Alarm as Novopay security breached
A Manawatu school principal is fuming after Novopay payroll system staff allowed another school to change the pay details of one of his teachers.
Opiki School principal Bede Gilmore said the breach showed there was "opportunity for fraud on a huge scale".
The company said steps had been taken to make sure the security problem didn't happen again.
The breach occurred after one of Mr Gilmore's staff made an honest mistake in an attempt to rectify consistently incorrect payments occurring due to a payroll system glitch.
Have you or someone you know been affected by Novopay's system? Get in touch: firstname.lastname@example.org
The teacher was still being paid the same rates she had received at her previous school, and despite complaints to Novopay, the problem had persisted, Mr Gilmore said.
Attempting to rectify the issue, she returned to her previous employer for help.
An authorised teacher at the school she had previously taught at signed and filed a pay change form for Opiki School.
The problem was, neither was authorised by Opiki to make the change, Mr Gilmore said.
When he discovered the discrepancy in a new pay cycle, he immediately called Novopay's call centre to ask how the breach could have occurred.
"I would have thought someone would have checked it," he said.
Two payroll-authorised staff members are required to sign off any changes to staff pay details.
In this case, neither were from Opiki School but the change went through Novopay, unchallenged.
The mistake was a "loophole" that left schools wide open for foul play, Mr Gilmore said.
"It sort of blew my mind a bit." "Surely there must be some checks and controls that the signature of the authoriser matches the school."
Novopay business owner Rebecca Elvy confirmed a staff member's pay details should only ever be viewed or changed by an authorised user at the employing school.
"Users from other schools, including those that have previously employed the staff member, should not have this access. As soon as the [Education] Ministry was made aware of this security issue, we took immediate steps to ensure it won't happen again," Ms Elvy said.
The latest Novopay blunder adds to a growing list of complaints from Manawatu schools about the system, including teachers being overpaid, underpaid, or not paid at all.
It came to light last week that one teacher at Apiti School who had returned the $39,000 she was overpaid in one pay cycle this August, has not been paid since.
A Manawatu school principal was not paid for two months.
NZEI Te Riu Roa national secretary Paul Goulter yesterday said schools planned to bill the Education Ministry for time consumed dealing with payroll glitches.
"We expect that the final bill will run into millions of dollars," he said.
Manawatu Primary Principals Association president Debra Peck said teachers in the region had been encouraged to log time rather than "bill" the ministry for the hours spent on dealing with Novopay issues, to leave a "paper trail".
Ms Elvy said the ministry would reimburse schools for travel time and attendance at system training roadshows that began last week.
However, the ministry did not plan to pay schools for extra time spent dealing with Novopay.
"There are no plans to compensate schools for additional administration time," she said.
- Manawatu Standard
Should Manawatu's earthquake-prone buildings be yellow-stickered?Related story: Council won't use earthquake-risk stickers