Rippling
Rippling is an all-in-one human resources management platform that brings together HR, payroll, IT, and system access rights in one place. It helps businesses onboard and offboard employees quickly, process payroll and taxes accurately, manage devices and apps, and automate workflows on a single system.
- The Rippling Platform
- HRIS
- Recruiting
- Benefits Administration
- Time & Attendance
- IT (Identity & Access + Devices)
- Payroll
- Spend (Expense Management)
- Global (EOR + Global Payroll)
- Security & Data Protection
Platform (Workflow Studio, Integrations, App Studio, Policies, Permissions, Analytics)
1) Quick scan + Orientation
Who is this for + When to use
- Admins setting up Rippling for the first time (or cleaning up a messy setup).
- Anyone building workflows, policies, integrations, or custom apps.
- Use this tab before you scale to more modules (Payroll, IT, Spend, Global).
Where in navigation + Related tabs
- Where: Top-level product area: The Rippling Platform → Core capabilities (Workflow Studio, Analytics, Policies, Permissions, Integrations, App Studio).
- Related: HRIS/Core HR, IT, Payroll, Spend, Security & Data Protection.
3–5 things you’ll do most
- Map your core data (people, org structure) so everything else can reference it.
- Set permissions first, then add policies and automations.
- Connect key integrations (IdP, accounting, ATS, expense, etc.) early.
- Build 1–2 workflows that remove manual handoffs (onboarding/offboarding is ideal).
- Create a lightweight dashboard/report you’ll check weekly.
2) Mental model / Flow
Think of Rippling as a shared data layer plus “engines” that act on that data: permissions decide who can do what, policies decide what should happen, workflows automate how it happens, and integrations/apps extend the system.
- Define your source-of-truth fields (employee attributes, departments, locations).
- Set up role-based access (who can view/edit each area).
- Encode rules as policies (e.g., approvals, eligibility, controls).
- Automate recurring work with workflows (trigger → conditions → actions).
- Connect third-party systems through integrations (sync data + actions).
- Use analytics to validate outcomes and catch drift (missing data, exceptions, pending approvals).
3) Objects & Terms
These are the platform building blocks you’ll see referenced in other tabs.
4) State machine / Lifecycle
Platform items typically move from design → test → rollout → monitor.
- Draft: build triggers/steps and set a narrow scope.
- Test: run with a small group or sandbox data where possible.
- Publish: expand scope and enable notifications/approvals.
- Monitor: track exceptions, tune conditions, update on org changes.
- Connect: authenticate and choose sync direction/scope.
- Map: align fields (departments, locations, titles, IDs).
- Validate: check sample records and edge cases.
- Operate: monitor sync errors and handle changes over time.
5) Core jobs-to-be-done
Start with a few high-leverage jobs that help every team.
- Design a minimal data model (must-have employee fields and ownership).
- Create role-based permissions for admins, managers, employees, finance, IT.
- Set baseline policies (approvals, eligibility, controls) for critical actions.
- Build an onboarding workflow that provisions accounts/tasks automatically.
- Connect 1–3 high-impact integrations (IdP/SSO, accounting, ATS/HR tools).
- Create a weekly health report (missing fields, exceptions, pending approvals).
6) Happy path workflow #1
Workflow: set up a simple “new hire kickoff” automation that reduces manual follow-ups.
- List the trigger: a new employee record becomes ‘ready to onboard’.
- Pick the minimum data required (start date, manager, department, location).
- Add conditional branches (e.g., different tasks by department/location).
- Create tasks for HR/IT/Manager with clear owners and due dates.
- Add notifications (email/Slack) for the owner when tasks are created.
- Run a test with 1–2 dummy hires; verify tasks and notifications fire once.
7) Happy path workflow #2
Workflow: build a lightweight “access change request” flow (approval + audit).
- Define what’s being requested (app access, role change, device request, etc.).
- Create a request form (fields: requester, target user, reason, urgency).
- Set approval logic (manager approval, then system owner/IT approval).
- Add policy checks (block if missing required training/attributes).
- After approval, route to a resolver step (ticket, task, or integration action).
