Have the agent trace every change in this payroll back to the record that authorised it. It compares the draft run with the last one, links each difference to an approved HR, manager or committee record, and runs fraud checks such as shared bank accounts. Anything it cannot trace becomes an exception. The payroll manager clears exceptions and a named approver signs off the run.
What is the pre-run check, and who owns it?
Before each payroll run, someone should confirm that every change since the last run was authorised and entered correctly: new starters, leavers, pay rises, overtime, bonuses, deductions, bank detail changes. In practice that check is often a quick look at total gross pay against last month. Errors and payroll fraud live in the detail, and the detail is what an agent can read in full.
The payroll manager owns the check and the exception list. HR owns the employee records and pay changes. Line managers own overtime and allowances. A finance director or equivalent approves the run before payment. The wider finance position is in AI agents for finance: books you can audit.
How does the agent check, step by step?
- Agent, depth 1: reads the draft run and the previous run. Every employee, every pay element, gross to net. Evidence: both runs identified by reference.
- Agent, depth 1: lists every difference. By employee and element: new, removed, increased, decreased. Evidence: the difference list.
- Agent, depth 1: traces each difference to its authority. A salary change to the HR record approved by the named approver. A starter to a signed contract and start date. A leaver to the termination record. Overtime to the manager's approval. A bonus to the approval that set it. Evidence: the source and approver linked to each difference.
- Agent, depth 1: runs the integrity checks. Two employees paid into the same bank account. Bank details changed shortly before payday. Leavers still paid. Pay with no hours or attendance. Net pay of zero or below. One-off payments above a threshold. Evidence: each check and its result.
- Agent, depth 2: drafts the exception list. Every untraced difference and every failed check, with what was expected and what was found.
- Person, payroll manager: clears exceptions. Fixes errors in the payroll system, obtains missing approvals, or confirms the item with a reason. Evidence: the clearance and reason per exception.
- Agent, depth 1: re-checks after corrections. Evidence: a second run of the checks on the corrected draft.
- Person, run approver: approves the run. With the cleared exception list in front of them. The payment itself is released by people under your payment controls.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read runs | Reads draft and previous | 1 | Nothing |
| Differences | Lists every change | 1 | Nothing |
| Trace | Links changes to approvals | 1 | Nothing |
| Integrity | Runs fraud and error checks | 1 | Nothing |
| Exceptions | Drafts the list | 2 | Nothing |
| Clear | Nothing | None | Payroll manager |
| Re-check | Repeats checks after fixes | 1 | Nothing |
| Approve and pay | Nothing | None | Run approver and payment release |
Why does the agent check but never correct?
Because payroll errors cut both ways and every correction affects a person's pay. A salary keyed wrongly might be an error, or it might reflect a late change HR has not yet recorded. Correcting it to match the HR record could underpay someone who was promised the higher figure. Only a person can find out which it is.
There is also a control reason. If the same agent found and fixed exceptions, the evidence that a check happened would disappear into the fix. Separate roles give the auditor a clean trail: found, investigated, cleared by a named person. The case for agents preparing changes for approval, rather than entering them, is set out in letting an AI agent prepare payroll changes for approval. The broader question of how far an agent can go is in can an AI agent run payroll.
Which controls matter, and what evidence do they leave?
Every difference traced. Evidence: the difference list with a source or an exception against every line.
Integrity checks on every run. Evidence: check results filed with the run reference.
Read-only access. The agent cannot change payroll data. The connection is scoped as described in connecting an AI agent to your payroll system. Evidence: all verdicts at depth 1 or 2.
Exceptions cleared by name. Evidence: the clearance log.
Re-check before approval. Evidence: the second check result on the final draft.
What should you measure?
- Exceptions per run, and how many were real errors.
- Post-run corrections, such as emergency payments or recoveries. The figure that should fall.
- False positives, which show where tracing rules need refinement.
- Time to clear the exception list before the cut-off.
- Integrity check hits, especially shared bank accounts and late bank changes.
Where does it usually go wrong?
Approvals live in email. A manager approved overtime in a message the agent cannot read, so every overtime line is an exception. Route approvals through a system the agent can see, or accept a heavy exception list while you fix it.
Timing differences. A pay rise approved after the cut-off appears in HR but not payroll. Not an error, but the exception list must say "approved after cut-off" so the manager knows to carry it forward.
Bank detail changes are trusted. An employee's bank details changed by an email request two days before payday is the classic payroll fraud. Flag every recent change and confirm it through a known contact.
Totals hide offsetting errors. Gross pay matches last month because one overpayment cancels one underpayment. Check by employee and element, not by total.
Where Pryme fits
In Pryme, the payroll checking agent holds read capabilities only, so finding an exception and fixing it can never be the same act. Each difference it traces is filed with the approval it matched, giving the run approver and the auditor one record of what was checked.
Questions people ask
Can the agent check payroll for many entities at once?
Yes, if each entity's runs and approval sources are connected. Keep exception lists separate per entity, because approvers and cut-offs differ.
Does the agent see salaries?
It must, to check them. Limit who can read its exception lists, and keep its access to payroll data separate from its other work. Salary changes themselves are discussed in can an AI agent change an employee's salary in payroll.
What if the run is urgent and exceptions are not cleared?
The approver decides whether to run with open exceptions and records why. The agent's list shows exactly what was approved with known issues.