The Payroll That Paid a Ghost.

Twenty-five payrolls. Ten countries. Thirty thousand employees. Three enterprise systems that were never designed to interoperate — an HCM platform, a payroll execution engine, and an ERP. Payroll runs on the 1st, 8th, and 14th of every month, including weekends and public holidays, managed by a three-person team working directly inside the execution engine.

The HCM was supposed to be the single source of truth. In practice, payroll officers bypassed it entirely — entering data directly into the engine because it was faster. Terminated employees remained active downstream, drawing salary every cycle. In high-inflation currencies, field limitations forced manual workarounds on regulatory filings with no documented sign-off. Cost centre changes propagated inconsistently. Misallocations were discovered at month-end — if at all.

There was no reconciliation between the three systems. Variances lived in tribal knowledge held by a handful of operators.

Forty-seven records in the execution engine had been modified before the HCM had synced. Not edge cases — direct data entry by officers who had learned that working inside the source system was slower than working around it. The bypass threshold was supposed to be zero. The actual number was forty-seven, and nobody knew.

One terminated employee — deactivated in the HCM months earlier — was still drawing a full salary every cycle. In a single pay period, that ghost cost the equivalent of six hundred dollars. Multiply by the number of cycles it had been running, across every country where the same integration gap existed.

Three regulatory filings in a high-inflation jurisdiction had been manually padded to fit a field-length limitation. No audit trail. No sign-off. Sitting in a compliance grey zone that would only become visible during an external audit.

Before the first anomaly was surfaced, the governance framework was established — policy codes covering data origin integrity, termination handling, regulatory filing standards, and master data governance. Every recommendation the system would produce would be grounded against this corpus. Not as commentary. As citation.

The intelligence layer sat above all three enterprise systems without touching them. Read-only. Non-intrusive. It ingested payroll run data, traced modification origins across systems, and reconciled breaks between what the HCM said, what the engine processed, and what the ERP posted. Where it found a breach, it classified it. Where it recommended an action, it cited the policy. Where the decision required judgment, it queued for human approval.

No autonomous execution. Every action — approved or deferred — carried a timestamp, a user identity, and a policy reference.

A ten-country dashboard. Each payroll run visible at a glance — status, anomaly count, severity. The investigation streamed in real time: the system’s reasoning arriving as it worked through each country’s data. Not a batch report delivered the next morning. A live feed of what was being found, as it was found.

Deferring a recommendation didn’t make it disappear. It surfaced the cost of non-action: compounding over-payments, regulatory exposure windows, unprotected future runs. The system made inaction visible.

The next question came from the integration team: what if we didn’t wait for the anomaly to reach payroll execution? The interface logs between systems — sync events, postings, partial failures, dropped records — were siloed and invisible. Failures only surfaced as downstream anomalies, days later. The ask: intercept at origin. Surface the failure before the payroll run is impacted. Shift from detection to interception.