Why Payroll Compliance is Australia’s Next Boardroom Risk

Australian boardrooms have faced a reckoning over the past five years. From household-name retailers to universities and large corporations, the headlines are consistent: significant underpayment scandals, multimillion-dollar penalties, and reputational damage that takes years to repair.
What was once treated as a payroll problem is now a governance issue. In today’s environment, CFOs, finance directors and executives cannot afford to view payroll compliance as “just operations”. It is a trust issue that can move share prices, unsettle investors and erode brand equity.
This article explains why payroll compliance has climbed the board agenda, the real costs of getting it wrong, and how modern technology can keep Australian enterprises audit-ready and protected.
The compliance landscape has shifted
Three changes have pushed payroll from the back office to the board table.
- Criminal liability for deliberate underpayments
Intentional wage underpayment is now a criminal offence for conduct from 1 January 2025, with matters investigated by the Fair Work Ombudsman and referred for prosecution where appropriate. Small businesses can avoid prosecution by following the Voluntary Small Business Wage Compliance Code. - Stronger enforcement and higher recoveries
The Fair Work Ombudsman reported $473 million recovered for nearly 160,000 underpaid workers in 2023–24, with more than half coming from large corporations. The regulator also secured record court-ordered penalties and continues to target large employers, universities, construction and care sectors. - Relentless public and investor scrutiny
High-profile investigations and enforceable undertakings have kept underpayments in the news cycle. The University of Sydney, for example, agreed to repay more than $23 million and make a payment, with sector-wide probes continuing.
The real cost of getting it wrong
Boards typically see the headline remediation number. The true cost stack is broader.
- Back pay and on-costs
Wages, allowances, overtime, penalties and superannuation. Past periods often require interest and tax adjustments. - Civil or criminal penalties and enforceable undertakings
Depending on the conduct, penalties can include significant fines, enforceable undertakings with independent audits, and, for intentional underpayments from 1 January 2025, potential criminal prosecution. - Forensic reviews and advisory fees
Multi-year lookbacks demand legal counsel, specialist IR advice and data engineering, with material consulting costs. - Operational disruption
Payroll freezes, off-cycle payments and manual workarounds delay close and distract finance, HR and operations. - Talent and brand damage
Rising pay queries, staff turnover and leadership airtime spent on remediation instead of transformation. - Customer and contract risk
Major buyers and government panels increasingly require evidence of robust workplace law compliance in procurement.
Why companies trip up
Underpayments rarely come from a single error. They are usually the product of system, data and process gaps:
- Award and agreement complexity across sites, roles and classifications
- Enterprise agreement drift from the underlying award, especially where BOOT checks are manual
- Annualised salary risk where salaries do not reconcile with what the applicable award would have delivered for actual hours worked
- Fragmented HRIS, T&A and payroll with inconsistent fields, time zones and rounding rules
- Manual approvals and overrides that bypass built-in controls
- Poor timekeeping hygiene such as missed breaks, split shifts and higher duties not captured cleanly
Signals your board should look for
- A high proportion of casual or variable rosters and frequent shift changes
- Multiple modern awards and EAs across brands or states
- Complex allowances (travel, higher duties, site, recall, on-call)
- Large volumes of pay queries or off-cycle adjustments
- Exception backlogs in T&A or payroll
- Limited evidence that BOOT testing and award interpretation are versioned, audited and repeatable
What “good” governance looks like
Board accountability and reporting
- Name a responsible executive for workplace law compliance and table a standing risk item.
- Receive quarterly dashboards covering underpayment exposure, exception trends, BOOT evidence rates and time-to-resolution.
First- and second-line controls
- Standardise classification data and allowance libraries.
- Enforce manager sign-off for exceptions before payroll run.
- Run routine reconciliations for salaried staff against award outcomes.
Independent assurance
- The commission targeted internal audits and periodic external reviews.
- Validate that enterprise agreements continue to pass BOOT on real rosters, not just modelled patterns.
Technology that changes the risk profile
Modern platforms reduce the gap between planned and paid by making rules executable and auditable.
- Real-time validation
Check each shift against the relevant award or EA at approval, not after pay has run. - Automated BOOT testing
Run the Better Off Overall Test at shift or pay-period level and store evidence for audits. - Award interpretation engine
Convert raw timesheets into itemised outcomes (ordinary hours, penalties, overtime, allowances) with traceable breakdowns. - Version control and sandboxes
Test rule changes before go-live and maintain a full history of applied versions. - APIs and composability
Slot the compliance engine into your current HRIS, T&A and payroll without a rip-and-replace.
OAHI’s approach aligns to these principles:
- Pay Pulse provides payroll compliance checks and BOOT automation with audit-ready evidence.
- Pay Rules exposes an award interpretation engine via API so you can keep your existing stack and still get consistent, versioned results.
Conclusion
The risk is no longer theoretical. Criminal liability for intentional underpayment applies to conduct from 1 January 2025. Enforcement is active and well-resourced, with large corporations a continuing priority. The playbook is clear: treat payroll compliance as a board-level control, modernise your assurance stack, and move testing and validation upstream into day-to-day operations.