In this article
- The challenge: one shift, four disconnected records
- The record that should drive every downstream process
- The approach: build a controlled deployment-to-payroll flow
- 1. Create the roster from the client contract
- 2. Capture actual attendance, not only planned attendance
- 3. Approve relief, overtime and site-transfer exceptions before payroll
- 4. Generate payroll and statutory records from verified earnings
- 5. Invoice only approved, billable service delivery
- Results: what management should measure every month
- Worked example: the 300-guard review
- Worked example: a regional guarding contractor
- Quote
- Frequently Asked Questions
- Does attendance data replace supervisor approval?
- What records should a Zimbabwe security firm retain?
- Can Odoo ERP support ZIMRA PAYE preparation?
- Which control should we fix first?
A guard has covered a night shift at a Harare industrial site, but the supervisor’s roster still shows the original guard. Payroll closes before the correction reaches finance. The employee is paid, while the client invoice either omits the shift or bills hours that cannot be supported.
Security payroll integration gives Zimbabwean security firms one approved record from deployment through to payroll and client billing. It connects the roster, actual attendance, approved exceptions and billable service delivery, so the same hours are used to pay guards, support invoices and retain auditable employment records.
For a business with hundreds of guards across multiple sites, this is not a reporting refinement. It is a control over labour cost, revenue leakage and statutory evidence.
The challenge: one shift, four disconnected records
Most control failures start when rostering, attendance, payroll and invoicing sit in separate spreadsheets or applications. Operations schedules a guard. A site supervisor records a late relief shift by phone or paper. Payroll receives a monthly total. Finance invoices from the contract schedule.
Each team can be working from a plausible version of events. The problem appears only after payroll is paid, a client disputes an invoice, or an auditor asks why an employee’s overtime does not match the available attendance evidence.
In Zimbabwe, the record-keeping requirement is specific. The Labour Act requires employers to keep records of remuneration paid and time worked for three years, and to produce them when required. Failure to keep, retain or falsify records is an offence, carrying a fine of up to level five, imprisonment of up to six months, or both. That makes the link between roster, attendance and pay operationally important, not merely an HR preference.
ZIMRA requires employers to retain employee remuneration, deductions and PAYE records for at least six years. As of November 2026, PAYE returns are due by the fifth day of the following month, while payment is due by the tenth. The shorter submission window leaves little room to reconstruct variable hours after a payroll run.
NSSA also requires employee-level identity details, employment dates, earnings, employee deductions and employer contributions, together with monthly headcount and wage-bill summaries. The monthly P4 return, P4A remittance record, P4C cessation update and annual WC50 wage declaration all depend on payroll data that can be explained at employee level.
The record that should drive every downstream process
We recommend making each approved shift the shared source record. At minimum, it should hold:
-
Guard and employee number
-
Client, site and contract reference
-
Scheduled start and end time
-
Actual check-in and check-out time
-
Overtime, absence and relief-guard details
-
Reason and approval for any exception
-
Billable hours and the billing status
This is the practical control point. Payroll should pay verified and approved hours. Billing should invoice the same approved service delivery. If the information differs, the system should show the exception before either process closes.
A planned roster alone is not enough. It shows what management intended to deliver, not what the business delivered or what it is entitled to invoice.
The approach: build a controlled deployment-to-payroll flow
An Odoo ERP implementation can create a unified operational record across deployments, attendance, payroll and invoicing. The value is not simply that data moves between modules. The value is that each change has an owner, approval status and audit history.
1. Create the roster from the client contract
Start with the site, post requirements, contracted coverage hours and agreed billing terms. Assign the scheduled guard and shift pattern against that contract record.
This matters because a guard can be present at a client site but still be working outside the approved service scope. Without the contract reference on the shift, finance cannot distinguish recoverable work from a deployment error.
2. Capture actual attendance, not only planned attendance
Attendance may come from biometric devices, mobile check-ins or supervisor validation, depending on site conditions. The deployment record should retain the scheduled hours and actual hours separately.
The most common mistake we see is paying scheduled hours by default when a biometric or mobile check-in is missing. A missing check-in is an exception to investigate, not proof that the scheduled shift occurred. The correct workflow records the reason, such as a device outage or emergency site transfer, and requires an authorised approval.
3. Approve relief, overtime and site-transfer exceptions before payroll
Relief guards and overtime are normal features of guarding operations. They become expensive when approval happens in messages after the payroll cutoff.
Set an exception queue for unfilled rosters, late check-ins, early check-outs, overtime, unapproved site transfers and shifts without a billable code. Operations should resolve the queue before payroll receives the approved hours.
This is where a multi-entity security group needs discipline. If one entity employs the guard and another entity holds the client contract, the system must retain both legal entities and the intercompany approval path. Otherwise, group reporting can hide unpaid intercompany labour or revenue posted to the wrong entity.
4. Generate payroll and statutory records from verified earnings
Connected attendance data supports complete earnings uploads in ZIMRA’s TaRMS Employee Management Module. The module supports individual or bulk employee registration and earnings uploads, then auto-populates PAYE and AIDS Levy. Variable shifts, overtime and allowances should be included from approved records, rather than added as unexplained payroll adjustments.
