Keep the registers, the attendance and leave records that fed each run, payslips, proof of every remittance, the returns you filed, employee declarations and supporting proofs, and settlement documents. Storage and retention are separate questions: decide where each record lives and who can open it, and confirm how long you must hold it with a qualified advisor.
Every payroll question that arrives later is answered from records, not recollection. An employee querying a deduction from an earlier year, an auditor testing a sample, finance tracing a cost, an authority asking how a figure was arrived at: in each case you are being asked to reconstruct a run, and you can only reconstruct what you kept. The register alone is rarely enough, because it shows the result without the inputs that produced it. Keeping the attendance and leave data, the approvals and the supporting documents alongside it is what turns a number into something you can defend. Treat records as part of the run rather than as an afterthought once salaries are out.
Registers and computation output for each closed period. The attendance, leave and input files that fed them. Payslips as issued. Proof of every remittance made to an authority. The returns filed and their acknowledgements. Employee declarations and the proofs submitted against them. Employment documents that affect pay, such as offer letters, revision letters and any agreement about recoveries. Settlement statements and their working. Bank files and confirmation of what was actually paid. A [payroll system](/payroll-software) will hold several of these and none of the others, so decide explicitly where each category lives instead of assuming the software has it covered.
Storage is where a record sits and who can reach it. Retention is how long you are obliged to keep it, and that is a legal question rather than an infrastructure one. The two get conflated because both end up as folder policies, and the result is either records deleted while still needed or everything kept indefinitely with no index. Retention obligations differ by the type of record and by the law that requires it, and they change, so confirm the current position with a qualified advisor or the relevant authority rather than adopting a period you found somewhere. Then set storage to serve whatever retention you are told, not the other way round.
Fewer people than currently can, in most organisations. Payroll records carry salary, bank details, statutory identifiers and sometimes medical or family information, and access tends to accumulate: a temporary grant during an implementation, a shared folder that was convenient once, an analyst who needed a single month's file. Define access by role, review it when people change roles, and log who opened what wherever the system allows it. Keep the employee master separate from payroll output where you can, so someone who needs headcount data from an [employee database](/employee-database-software) does not need salary access to obtain it.
This is where records are quietly lost. A vendor change, a migration or a decommissioned server takes historical registers with it unless somebody extracts them deliberately, and extraction is nobody's favourite task during a go-live. Export closed periods in a format readable without the original product, verify the export by reopening a sample rather than trusting a file count, and store it where your retention policy says it belongs. If you are moving to [cloud HR software](/cloud-hr-software), confirm what happens to your archive when the contract ends, and get that answer in the agreement rather than from a support conversation. Note which system produced which period, since layouts differ and future readers will need the context.
Payslips for the periods they worked, their settlement statement and its working, tax documents for the relevant years, and sometimes a letter confirming employment or earnings for a loan or a visa. These requests arrive long after the person has left and after their access has been revoked, which is exactly as it should be, so decide in advance who handles them and how the requester is identified before anything is released. A documented request route beats an individual's email address, because the individual will change jobs and the requests will not stop. Record what was issued and to whom.
Give it an owner and a rhythm. An index listing each record category, where it lives, who may access it, how long it is held and who is responsible is more useful than a large uncatalogued archive, and it takes an afternoon to write. Review it when a system changes, when your footprint changes, and when the person who owned it moves on. Add the record step to the close of every cycle so it happens with the run rather than being reconstructed later. The test is simple: pick a closed period at random and try to produce its register, its inputs and its remittance proof without asking anyone for help.
Pitch N Hire is an applicant tracking system built for recruiters and hiring teams. If this answer described something you want to run properly, the ATS is where it lives.
Free for 1 user · No credit card · Talk to a real hiring expert
Get a personalized walkthrough of Pitch N Hire on your own roles and workflow. No slides, no obligation.
Prefer to talk? Book a demo · Talk to sales · View pricing
Free 1-user plan · No credit card · Talk to a real hiring expert
See your true cost-per-hire and how much Pitch N Hire could save you — our free Recruitment ROI Calculator gives you the numbers in under a minute. No signup required.
Open the free ROI calculatorPrefer a tailored walkthrough on your real roles? Drop your work email:
★ Free 1-user plan · No spam · Talk to a real hiring expert
