How to Manage Outsourced Worker Attendance Records: Payroll and HR Internal Controls
For businesses in retail, logistics, warehousing, catering and other frontline industries, outsourced workers can provide flexibility when staffing needs change. However, when a contractor charges according to working hours and the company relies on clock-in or sign-in records to verify the service, attendance data is no longer just an administrative record. It becomes important evidence for Payroll, supplier payments and internal controls.
On 4 September 2026, the Independent Commission Against Corruption (ICAC) announced a case involving warehouse workers’ attendance records. According to the ICAC, five defendants admitted a conspiracy to defraud charge in the District Court. The case involved alleged falsification of attendance records for 13 warehouse workers over about two years and allegedly overstated working hours reported to a supermarket chain, involving wages of more than HK$3.2 million. Sentencing was adjourned to 5 March 2027. Another defendant in the same case had earlier pleaded not guilty, with the trial scheduled to begin on 10 February 2027.
The case is a reminder that outsourcing does not mean handing all responsibility for attendance, working hours and payment verification to the contractor. Employers still need to define who records, who verifies, who approves and who can amend the data.
Case source: ICAC, “Five charged by ICAC admit falsifying attendance records of supermarket warehouse workers to defraud wages totalling HK$3.2 million”, 4 September 2026. The procedural status and position of each defendant should be checked against the latest official announcement. An admission of a charge or a pending charge should not be described as a completed conviction or sentence.
What should employers learn from this outsourced worker attendance case?
According to the ICAC announcement, the arrangement involved different roles, including personnel at the company’s distribution centre, contractor management staff and outsourced warehouse workers. The contractor charged the company based on the workers’ hours, while attendance records included clock-in data and sign-in sheets verified by contractor management.
The risk is not limited to one individual’s integrity. It also concerns whether the process relies too heavily on one record or one person, for example:
• Can clock-in data be created or amended by a person connected with the process?
• Are paper sign-in sheets checked only by the same supervisor, without an independent record?
• Does the company conduct sample checks on the actual headcount and work location?
• Do contractor-submitted hours become the only basis for payment and wage calculations?
• Can former employees or applicants still be added to a timecard or duty list?
Employers do not need to wait for a major case before reviewing these controls.
Who should be responsible for outsourced worker attendance records?
A more reliable approach is to separate recording, verification, approval and payment. This reduces the risk that one person can control the entire process from beginning to end.
1. Recording: generate original data from a controlled source
Attendance data should, as far as practical, be generated by a designated system, such as:
• Clock-in records linked to a designated location or device;
• Start and end times;
• Change history and reasons for amendments;
• The worker’s contractor and work location; and
• The responsible shift supervisor or site manager.
If the company still uses paper sign-in sheets, it should establish clear rules covering who issues them, who collects them, how corrections are made, how they are stored and when they are sent to HR or Payroll for review.
2. Verification: compare the submitted hours with actual operations
After the contractor submits working hours, the company should not approve payment simply by reviewing one spreadsheet. Depending on the industry and risk level, it can use reasonable cross-checks such as:
• The actual number of workers present;
• Access or entry records at the warehouse or worksite;
• The roster and scheduled shifts;
• Work volume, dispatch records or completed tasks;
• Independent confirmation by a site supervisor; and
• Worker lists, timecards and leaver records.
The verifier should record the date, name and approval details. Writing only “checked” does not show who performed the check or what evidence was considered.
3. Approval: use appropriate approval levels
Working-hours verification and payment approval should preferably be handled by different roles. A company can set approval levels based on payment amount, headcount or unusual activity, for example:
• The department supervisor performs an initial check of ordinary hours;
• A second manager reviews a significant increase in headcount or hours;
• HR, Finance or management approves hours above the contract limit or unusual amendments; and
• The contractor’s invoice is reconciled against the verified hours report.
Payroll controls should not focus only on calculation errors
When companies discuss Payroll controls, they often think first about salary calculations, MPF or payment dates. In an outsourced arrangement, however, Payroll risk may begin with the attendance data at the start of the process.
If the original hours are unreliable, later salary calculations, contractor invoices and cost reports may still produce the wrong result even when the arithmetic is correct. Employers should therefore treat the following as one connected data chain:
Attendance record → hours verification → contractor report → invoice/payment → cost and Payroll reconciliation
Each handover should have an owner, supporting evidence and a change history. In particular, check:
• Who can add, deactivate or amend worker records?
• Who can change clock-in or clock-out times?
• Does the system retain the original data and the reason for the change?
• Who can approve exceptional hours, missed punches or manual entries?
• Are the system permissions of the contractor, site supervisor, HR and Finance excessively overlapping?
• Does the company regularly review former workers and inactive timecards?
Seven outsourced HR internal control checks for Hong Kong businesses
1. Map the full process
Document every step from worker onboarding, site access and clock-in, to supervisor verification, contractor reporting and company payment. Assign an owner to each step.
2. Make sure attendance does not rely on only one source
Depending on the business, reasonably cross-check clock-in records, rosters, access records, site confirmation and work-volume data.
3. Flag exceptions separately
Missed punches, manual time changes, last-minute shift swaps, overtime and sudden increases in headcount should not be mixed into ordinary hours without a clear marker and explanation.
4. Manage the worker data lifecycle
When a worker joins, moves location, stops working or leaves, the company should have a procedure to update or deactivate the record. Reconcile the contractor’s list with the company’s records regularly.
5. Separate recording, verification and payment permissions
An SME may not have enough staff to create complete separation, but it should at least add a second-person review, periodic sample checks or an exception report for management.
6. Put data and audit requirements into the contractor agreement
The agreement and operating process should specify what records the contractor must submit, how long they should be retained, how corrections are handled and when the company may request access or conduct a sample review. The actual terms should be tailored to the business and supported by appropriate professional advice.
7. Conduct small regular sample checks
A monthly sample review of selected shifts, workers and payments can identify problems earlier than waiting until year-end or until a complaint arises.
How can an HRIS help manage outsourced workers?
An HRIS or attendance system cannot automatically eliminate fraud or control risks. It can, however, make the data flow clearer and reduce reliance on WhatsApp messages, paper forms and repeated manual entry. Businesses may consider functions such as:
• Classifying workers by worksite, department or contractor;
• Assigning different viewing and amendment permissions by role;
• Retaining attendance-change history;
• Flagging unusual hours, duplicate timecards or implausible shifts;
• Exporting verified hours for Payroll or Finance reconciliation; and
• Producing regular management reports and sample-check lists.
System configuration still needs to match the actual process. If one person has every amendment permission, or if the system does not define who verifies the data, simply buying an HR system does not establish effective internal controls.
Five checks employers can start today
1. List all outsourced workers, contractors and work locations.
2. Trace one recent payment from the invoice back to the original attendance records.
3. Identify who can add workers, amend hours and approve payments.
4. Sample-check former workers, duplicate timecards, manual adjustments and unusual hours.
5. Classify the issues found as process, permission, system or contract issues, then assign an owner and target completion date.
How Get More can help
If your business manages many outsourced workers, or if the handover between HR, site supervisors and Finance still relies on manual spreadsheets, Get More can help organise and review a practical HR outsourcing, internal-control and HR system framework, including:
• Outsourced worker onboarding, site-transfer and offboarding records;
• Attendance, working-hours and Payroll data handovers;
• Responsibilities between HR, supervisors, Finance and contractors;
• HR policies, operating procedures and approval permissions;
• HRIS and attendance-system selection and implementation; and
• A basic framework for regular sample checks and management reports.
Where a matter involves suspected criminal conduct, legal liability or an individual dispute, the company should obtain advice from a qualified legal professional. Get More’s support focuses on HR processes, policies, systems and workforce risk management.
Want to strengthen the link between outsourced worker attendance records, Payroll verification and internal controls? Contact Get More to discuss how we can review your company’s HR processes, approval permissions and system requirements.
📞 Phone: (852) 2333 1090
📧 Email: HR@getmore.com.hk
💬 WhatsApp: 9699 0665
Further reading
Disclaimer
This content is for general informational purposes only and does not constitute legal advice. For specific situations, please consult a qualified HR consultant or legal professional.
