen would create YTD inconsistency. | Use an off-cycle adjustment instead. |
Related