- Log completion and keep a simple report for audits and reviews.
8) Decision points
These choices affect your long-term maintainability.
| Decision | If A… | If B… |
|---|---|---|
| Data ownership | HR owns core people data; lock edits to HR/admin roles. | Split ownership: HR owns people fields; Finance/IT own their fields with tight scopes. |
| Permissions model | Start simple: 3–5 roles, expand later. | Start granular: many roles/groups if your org needs strict separation from day 1. |
| Integrations | Connect fewer, high-impact apps first; stabilize before adding more. | Connect many apps early if Rippling is your central control plane (requires strong governance). |
| Automation scope | Automate only ‘happy path’ first; handle edge cases manually. | Automate edge cases too (more complexity; requires monitoring and iterative tuning). |
9) Guardrails: Do / Don’t & Common mistakes
Platform choices compound over time—keep them boring, consistent, and reviewed.
Do / Don’t
- Do: define a small set of canonical fields and document who owns each.
- Do: use role-based access, then layer policies for sensitive actions.
- Do: test workflows/integrations with a small scope before broad rollout.
- Don’t: let everyone create new fields freely (you’ll get duplicates and drift).
- Don’t: hardcode logic that depends on brittle names (use IDs or stable attributes).
- Don’t: add dozens of integrations without a monitoring/ownership plan.
Common mistakes + how to avoid
- Building workflows before data is clean → fix: start with required fields + validation.
- Over-granular permissions on day 1 → fix: start coarse, then split roles as needs appear.
- No exception monitoring → fix: create a weekly “errors/failed runs” review routine.
- Inconsistent naming (departments/locations) → fix: standardize lists and lock edits.
- Integrations syncing the wrong direction → fix: decide the system of record per field.
10) What good looks like + Checklists
Use this as your ‘platform health’ checklist.
What good looks like (mini rubric)
- Core employee attributes are complete for >95% of people (owner known for the remaining).
- Roles are understandable and reviewed quarterly (no mystery admins).
- Workflows have clear triggers, owners, and an error-handling plan.
- Key integrations have field mappings documented and monitored.
- Analytics shows exceptions and is actually used (not just built once).
Pre-check (before you run)
- Confirm required fields are present on the target records.
- Confirm the right roles/permissions are applied to testers and approvers.
- Check policy rules for edge cases (transfers, contractors, interns).
- Verify integration authentication hasn’t expired.
- Define rollback/disable steps for workflows before enabling broadly.
- Announce the change window to affected admins/teams.
Post-check (after you run)
- Review workflow runs: successes, failures, and skipped steps.
- Spot-check 3–5 records to confirm data and access are correct.
- Check integration sync logs for errors or unexpected field overwrites.
- Confirm approvers received notifications and can complete actions.
- Document what changed + who owns future maintenance.
- Set a recurring reminder to revisit policies/roles as org changes.
11) Practice lab (5–15 min) + Official docs links
Practice: create one tiny workflow that tags a record and notifies an owner (safe, reversible).
- Choose a trigger you can safely simulate (e.g., a profile field change).
- Create a ‘Test’ tag/field and apply it in the workflow action.
- Add a single notification step to yourself (or a test admin).
- Limit scope to 1–2 test users.
- Run it once; confirm tag is applied and you receive the notification.
- Disable the workflow and remove the test tag/field if you don’t need it.
- The workflow only ran for the test users you scoped.
- You can see a run log with each step marked complete.
- No unrelated fields were overwritten by an integration sync.
- Disabling the workflow stops future runs immediately.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Rippling Platform (overview)
- Workflow Studio
- Integrations
- App Studio
- Rippling+ → Help Center entry point
HRIS (Core HR / System of record)
1) Quick scan + Orientation
Who is this for + When to use
- HR admins building the company’s system of record for employee data.
- Managers who need clean org structure (teams, reporting lines) for approvals.
- IT/Payroll/Finance leads who rely on HR data to automate downstream work.
Where in navigation + Related tabs
- Where: Products → HCM → HRIS.
