Are you locking HR21 users when you run your payroll?

This has been a sticking point for most organisations that use Chris21. Since HR21 is supposed to be a system that can be easily accessed by employees at any time, it makes sense to avoid locking HR21 users whenever possible.

The reason for locking HR21 users is to ensure that they don’t make changes that might affect payroll. A good example would be when a leave request is approved. Because this creates an LVE record in Chris21, it can have an impact on the payrun. Payroll want to avoid this situation, and for good reason.

Many organisations will build into their payroll procedures a step to lock HR21 users. This is usually done fairly early in the process.  HR21 is then unlocked when processing has finished. It’s not uncommon for this to be one to two days. So that’s one to two days that users can’t access HR21. Worst still, some organisation’s run a payroll each week. This means that HR21 is inaccessible for a significant amount of time each week.

Is there a better way?

You do have a few options that will reduce the time that HR21 is unavailable to users. For instance, you could use Update Restrictions in Chris21. This creates restricted access to the forms you choose. So you could restrict the LVE form to ensure that users can’t update it via HR21. Note that if you use this approach to restrict LVE, the system will also restrict access to the application and cancellation forms.

A better solution and one that a number of clients are now using, is to restrict access to the LAP (Application) form. Security in Chris21 can be configured to allow users full access to LAP so that they can request leave and at the same time restrict access to managers so that they cannot approve a leave request. Remember, it is the approving of the leave request that creates the LVE record and thus potentially creates an issue for Payroll.

The end result is that you avoid locking HR21 users while processing your payroll. The majority of users will be able to use HR21 as they normally would, to request leave and update personal details. For them it will be a transparent process. The only users that will notice a change will be managers and this will only be when approving leave. The security restriction will stop any leave requests from being approved.

How is it done?

You only need to make a change to you HR21 security profile to restrict manager’s access to LAP. Do this when you would normally lock HR21 users as per your payroll procedures. Then switch the security setting back when payroll processing is complete. Bear in mind you will need to do this for each HR21 profile if you use more than one. In my experience though, most clients only have the one profile.

If you are interested in implementing this approach you can find more details by reading my ‘How To’ article How to Configure HR21 Security During Payroll Processing.

If you have any questions or would like some help with this, leave a comment or email me at and I’ll make sure I get back to you.