Employee Self-Service

The useful split is between things the employee knows better than HR does, and things the employer is answerable for. The first group should be devolved.

The test is whether the employee is the authoritative source. They know their new address and their rent receipt. They are not the authoritative source for their leave balance, their grade or their notice period, and letting those be edited in the same interface is how the record stops being reliable.

This is the point most often missed when self-service is introduced, and it shows up first in tax.

An employee submitting an investment declaration is telling the employer what they intend to invest, so that tax deducted at source can be computed on that basis. The declaration is a claim. Before the employer gives effect to it in the final quarter it has to collect and check the proof, and the deduction the employer makes is the employer's responsibility, not the employee's. A shortfall discovered later is recovered from the employer with interest, and the fact that an employee typed a number into a portal is not an answer.

The same logic runs through the rest of it.

• A leave application in the system is a request. The entitlement, the accrual and the encashment position remain the employer's to compute and to record correctly.
• Attendance regularised by the employee still has to be approved by someone with the standing to approve it, because the attendance record supports the wage payment.
• Nominee details entered by an employee do not by themselves satisfy a statutory nomination requirement where a prescribed form is required.
• The statutory registers and returns stay with the employer regardless of who entered the underlying data.

Self-service is a data collection mechanism. It is a good one. It is not a transfer of accountability, and the policy should say so in words rather than leave employees to assume otherwise.

Two changes account for most of the fraud risk in an ESS, and both look like ordinary profile edits.

• Bank account changes. An attacker with access to an employee's session, or an employee acting for someone else, redirects salary. A change should require verification through a separate channel, should not take effect in a payroll run already in progress, and should notify the previous account holder's registered contact.
• Contact detail changes. Changing the registered mobile number or email first, then changing the bank account, defeats a notification sent to the new address. Treat the two as linked and impose a cooling period.

Beyond those, a few rules keep the system trustworthy: no editing of historical payroll, leave or attendance records once a period is closed; approvals routed to a role rather than a named person, so an approval chain does not stall when someone leaves; and a full log of who changed what and when. That log is what answers a later dispute about whether an employee applied for leave, submitted a proof on time or resigned on a particular date.

Self-service works well for a desk workforce and often fails for the people who most need it, because the assumptions built into it do not hold.

• Access. A worker without a company laptop or a personal smartphone cannot use a portal designed for one, so a shared kiosk, a supervisor-assisted flow or a messaging interface has to exist.
• Language. A payslip and a tax declaration in English are not usable by a workforce that does not read English, and the resulting errors land in payroll.
• Timing. Asking a shift worker to complete a declaration during working hours means asking their supervisor to release them, which is a scheduling decision rather than an HR one.
• Trust. An employee who has never seen a payslip breakup will not raise a query about it, and silence gets read as agreement when it is unfamiliarity.

Where these are not addressed, HR ends up operating the portal on employees' behalf. That produces the worst of both arrangements: the administrative burden stays, and the record now says the employee submitted something they never saw.