- Related: Platform (Permissions/Policies/Workflows), Payroll, Time & Attendance, IT, Recruiting, Benefits.
3–5 things you’ll do most
- Decide your required employee fields (start date, manager, location, employment type).
- Standardize lists (departments, locations, job levels) before importing data.
- Import/enter employees and validate with spot checks.
- Set up an onboarding intake that produces clean downstream data.
- Build a simple org/report view to catch missing or inconsistent fields.
2) Mental model / Flow
HRIS is the ‘source of truth’ for people and org data. If HRIS fields are incomplete or inconsistent, workflows, payroll, access, and reporting will be noisy and error-prone.
- Define your core data model (fields + controlled vocabularies).
- Migrate employees (import or manual entry) and validate correctness.
- Establish ownership and edit rules for each field (who can change what).
- Set onboarding inputs (forms/tasks) so new records are complete at creation.
- Use workflows/policies to enforce rules and reduce manual clean-up.
- Monitor data quality with a recurring report/check.
3) Objects & Terms
Core HRIS terms you’ll use across Rippling.
4) State machine / Lifecycle
Most HRIS work follows the employee lifecycle; keep transitions explicit.
- Pre-hire: record created with planned start date and role attributes.
- Active: profile maintained as changes happen (role, manager, location).
- Change events: promotions, transfers, leave events—tracked and validated.
- Offboarding: end date recorded; triggers downstream deprovisioning and final pay.
5) Core jobs-to-be-done
Prioritize jobs that improve data quality and reduce rework.
- Define required fields and controlled lists (departments, locations, levels).
- Import employees and resolve duplicates or missing critical fields.
- Create a consistent onboarding intake (who provides what, by when).
- Set manager/reporting structure to support approvals and access control.
- Standardize naming conventions for titles, teams, and locations.
- Create a recurring data-quality review routine (weekly or monthly).
6) Happy path workflow #1
Workflow: build a ‘New employee record completeness’ routine (before onboarding starts).
- Pick the minimum required fields for activation (start date, manager, location, type).
- Create a checklist of missing fields per person.
- Notify the owner (HR admin or recruiter) when any required field is missing.
- Block downstream steps (e.g., access provisioning) until fields are complete.
- Have a manager confirmation step for reporting line and department.
- Run on a small set of upcoming hires first; expand once stable.
7) Happy path workflow #2
Workflow: manage an internal transfer (department/manager/location) in a controlled way.
- Create a transfer request form (employee, effective date, new manager/team/location).
- Route approvals: current manager → new manager → HR.
- Update the employee attributes on the effective date (not immediately).
- Trigger downstream tasks (IT access review, payroll/tax updates, reporting changes).
- Notify stakeholders (employee, managers, payroll, IT) with the effective date.
- Review outcomes after the date: confirm access/payroll align with the new attributes.
8) Decision points
Choose patterns that keep your HRIS clean as you grow.
| Decision | If A… | If B… |
|---|---|---|
| Field design | Keep fields simple and reusable (department, location, level). | Create many custom fields if you have strict reporting/controls (requires governance). |
| Controlled lists | Use locked picklists for key fields to avoid typos. | Allow free-text only for low-stakes fields (notes, internal comments). |
| Change management | Use effective dates for org changes to avoid mid-cycle confusion. | Apply changes immediately only when business processes require it. |
| Ownership | Single owner per critical field (clear accountability). | Shared ownership with rules (needs well-defined permissions and audit routines). |
9) Guardrails: Do / Don’t & Common mistakes
Treat HRIS like a database: clean inputs, controlled edits, and predictable outputs.
Do / Don’t
- Do: decide which system is the source of truth for each field before integrating.
- Do: standardize departments/locations/job levels early and lock them down.
- Do: use approvals/effective dates for major changes (manager, location, type).
- Don’t: let multiple teams edit the same critical fields without clear ownership.
- Don’t: import data without spot-checking against a trusted source.
- Don’t: encode business logic in free-text fields (hard to automate and report).
Common mistakes + how to avoid
- Missing manager or location on new hires → fix: make them required before ‘ready’.
