SOC 2 by industry

SOC 2 for HR and payroll tech: records, pay runs and who can touch them.

Q: We run HR records but not payroll. Do we still need Processing Integrity?

Probably not. Without pay calculation, the main risks are confidentiality and access. Processing Integrity tends to earn its place when your output is a number customers rely on, such as pay, accruals or tax.

Q: Does one wrong payslip mean an exception?

Not by itself. The auditor tests controls, not outcomes. A wrong payslip that your variance check caught and corrected can be evidence the control works. An error that passed a control which should have caught it is more likely to be an exception.

HR software holds what an employer knows about its people: salary, bank details, tax identifiers, health leave, performance notes. Payroll software then moves money on that data. Buyers ask two questions at once: is the data kept to the right people, and is every pay run right? This guide covers how both show up in a SOC 2, and where a customer will want a different report.

Back to SOC 2 services

01 · Who asks

Who asks HR tech companies for a SOC 2 report

The buyer decides the scope and the weight of the report, so start with who is asking.

Asked by	What they want to see
Chief people officer or HR operations lead	Whether managers see only their own reports and whether sensitive fields like health leave are hidden from them.
Customer's security team	Production access, single sign-on enforcement, and how bulk exports of employee data are controlled.
Customer's finance team and external auditor	Evidence that payroll calculations and payments are controlled, often in a SOC 1 rather than a SOC 2.
Works council or employee representative	In some countries, what data is processed about staff and for what purpose.

02 · What is in scope

What sits inside the system boundary

The report covers one system. In this sector the boundary usually takes in:

Employee master data: Identity, contract, salary, bank account and tax details, plus the change history of each field.
Pay calculation engine: Rules for gross-to-net, deductions and statutory tables, and the release process for updating them.
Payment file generation: The step that turns an approved pay run into a bank file or a payment instruction.
Manager and employee self-service: Where people view payslips and update their own details, which is also where account takeover does damage.
Integrations: Feeds from time-tracking, benefits and accounting systems, each one a source of input errors.

03 · Categories

Which Trust Services Categories matter here

Security is always in. The rest depend on what you promise customers.

Category	Weight in this sector	Why
Security	Always	Required; here it is mostly role design across HR, managers, finance and support.
Confidentiality	Strong	Compensation, performance and disciplinary records are confidential to the customer by contract.
Processing Integrity	Strong for payroll	A pay run that is incomplete, late or wrong is the failure customers fear most.
Privacy	Often	Considered when you make direct commitments to employees about notice, access and correction.
Availability	Sometimes	Pay dates are fixed; customers ask about recovery near payroll cut-off.

04 · Vendors in the report

The vendors that appear in your report

Each one is a subservice organization or a carve-out, and the report has to say which.

Cloud host: Usually carved out, with your own controls over configuration and access kept in scope.
Payment or banking partner: Receives payment files. Often carved out; the report should state the hand-off point and the reconciliation you run after it.
Tax table or statutory data provider: If you rely on a supplier for rates, describe the control that checks each update before it goes live.
Background check or benefits partners: If they receive employee data through an integration, name them and the data they get.

05 · Sector controls

Controls that this sector makes necessary

Examples only. Your own wording is what the auditor tests.

S.1
Bank detail change verificationA change to an employee's bank account triggers a notice to the employee and, above set conditions, a second approval.
S.2
Pay run four-eyes approvalA pay run is prepared by one person and approved by another before the payment file is released.
S.3
Pre-release variance checkEach pay run is compared with the previous one; changes beyond a threshold are explained before approval.
S.4
Statutory rule change testingUpdates to tax and deduction tables are tested against worked cases and approved before release.
S.5
Field-level access for sensitive dataHealth leave, disciplinary notes and identifiers are hidden from roles that don't need them.
S.6
Post-payment reconciliationPayments confirmed by the bank are matched to the approved pay run, and differences are investigated.
S.7
Support access to customer tenantsSupport staff enter a customer tenant only with customer consent or a ticket, and access is time-boxed.

06 · Traps

Where companies in this sector slip

Predictable, and cheaper to fix before fieldwork.

Assuming SOC 2 answers a finance auditor. Payroll feeds customers' financial statements. Their external auditor often wants a SOC 1 on controls over that processing.
Testing role design only at the platform level. Customers configure their own roles. The report should say which access controls are yours and which are CUECs.
One engineer who can change rules and release them. Separation of duties in the rules engine is often missed on small teams.
No evidence that variance checks happened. If the check lives in someone's head, there is nothing to sample.
Overlooking off-cycle runs. Bonus and correction runs often skip the approval path the normal run follows.

07 · Separation of duties

Separation of duties in a pay run

The auditor wants to see that no single person can both create and release a wrong payment.

Step	Who should do it	Who should not
Change an employee's bank details	The employee, or HR with verification	The person who releases the pay run
Prepare the pay run	Payroll administrator	The approver of the same run
Approve the pay run	A second, named approver	The preparer
Change calculation rules	Engineering, through change control	The engineer who approves the release
Reconcile bank confirmations	Finance or payroll operations	The preparer, where team size allows

Some of these steps are performed by your customer in your product, not by you. The system description should say which separations your platform enforces and which it leaves to customers, and list the latter as complementary user entity controls.

Small teams can use compensating controls, such as an after-the-fact review by a manager, where full separation isn't possible. Document them before the period starts.

08 · Evidence

Evidence to have ready

What an auditor will ask for, in the order they usually ask.

Role and permission matrix, including the field-level restrictions
Sample of bank detail changes with the notice and approval trail
Sample of pay runs with preparer, approver and variance explanations
Change records for statutory table and calculation rule updates
Reconciliations of bank confirmations to approved runs
Support access requests and session logs for customer tenants
The list of CUECs given to customers

When the customer's auditor needs SOC 1

Payroll processing can affect a customer's internal control over financial reporting, so their external auditor may ask for a SOC 1 report under AT-C section 320. A SOC 2 covers security and the other categories; a SOC 1 covers control objectives tied to financial reporting. Many payroll providers carry both. Neither is a finding of compliance with employment or data-protection law.

Sources: AICPA Trust Services Criteria (TSP section 100, 2017, revised points of focus 2022), including PI1.1 to PI1.5; AICPA attestation standards AT-C section 205 and AT-C section 320; AICPA description criteria (DC section 200); AICPA SOC 2 guide.

More about SOC 2 for HR tech

We run HR records but not payroll. Do we still need Processing Integrity?

Probably not.

Without pay calculation, the main risks are confidentiality and access. Processing Integrity tends to earn its place when your output is a number customers rely on, such as pay, accruals or tax.

Can our customers' admins break our controls?

They can, which is why CUECs exist.

If a customer gives every HR user full admin rights, your platform can't stop them. The report should list the complementary user entity controls you expect, such as customers reviewing their own role assignments.

Does one wrong payslip mean an exception?

Not by itself.

The auditor tests controls, not outcomes. A wrong payslip that your variance check caught and corrected can be evidence the control works. An error that passed a control which should have caught it is more likely to be an exception.

Should we do SOC 1 or SOC 2 first?

Ask who is asking.

If finance teams and their auditors are blocking deals, start with SOC 1. If security reviewers are, start with SOC 2. Many controls are shared, so the second report usually builds on the first.

Scope your HR tech SOC 2 around what buyers ask.

A readiness assessment turns this into your boundary, your categories and your gaps.

Get a SOC 2 readiness assessment Book a free consultation Back to SOC 2 services