Managed Payroll Provider Australia: six key questions on process and tech 2025
If you’re thinking about managed payroll, don’t start with a vendor demo. Start with sharper questions. The right partner will shorten quarter-end, lower risk, and give you cleaner data for decisions. The wrong one adds new mystery steps between you and the ATO. Here are the six questions that separate the two.
1) What exactly are we outsourcing and who holds the pen with the ATO?
Spell out scope in verbs, not marketing nouns. Are you asking for processing only (import timesheets, run pays, produce files), or compliance and lodgement too (interpreting awards/EBAs, mapping STP Phase-2 items, lodging STP, reconciling W1/W2, preparing SGC statements when needed)? If the provider will lodge STP on your behalf, they must be a registered tax or BAS agent, linked to you, using STP-enabled software, with the software ID notified to the ATO. Each STP pay event is an approved form that requires a declaration from someone authorised to lodge; you can give a standing STP engagement authority to your agent, but the declaration still matters.
What this really means is you can outsource the how, but you still own the truth of what’s being reported. Demand a one-page RACI: who calculates, who checks, who pushes the button, and who signs the declaration each run. If a provider can’t show this cleanly, keep looking.
2) How do you handle STP Phase 2, today and when things change?
Phase 2 killed the “single gross” habit. Your STP file must disaggregate ordinary time, paid leave, allowances by purpose, overtime, bonuses/commissions, directors’ fees and salary sacrifice so ATO data matches the payslip story. Ask the provider to show a live STP pay-event preview that mirrors payslips line-for-line before lodgement, and to walk you through their change control when a new allowance appears (e.g., first-aid, laundry, travel). If they bury “all-purpose” amounts in base, you’ll keep failing reconciliations and burning time at BAS.
Non-negotiable: the provider must run an STP preview every pay and reconcile it against draft payslips before lodging. That simple ritual prevents most quarter-end archaeology.
3) Who owns W1/W2 and BAS alignment?
Your BAS isn’t a separate reality. W1 (payments subject to withholding) and W2 (amount withheld) should fall out of payroll logic and match ATO prefill sourced from STP. Ask for a standing W1/W2 view as part of every run, and a monthly pack that shows any variances and the fix. If a partner can’t produce W1/W2 on demand, they’re guessing at quarter-end or making you do the work.
A quick test: pick a recent pay, total the items subject to withholding, and match to the provider’s W1 figure. If it doesn’t tie, you don’t have a tax problem; you have a mapping problem no one owns.
4) Are you built for super now and for payday super next year?
Two realities. First, SG is 12% on payments made from 1 July 2025, even if the pay period straddled June. Second, from 1 July 2026 you’ll move to payday super, the ATO’s Small Business Superannuation Clearing House will close, and no new registrations are allowed after 1 October 2025. Ask the provider to show: (a) their accrual logic at 12%, (b) a per-pay contribution model with reconciliation to clearing confirmations, and (c) their migration plan off the SBSCH with cut-over dates and testing. If they’re hand-waving cash-timing questions, that’s your cue to walk.
Also ask how they surface accrued vs paid by employee and fund. In 2026, contribution timing will bite faster; you want a monthly ageing report now so missed batches don’t become SGC pain later.
5) What are your security and privacy baselines, for money and TFNs?
Payroll fraud is rarely cinematic; it’s usually a believable email that changes bank details or a quietly altered ABA file. Your provider should enforce maker–checker on pay batches and bank-detail changes, keep ABA/Direct Entry files in restricted storage (no email), and run MFA on payroll, HRIS and banking. In Australia the baseline is the ACSC Essential Eight, ask them to name their target maturity and show evidence (e.g., admin MFA, patch windows, backups).
On privacy, treat TFNs as regulated identifiers, not “just personal data.” The Privacy (Tax File Number) Rule 2015 and OAIC guidance require reasonable steps to protect TFN information and limit its use to what tax/super law allows. Ask where TFN data lives, who can access it, how long it’s retained, and how they’ll manage Notifiable Data Breach assessments if something goes wrong. If answers are vague, assume the controls are too.
6) If we need to leave, how portable is our payroll?
Exit is where many “managed” deals get sticky. You’ll need more than PDFs. Ask for data portability in the contract: export of employee master data, pay-item catalogue with STP mappings, historical STP lodgements, W1/W2 history, super clearing confirmations, ABA audit logs and configuration notes (earnings/OTE flags, allowance purposes). You also want their STP correction playbook (update events, re-lodgements) so your YTDs reconcile before finalisation. The ATO publishes correction and checklist guidance, your provider should operate against it, not invent their own rules.
Finally, check payslip and records obligations survive the relationship. You still must issue payslips within one working day and keep time-and-wages records seven years. Make sure your provider’s process guarantees both, and that you have access to the source records if something’s disputed later.
What a good managed-payroll setup looks like
One calendar, shared. Cut-offs, pay days, STP lodgement times, super payment cycles, BAS months, and EOFY finalisation targets live in a shared calendar the provider owns with you. The runbook names who is “on the hook” each step. (STP is due on or before pay day; finalisation must be declared by mid-July unless you’re on the closely-held timetable.)
Two mirrors, every pay. A Phase-2 STP preview that equals payslips line-for-line, and a W1/W2 view that equals the BAS labels. No green lights, no pay. Boring? Good. That’s the goal.
Super that runs like clockwork. Accrued vs paid reports, monthly ageing, clearing confirmations attached to the pay-run pack, and a tested plan for payday super and SBSCH exit well before 1 Oct 2025 new-registrations cut-off.
Security you can describe in a sentence. “One person builds, another approves; MFA on all the things; ABA files never emailed; TFNs encrypted and access-controlled; backups tested.” If the provider can’t say it that simply, they probably don’t run it that simply.
Corrections without drama. Mistakes happen. What matters is the correction path: update events lodged under the correct authority, re-issue of payslips if needed, W1/W2 re-reconciling, and a single email that explains “what changed, why, and where it’s fixed.” The ATO’s checklists set the standard; your provider should align to them.
Red flags that say “no”
- They can’t show disaggregated Phase-2 mapping (allowances by purpose, salary sacrifice separated, etc.).
- W1/W2 is something they “work out at BAS time.”
- Super is still quarterly with fuzzy reconciliation, and no plan for payday super or SBSCH closure.
- Security is hand-wavy and the TFN Rule is news to them.
- Exit terms give you PDFs, not config and history.
How to buy this properly (a short playbook)
- Define the job. Write a two-page scope that names payroll frequency, headcount, awards/EBAs in play, STP & BAS cadence, super cadence, banking model (ABA/Direct Entry), and the reports you expect each run (STP preview, W1/W2, super accrued vs paid, ageing).
- Assess Phase-2 competence. Ask for a live demo showing an allowance added and correctly tagged (travel vs car vs first-aid), then watch the STP preview and payslip reflect it instantly.
- Probe super timing. Make them walk you through a per-pay contribution, reconciliation to clearing confirmations, and the migration off SBSCH with dates.
- Test security and privacy. Request their Essential Eight target maturity and evidence; ask where TFNs sit, how they’re restricted, and how NDB assessments happen.
- Lock exit and ownership. Bake data-portability and configuration export into the contract. Add an operational clause: if they miss the one-day payslip rule or STP lodgement timetable, consequences apply.
Bottom line
Managed payroll should reduce moving parts, not hide them. Hold the provider to the same standard you’d hold your internal team: STP that matches payslips, W1/W2 that matches BAS, super that’s accurate at 12% now and ready for payday super next year, and controls that would make your auditor yawn. Get those right and payroll stops being a source of noise, and becomes quiet infrastructure you don’t have to think about.