- Duplicate employee records → fix: dedupe before importing; use stable unique IDs.
- Inconsistent department naming → fix: controlled picklists + governance owner.
- Changing attributes mid-pay period → fix: use effective dates aligned to cycles.
- No audit trail of changes → fix: route changes through requests/approvals.
10) What good looks like + Checklists
If HRIS is healthy, other modules get dramatically easier.
What good looks like (mini rubric)
- Required fields are complete for nearly all active employees.
- Departments/locations are consistent and change through a controlled process.
- Transfers/promotions use effective dates and documented approvals.
- Downstream teams (payroll/IT/finance) can rely on HRIS attributes for rules.
- Reports show data quality issues early (before they break workflows).
Pre-check (before you run)
- Confirm controlled lists (departments/locations/levels) are finalized for now.
- Collect source data files and define what will be imported vs entered manually.
- Decide unique identifiers and how duplicates will be handled.
- Define who can edit each critical field (ownership).
- Pick a small pilot group for validation before full import.
- Plan a cutover moment (when HRIS becomes the ‘source of truth’).
Post-check (after you run)
- Spot-check random employees against the trusted source (at least 10).
- Run a ‘missing required fields’ report and resolve gaps.
- Verify reporting lines and managers for key teams.
- Confirm downstream modules are referencing the right fields.
- Document field definitions and owners in one place.
- Schedule a recurring audit cadence (monthly is fine to start).
11) Practice lab (5–15 min) + Official docs links
Practice: create a mini data-quality audit for a small team (safe and quick).
- Pick 5–10 employees as your test group.
- Choose 4 required fields to audit (manager, location, department, type).
- Check each record and note missing/incorrect values.
- Fix the values and record who made the change (for accountability).
- Create a simple ‘data quality’ checklist you can reuse monthly.
- Share the checklist with the stakeholders who own those fields.
- Your test group shows 0 missing values for the chosen required fields.
- Controlled lists match what’s used in employee records (no typos/variants).
- You can explain who owns each field and how changes should be requested.
- Downstream teams can confirm the data is usable for their rules.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- HRIS (product overview)
- Rippling Platform (permissions/policies/workflows context)
- Rippling+ → Help Center entry point
Recruiting (Hiring pipeline & onboarding handoff)
1) Quick scan + Orientation
Who is this for + When to use
- Recruiters and hiring managers running job pipelines.
- HR admins who need consistent handoff from candidate → employee record.
- Teams that want fewer ‘missing info’ pings during onboarding.
Where in navigation + Related tabs
- Where: Products → HCM → Recruiting.
- Related: HRIS, Platform (Workflows/Permissions), IT (provisioning), Payroll, Global (if hiring internationally).
3–5 things you’ll do most
- Standardize job requisitions and required fields before opening roles.
- Define pipeline stages and stage exit criteria (what ‘ready’ means).
- Collect onboarding-critical info during or right after offer acceptance.
- Automate handoff tasks (background check, device request, payroll setup).
- Track bottlenecks: where candidates stall and why.
2) Mental model / Flow
Recruiting is a funnel: requisition → candidates → stages → offer → hire. The key newbie win is building a predictable handoff so every hire arrives in HRIS with complete, usable data.
- Open a requisition with clear role requirements and owner(s).
- Source candidates into the pipeline and capture structured data.
- Move candidates through stages with consistent evaluation criteria.
- Create an offer and confirm start date + essential onboarding details.
- Convert the hired candidate into an HRIS-ready record (handoff).
- Kick off onboarding workflows and tasks (IT, payroll, manager prep).
3) Objects & Terms
Recruiting objects usually map cleanly into HRIS once hired.
4) State machine / Lifecycle
If your docs don’t expose a formal lifecycle, use this simple one.
- Lead → Active candidate: added to a requisition pipeline.
- In evaluation: moving through stages with notes/decisions.
- Offer: terms proposed and negotiated.
- Hired / Not hired: outcome recorded; hired moves to onboarding.
5) Core jobs-to-be-done
Focus on jobs that reduce cycle time and increase handoff quality.
- Create repeatable requisition templates by department/role type.
- Define pipeline stages and what information is required at each stage.
- Track candidate status and ensure timely feedback loops.
- Generate a complete handoff packet for HRIS (start date, manager, location, type).
- Automate post-offer tasks (checks, forms, device request, payroll prerequisites).
- Measure funnel conversion and identify bottlenecks.
6) Happy path workflow #1
Workflow: open a new requisition with consistent approvals and inputs.
- Use a requisition template (role, department, location, hiring manager).
- Confirm budget/headcount owner and route approval to them.
- Define the pipeline stages for this requisition (keep it consistent).
- Set stage exit criteria (what must be documented to advance).
- Publish the role and assign recruiting tasks/owners.
- Start weekly check-ins: pipeline health, blockers, next actions.
7) Happy path workflow #2
Workflow: convert an accepted offer into a ‘ready-to-onboard’ handoff.
- Confirm offer acceptance and lock the start date.
- Collect the handoff packet fields (manager, department, location, employment type).
- Trigger onboarding kickoff: HR tasks + manager tasks + IT request.
- Notify payroll/finance of any compensation inputs needed for setup.
- Set an internal deadline (e.g., 3–5 business days before start date) for completion.
- Run a final completeness check before day 1.
8) Decision points
Small recruiting choices can create big downstream pain (or savings).
| Decision | If A… | If B… |
|---|---|---|
| Pipeline design | Use a standard pipeline across teams for consistency. | Customize pipelines heavily per role (more fit, more admin overhead). |
| Data capture timing | Collect onboarding-critical info at offer acceptance. | Collect later (risk: missing info delays onboarding). |
| Approvals | Require approvals for new headcount to prevent surprise hiring. | Allow open requisitions (faster, but risk budget/process drift). |
| International hiring | Route to Global/EOR early if hiring abroad. | Treat as normal hire then adjust later (risk: compliance delays). |
9) Guardrails: Do / Don’t & Common mistakes
The best recruiting system is boring: consistent stages, clear ownership, and clean handoffs.
Do / Don’t
- Do: standardize stage names and stage exit criteria so reporting is meaningful.
- Do: define the handoff packet and make it required for ‘ready-to-onboard’.
- Do: keep tight ownership—every candidate has a next action and an owner.
- Don’t: move candidates without documenting why (you’ll lose signal and accountability).
- Don’t: negotiate offers without capturing key terms in structured fields.
- Don’t: start onboarding work before the start date and manager are confirmed.
Common mistakes + how to avoid
- Too many pipeline stages → fix: merge stages; keep only decision-driving steps.
- Missing manager/location at handoff → fix: require them before moving to hired.
- No feedback SLA → fix: set a default turnaround for interview feedback.
- Ad hoc requisition creation → fix: templates + approvals.
- International hire treated like domestic → fix: involve Global/EOR early.
10) What good looks like + Checklists
Recruiting is ‘good’ when the pipeline is predictable and the handoff is complete.
What good looks like (mini rubric)
- Every open requisition has an owner, approvals, and defined stages.
- Candidates always have a next step scheduled or a clear decision logged.
- Offer terms are captured in structured fields, not only in notes.
- Hired candidates generate a complete handoff packet into HRIS.
- Cycle time and bottlenecks can be explained with real data.
Pre-check (before you run)
- Confirm who approves new headcount and what info they need.
- Define a standard pipeline and which stages require structured fields.
- Create a handoff packet checklist shared by recruiting + HR + IT + payroll.
- Agree on interview feedback timelines and ownership.
- Decide where job descriptions and scorecards live (single source).
- Plan how to handle international hiring paths.
Post-check (after you run)
- Review conversion rates by stage and identify one bottleneck to fix.
- Audit the last 5 hires: were handoff packet fields complete?
- Check time-in-stage for stalled candidates and assign next actions.
- Update templates if teams keep adding the same ‘extra’ fields.
- Align with HRIS data owners on any new required fields.
- Document the ‘ready-to-onboard’ definition and enforce it.
11) Practice lab (5–15 min) + Official docs links
Practice: design a handoff packet and test it with one recent hire (or mock hire).
- Write the minimum handoff packet fields (start date, manager, location, type, title).
- Pick a single requisition and map where each field is captured.
- Identify one field that’s often missing and add a required step to capture it.
- Run a mock ‘offer accepted’ scenario and fill the packet end-to-end.
- Have HR/IT/payroll review the packet for usability.
- Update the packet and share the final checklist with hiring managers.
- Downstream teams confirm they can start onboarding work without asking extra questions.
- The handoff packet is written in structured fields (not only in notes).
- You can point to where each field is captured during the hiring process.
- A ‘ready-to-onboard’ gate prevents incomplete handoffs.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Recruiting (product overview)
- HRIS (handoff destination)
- Rippling+ → Help Center entry point
Benefits Administration (and PEO context)
1) Quick scan + Orientation
Who is this for + When to use
- HR/People Ops admins managing health and other benefits enrollment.
- Teams planning open enrollment or onboarding with benefits eligibility rules.
- If your company uses a PEO, this tab helps you frame what to validate in your setup.
Where in navigation + Related tabs
- Where: Products → HCM → Benefits Administration (and PEO appears as a separate HCM product in Rippling navigation).
- Related: HRIS (eligibility attributes), Payroll (deductions), Platform (policies/workflows), Global Benefits (if operating internationally).
3–5 things you’ll do most
- Define eligibility rules (who gets what, and when).
- Prepare plan info and enrollment windows (open enrollment + new hire enrollment).
- Set a standard workflow for qualifying life events and mid-year changes.
- Validate payroll deduction mapping (benefits ↔ payroll) before going live.
- Run a small pilot (or dry run) before full open enrollment.
2) Mental model / Flow
Benefits administration is a set of time-bound windows and change events. You’re managing (1) eligibility, (2) plan options, (3) enrollment choices, and (4) payroll/tax deductions that must stay aligned.
- Confirm HRIS attributes that drive eligibility (location, employment type, hours).
- Set plan options and who is eligible for each option.
- Define enrollment windows and required employee actions.
- Collect elections and validate completeness (dependents, waivers, etc.).
- Sync deductions and verify payroll reflects elections correctly.
- Handle change events (new hires, life events) with a consistent process.
3) Objects & Terms
Keep these terms consistent across communications and reporting.
4) State machine / Lifecycle
Benefits are inherently lifecycle-driven (windows + events).
- Setup: plans and eligibility rules defined.
- Enrollment window: employees choose elections (or waive).
- Effective date: elections take effect; deductions should match.
- Change events: new hire enrollment / qualifying life events processed.
5) Core jobs-to-be-done
Choose jobs that prevent downstream payroll surprises.
- Define eligibility rules using stable HRIS attributes (avoid free-text logic).
- Publish plan options and enrollment instructions clearly.
- Run open enrollment with reminders and completion tracking.
- Process new hire enrollments on a predictable schedule.
- Handle mid-year changes through a consistent ‘event’ workflow.
- Validate payroll deduction alignment before and after effective dates.
6) Happy path workflow #1
Workflow: run open enrollment as a structured campaign (not a scramble).
- Lock eligibility rules and plan options before announcing dates.
- Set the enrollment window dates and communicate expectations to employees.
- Launch enrollment and send reminders to those not complete.
- Create a help channel/office hours for questions (limit one source of truth).
- Close the window and run a completeness check (missing elections/waivers).
- Verify payroll deduction mapping with a sample group before the effective date.
7) Happy path workflow #2
Workflow: process a qualifying life event (mid-year change) with guardrails.
- Employee submits an event request with the event type and date.
- Collect required documentation (if your policy requires it).
- Approve/deny based on eligibility and timing rules.
- Open a limited change window for that employee only.
- Update elections and confirm effective date of the change.
- Verify the next payroll reflects updated deductions correctly.
