Be very careful who you trust your payroll processing to. The industry is not regulated, and if there is a problem, you are on the hook with the IRS and your employees, and not the payroll processor.
We found this out the hard way. Several years ago, we signed up with a small payroll processing outfit, because they were willing to work with our back office automation needs and about 20% of what ADP charged. After an initial rocky start to get things lined up between our system and theirs, it went pretty smoothly...for four payroll cycles (monthly). Then they missed a tax payment. We called up, they already knew about it, and they paid within the week and the penalties and interest. We started watching the transactions carefully. Two months later, they filed Chapter 7.
And the owner took all our tax payments that month with him.
If you find yourself in the same situation, let me save you some time. Just pay the IRS directly, pay your employees again, then immediately find the bankruptcy case and get in touch with the assigned bankruptcy trustee. We wasted a lot of time finding out that unless you are talking in amounts of greater than $500K, the IRS will not help with either pursuing the perp, or extending any forebearance measures; the state attorney's office will be completely uninterested; likewise the FBI (interstate funds transfer) or US Postal Service. Small business owners are completely on their own.
What saved us in this incident? My "business paranoia", which caused me to insist:
- We set up a Bank of America "private account", and made our existing checking account a "public account". From that time onward, literally the only entities who know about the private account are BofA and the owners of the company; it is never divulged elsewhere under any circumstances. The public account became known as the "E-xfer", or "electronic transfer" account. Our banker was very helpful in getting this set up for us, and it didn't cost us anything extra with our existing commercial account because we kept a large enough balance.
- We still handled all actual payroll issuing, and "firewalled" the payroll processor to just handling the taxes, which required special procedures to set up on both sides because the default payroll processing model is all funds are deposited with the processor and the processor cuts the checks or generates the direct deposit.
If we had set up the way they normally expected, our entire payroll would have disappeared that month. We would have never survived that. It put a pinch on our cash flow, but we still survived (and are thriving today). As luck would have it, I had a project that put me in the city of the payroll processor's offices as this was unraveling. I was able to find the office and confront the owner on the very day he was moving out of the office, but it was an unsatisfying encounter (he lawyered up). We're still trying to recover the funds from him by working with the IRS.
After the initial scramble to pay the IRS, we turned back to our CPA to temporarily handle payroll for a few cycles while we surveyed the payroll processor industry. We now process our payroll through PeachPay, after adding the following requirements to the above.
- Verify that at no point is our data ever shipped offshore. We're scared witless that the SSN's will be hijacked in a mass identity theft, and our only recourse is retaining legal counsel in a foreign nation. This is why Bank of America payroll processing lost out in our survey; they could not demonstrate satisfactorily that the data does not ever leave the country.
- "Two strikes" rule: one anomaly in processing allowed per year; terminate immediately on second anomaly in the year.
- Run the check cutting during the first six months of payroll cycles completely by ourselves. We insisted upon being able to use the payroll processing service as just a fancy "generate the numbers" system for the first six months. Each cycle we would plug in the wages into the payroll processor's web site and copy out the taxes, withholdings, etc., then manually go to EFTPS (for the IRS) and state unemployment insurance web sites to file the payments (which were electronically linked to our public account). This was a real pain, and if I had to do it all over again I would hesitate a long time before committing to it.
Hope this helps, I never want another small business owner to have to go through what I did.
Even after all these precautions, we still worry about this, although practically we have settled for the status quo for the time being. Our nightmare scenario goes like the following. Whoever we pick, no matter how big or how flawlessly they have processed for many others for years and years, decides one day to send a portion of the processing offshore. Unbeknownst to them, the folks offshore scoop up all payments in one of the payroll cycles (likely end of calendar year when big bonuses are commonly transferred around). We get left out in the cold again, but this time there isn't even the emotional satisfaction of knowing that the perps could spend time in Club Fed, because it happened offshore.
There is another area for fraud that could be fixed in the shorter term. We wish Bank of America (or some bank, somewhere) would offer a self-managed electronic transfer accounts system, so we could create on demand new accounts that are tied to our private/primary account, but always defined with a maximum cap and optional expiry date. We could then control which account each vendor has access to, how much they could draw out, and optionally how long before the account withdrawl permission drops back to zero. Today, more than just a few vendors have shared access to our E-xfer account, we have to manually manage transfers from the private account, and I know it is only a matter of time before an excessive withdrawl is performed causing a cascade of problems for our other vendors.
Longer term, as we continue to grow, we're working out how to inexpensively insource this function, much as we prefer to outsource it. The chain of data custody is simply too obscure and unguaranteed for our comfort level going forward, and we're always going to be the liable party in the immediate term (and for all practical purposes, forever). The capacity for fraud is simply too great to ignore, and even with the big processors little guys like us just get trampled when push comes to shove. My preference is a market-enforced regulation, but I've yet to find a payroll processor who is bonded and insured with a Lloyd's-grade underwriter with a gold-plated Fitch rating. I'd really rather be able to make a claim on someone who absconds with
the funds and get immediately paid by an underwriter (who in turn will
put their significant resources to work on finding and apprehending the
perp). In the absence of that, I would settle for a regulatory environment that is actually enforced.