NSSA Pension and Other Benefits Scheme contributions are currently 4.5% from the employee and 4.5% from the employer, capped at a gazetted insurable-earnings ceiling per employee. The ceiling is subject to gazetted changes, so payroll teams should check the current rate and ceiling before every payroll run.
Do not hard-code a security-sector wage increase based on the October 2026 reports. The reported wage award is under appeal by employer associations as of November 2026, and revised rates should not be treated as settled until the arbitral award and appeal outcome are confirmed through the NEC or Labour Court.
5. Invoice only approved, billable service delivery
Once payroll-approved hours are marked against the client contract, invoicing should draw from the same approved shift record. A shift can then be classified clearly as paid and billed, paid but awaiting billing, non-billable with an approved reason, or disputed.
That visibility gives finance a direct route to investigate margin loss before month-end, rather than discovering it after a client rejects an invoice.
Results: what management should measure every month
A connected Odoo ERP process should produce operational indicators that a COO and CFO can use without rebuilding reports in spreadsheets.
| Indicator | What it reveals | Why it matters |
|---|---|---|
| Unapproved paid hours | Hours paid without an approved client billable code | Identifies direct labour cost that may not be recoverable |
| Roster-fill rate | Filled shifts against required shifts | Shows whether contracted coverage is being delivered |
| Attendance exception rate | Exceptions as a share of shifts | Highlights weak site controls or unreliable capture methods |
| Overtime-to-rostered-hours ratio | Overtime against scheduled hours | Identifies persistent understaffing or poor deployment planning |
| Billable-to-paid-hours ratio | Approved billable hours against paid hours | Measures the link between labour spend and revenue |
| Payroll correction rate | Post-payroll changes as a share of payroll entries | Shows whether approvals are occurring too late |
| Invoice dispute rate | Disputed invoices against invoices issued | Indicates whether service evidence supports client billing |
Worked example: the 300-guard review
Take a 300-guard firm that finds 180 paid hours in one month with no approved client billable code. Every one of those hours carries a loaded labour cost the firm has already paid, with no invoice behind it. The management question is: were those hours a valid but unbilled relief deployment, an overtime approval failure, or work performed outside contract scope?
With disconnected spreadsheets, the finance team may only see a payroll variance. With security payroll integration, the operations manager can see the guard, site, supervisor approval and missing billing status in one exception list. The firm should not assume all of that cost is recoverable. It should first classify each shift, then correct the workflow that allowed paid hours to reach payroll without a billable or approved non-billable code.
Worked example: a regional guarding contractor
Consider a regional contractor with twelve staff in the payroll office and 40 active client sites. A relief guard covers two shifts after a late absence, but the supervisor changes the roster only after payroll has closed. The guard is initially underpaid, while the client is invoiced against the original roster and asks for supporting attendance evidence.
A controlled deployment process records the relief assignment at the time of approval, captures actual attendance, and flags it for payroll and billing review. The contractor avoids a second payroll correction and can provide the client with a consistent site-service record. If the business has fewer than 20 guards and one or two stable sites, a full enterprise implementation may be disproportionate. It should still establish the approved-shift record and exception workflow before adding more complex automation.
Quote
“The approved shift should answer two questions at once: what are we paying for, and what are we entitled to bill?”
That is the standard we use when assessing security operations. If payroll cannot trace an earnings line to a verified deployment record, the business has a control gap. If billing cannot trace an invoice line to the same record, the business has a revenue-risk gap.
Frequently Asked Questions
Does attendance data replace supervisor approval?
No. Attendance captures evidence of presence or time worked, while supervisor approval explains exceptions such as device failures, relief deployment, overtime and site transfers. Both records are needed for an auditable payroll process.
What records should a Zimbabwe security firm retain?
Keep remuneration and time-worked records for three years under the Labour Act. Keep employee remuneration, deductions and PAYE records for at least six years for ZIMRA. NSSA also requires employee-level earnings and contribution records, plus monthly and annual wage information.
Can Odoo ERP support ZIMRA PAYE preparation?
An Odoo ERP implementation can consolidate approved earnings, deductions and employee-level payroll data for the PAYE process. The final return still needs to follow ZIMRA’s TaRMS Employee Management Module and PAYE return requirements.
Which control should we fix first?
Start with the approved shift record. If the business cannot identify the guard, site, contract, actual hours, exception approval and billing status for each paid shift, adding more payroll reporting will not solve the underlying problem.
With SERPA and Odoo ERP, every approved shift pays the guard correctly, supports the client invoice and leaves the statutory record ZIMRA, NSSA and the Labour Act expect. Labour cost stops leaking, invoice disputes fall and month-end stops being a reconstruction exercise. We assess the deployment-to-payroll controls, data ownership and integration points that affect payroll accuracy, client billing and statutory records, then scope the solution to your sites and headcount. Book an ERP Readiness Audit and request a quote tailored to your operation.