8) Decision points
These decisions determine how chaotic (or calm) benefits season feels.
| Decision | If A… | If B… |
|---|---|---|
| Eligibility rules | Use stable HRIS attributes; keep rules simple. | Complex rules by many edge cases (needs strong data governance). |
| Enrollment accountability | Require explicit election or waiver for every eligible employee. | Allow silent defaults (faster, but higher risk of disputes). |
| Change events | Centralize via a request + approval workflow. | Allow ad hoc changes via email (unscalable, hard to audit). |
| PEO vs non-PEO | If using a PEO, confirm which processes/records live where. | If not using a PEO, keep full ownership of enrollment and deductions internally. |
9) Guardrails: Do / Don’t & Common mistakes
Benefits mistakes show up as payroll errors or employee trust issues—guardrail them early.
Do / Don’t
- Do: align HRIS eligibility fields before configuring benefits rules.
- Do: run a small dry run for open enrollment communications and checks.
- Do: sample-check deductions after elections become effective.
- Don’t: change plan options mid-window without re-communicating clearly.
- Don’t: process life events without a consistent request/audit trail.
- Don’t: let multiple sources of truth exist (spreadsheets + system + email).
Common mistakes + how to avoid
- Eligibility fields incomplete → fix: require and validate HRIS attributes first.
- Employees forget to waive/enroll → fix: reminders + completion tracking + clear deadline.
- Deductions wrong on first payroll → fix: run pre-effective sample payroll checks.
- Life events handled inconsistently → fix: standardized request + approvals.
- PEO responsibilities unclear → fix: write a one-page RACI (who does what) before go-live.
10) What good looks like + Checklists
Benefits is ‘good’ when people can enroll easily and payroll always matches elections.
What good looks like (mini rubric)
- Eligibility is explainable and based on stable HRIS attributes.
- Every eligible employee has an explicit election or waiver.
- Effective dates are clear and payroll deductions align.
- Life events are handled with a repeatable process and an audit trail.
- Support questions drop because instructions and timelines are consistent.
Pre-check (before you run)
- Confirm HRIS attributes used for eligibility are complete and controlled.
- Collect plan option details and define enrollment windows and deadlines.
- Decide how employees get help (single channel + office hours).
- Define the life-event request and approval process.
- Agree on payroll deduction mapping approach and owners.
- Pilot with a small group if possible (or do a dry run).
Post-check (after you run)
- Run completeness checks: missing elections/waivers, missing dependents info.
- Sample-check payroll deductions for a subset of employees.
- Document common questions and update guidance for next cycle.
- Review life-event turnaround times and refine the process.
- Confirm roles/permissions are correct (who can edit plans/elections).
- Schedule a retrospective after the first effective payroll.
11) Practice lab (5–15 min) + Official docs links
Practice: run a mini ‘benefits readiness’ audit for 10 employees before open enrollment.
- Pick 10 employees across different locations/types (to test eligibility rules).
- Check whether each has complete eligibility fields in HRIS.
- Simulate what plan options each person should see (write expected results).
- Identify mismatches and fix the underlying HRIS attribute or rule.
- Write a one-page checklist for open enrollment launch day.
- Share the checklist with HR + payroll stakeholders.
- For each test employee, you can explain why they are eligible (or not).
- No test employee is missing the HRIS attributes required for eligibility.
- You have a launch checklist and owners for payroll deduction validation.
- You can describe the life-event workflow in 30 seconds to a manager.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Benefits Administration (product overview)
- Rippling navigation showing Benefits Administration + PEO
- Rippling+ → Help Center entry point
Time & Attendance (Time tracking → approvals → payroll-ready)
1) Quick scan + Orientation
Who is this for + When to use
- HR/payroll admins coordinating time collection and approvals.
- Managers approving time for their teams.
- Ops teams who need reliable labor data (hours, overtime, job codes).
Where in navigation + Related tabs
- Where: Products → HCM → Time & Attendance.
- Related: Payroll (payout), Platform (policies/approvals), Scheduling (if used), HRIS (eligibility and worker types).
3–5 things you’ll do most
- Define who tracks time and what the rules are (hourly vs salaried, overtime rules, breaks).
- Choose a standard time period and cutoff schedule.
- