Building a Payroll Disaster Recovery Plan
7/10/2026
Payroll continuity planning is unusual in one respect: a missed payday is a legal violation, not merely a service failure. State wage payment laws require payment on the established payday, and no statute contains an exception for a ransomware event, a bank outage, or a payroll manager in the hospital.
That framing changes the planning question. It is not "how do we restore the system" but "how do we pay people on time without it."
The Scenarios That Actually Occur
Plans built around dramatic events miss the ones that happen. In practice:
Ransomware or a systems outage. Now the most common serious scenario, and the one with the worst characteristics: data may be encrypted, backups may be compromised, and the outage duration is unknown at the moment you need to decide whether to invoke a manual process.
The single knowledgeable person is unavailable. Illness, family emergency, resignation, or termination. Statistically the most likely disruption in a small department, and the most frequently unplanned for — because the plan itself usually lives in that person's head.
Loss of banking connectivity. Your bank, or your provider's, cannot originate the ACH file. The payroll is calculated correctly and cannot be paid.
Payroll provider failure. Vendor outage, an acquisition transition gone wrong, or a service termination.
Loss of facility access. Fire, flood, extended power failure, or a building closure. Less consequential now that most work is remote-capable, but it still severs access to anything stored only on-site.
Data corruption without an outage. The system runs and produces wrong results. Arguably worse than an outage, because it is not obvious.
A key vendor's breach, requiring you to disconnect from a system you depend on.
Establish Your Actual Deadline
The plan needs a number: how long you can be down before you miss a payday.
Work backward from the payday. If direct deposit files must transmit two banking days before payday, and payroll must be approved a day before transmission, your recovery window is roughly the interval between the last successful process and that transmission deadline — commonly three to four days, and shorter around holidays.
Two refinements:
Establish it per payroll group if you have multiple frequencies. A weekly population has a tighter window than a semi-monthly one.
Identify the worst week of the year. A holiday-shortened week with a bonus run has the least slack. Plan to that week, not to an average one.
The Minimum Viable Manual Payroll
The core of the plan. If the system is unavailable, what do you need to pay people approximately correctly and on time?
Data, held offline and refreshed regularly:
- Employee names, addresses, and identifiers
- Current pay rates and salary amounts
- Standard hours or schedule
- Tax withholding elections
- Year-to-date wages and taxes — required for wage bases and limits
- Active deduction elections and amounts
- Active garnishment orders with cumulative amounts withheld
- Bank account details, or the ability to issue checks
- Prior period's register as a baseline
Capability:
- A means of calculating gross-to-net without the system. A spreadsheet built in advance and tested is sufficient; building one during an incident is not.
- Check stock and signature capability, or a documented alternative
- A way to originate payments — a banking portal accessible without the payroll system, or the ability to write checks
- A method of depositing taxes without the usual system
Access:
- Credentials for the banking portal, the tax deposit system, and the payroll vendor's support channel, held by more than one person and stored securely — a password manager with break-glass access, not a note in the payroll manager's desk
- Contact details for the payroll provider, the bank, and the tax deposit system, held offline
The practical test of this section: could someone other than the payroll manager, working from documentation, pay the workforce approximately correctly? If not, the plan is incomplete regardless of what else is in it.
Our Paycheck Fundamentals Training & Certification Program covers the manual calculation the plan depends on.
Approximate Now, Reconcile Later
The most useful decision to make in advance: in a genuine emergency, pay an approximation on time rather than an exact amount late.
A defensible approach:
- Pay each employee their prior period net pay, or their standard gross less standard withholding
- Document the basis clearly
- Communicate to employees what was done and when it will be trued up
- Reconcile and correct in the following cycle, adjusting for actual hours, deductions, and taxes
Why this is preferable: a missed payday is a wage payment violation in most states, and in several it carries penalties or waiting-time liability. An approximate payment followed by a documented correction is a far better position than a late payment.
Two constraints to build in: do not skip garnishments, since a support order failure creates employer liability for the amount that should have been withheld; and do not skip tax deposits, since withheld amounts are trust funds and the penalties escalate quickly. See our garnishment guide.
Tax Deposits Without Your System
The obligation that most plans omit entirely, and it does not pause.
Federal deposits must be made electronically, and the deposit system is accessible independently of your payroll provider. What you need documented:
- Enrollment status and credentials for the federal electronic deposit system, held by more than one person
- The deposit schedule — monthly or semi-weekly for the current year
- How to compute the liability if the system cannot produce it: withheld income tax plus both shares of Social Security and Medicare
- State and local deposit portals and credentials for each jurisdiction
- Whether your provider makes deposits on your behalf, and what happens if they cannot — this is the question most employers have never asked
Note the $100,000 next-day rule still applies during an incident. A payroll processed manually can still trigger it.
The Bus Test
Address the single-person dependency directly, because it is the likeliest disruption.
- Document the cycle — what happens on which day, who approves what, how each exception is handled. One procedure per month builds a manual in a year.
- Cross-train a second person, even partially. Someone who has run one payroll under supervision is dramatically more capable than someone who has read about it.
- Hold credentials in more than one place, securely.
- Identify external backup — your provider's service bureau option, an accounting firm, or a contract payroll professional. Establish the relationship before you need it, since onboarding a new provider during an incident is not feasible.
- Document the payroll calendar and deadlines somewhere other than in one person's calendar.
See documenting payroll procedures and The Payroll Operations Procedures Manual.
Testing
A plan that has not been exercised is a document.
Annually at minimum, run a tabletop: given a stated scenario and today's date, walk through who does what, in what order, with what data. The exercise finds gaps that reading does not — expired credentials, an offline data extract that was never refreshed, a contact who left.
Test the specific things that quietly fail:
- Can you actually restore from backup, or only confirm a backup exists?
- Are the offline credentials current?
- Is the offline data extract recent enough to be useful?
- Does the second person's access actually work?
- Can you reach the provider's emergency channel?
Test after any change — a new system, a new provider, a new bank, a reorganization, or a departure. Each invalidates part of the plan.
Communication
Decide in advance who says what.
To employees: what happened, when they will be paid, whether the amount is approximate, and when it will be corrected. Silence during a payroll disruption is worse than the disruption. Draft the template now.
Internally: who is notified, who decides to invoke the manual process, and who has authority to approve an approximate payment.
Externally: the provider, the bank, and — if an incident involves data — counsel and any breach notification obligation. Payroll data sits squarely within state breach notification statutes, and a ransomware event frequently triggers them. See our payroll data security guide.
Cleaning Up Afterward
The recovery is not finished when people are paid. Every emergency measure creates a reconciliation obligation, and the ones below are routinely missed because attention moves on once the payday is met.
True up the approximation. If you paid prior-period net rather than actual, the next cycle must adjust for actual hours, real deductions, and correct withholding. Document the adjustment on the pay statement so the employee can follow it.
Verify tax deposits reconcile. An approximated payroll produces approximated withholding, which means the deposit was also approximate. Compute the actual liability and deposit any shortfall promptly — the trust fund exposure does not soften because the circumstances were exceptional.
Reconcile garnishments. Any order paid at an estimated amount needs recalculation and a correcting remittance. Under-withholding on a support order is employer liability regardless of cause, so this cannot wait for a convenient moment.
Transmit retirement deferrals that were withheld but not sent. These are plan assets, and the delay may itself require correction with lost earnings — establish the facts and involve the plan administrator rather than quietly catching up.
Reconcile to the quarter. Ensure the emergency payroll and its correction both appear correctly in the register and tie to the Form 941 for the quarter. An incident spanning a quarter boundary is worse, and worth checking specifically.
Confirm year-to-date figures are correct in the restored system, particularly wage bases, contribution limits, and cumulative garnishment amounts. A restored system with stale year-to-date balances produces wrong withholding for the remainder of the year.
Write the post-mortem while you remember. What failed, what was missing, what took longer than expected, and which assumption in the plan turned out to be wrong. This is the single most valuable output of the whole event, and it has a short shelf life.
Frequently Asked Questions
Why does payroll need a disaster recovery plan?
Because a missed payday is a legal violation rather than a service failure. State wage payment laws require payment on the established payday, and none contains an exception for a systems outage, a bank failure, or an unavailable payroll manager — with several states imposing penalties or waiting-time liability. Withheld tax deposit obligations also continue during any incident.
What data is needed to run payroll manually?
Employee names and identifiers, current rates, standard hours, tax withholding elections, year-to-date wages and taxes for wage bases and limits, active deduction amounts, active garnishment orders with cumulative amounts, payment details or check capability, and the prior period's register as a baseline. Hold it offline, refresh it regularly, and store credentials for banking and tax deposits with more than one person.
Should you pay an approximate amount or pay late?
Approximate and on time, in a genuine emergency. Pay each employee their prior period net or standard gross less standard withholding, document the basis, tell employees what was done and when it will be trued up, then reconcile in the following cycle. A missed payday is a wage payment violation; an approximate payment followed by a documented correction is a substantially better position.
What about tax deposits during a payroll outage?
They continue, and this is the obligation most plans omit. Federal deposits must be made electronically through a system accessible independently of your payroll provider, so document enrollment and credentials held by more than one person, the current deposit schedule, how to compute the liability manually, and the portals for each state and locality. If your provider deposits on your behalf, establish now what happens if they cannot.
How do you address the risk of one person knowing everything?
Document the cycle one procedure at a time, cross-train a second person to the point of having actually run a payroll under supervision, hold credentials securely in more than one place, document the payroll calendar outside one person's own calendar, and establish an external backup relationship — a provider service bureau, an accounting firm, or a contract professional — before you need it. Onboarding a new provider during an incident is not feasible.
How often should a payroll continuity plan be tested?
Annually at minimum, as a tabletop exercise walking through a stated scenario, and again after any change — new system, new provider, new bank, reorganization, or a departure. Test the things that fail quietly: whether you can actually restore from backup rather than confirm one exists, whether offline credentials are current, whether the data extract is recent enough to be useful, and whether the second person's access works.
Going Deeper
Build the plan around a missed payday being a legal violation, test it annually and after any change, and confirm that someone other than the payroll manager could pay the workforce from documentation alone.
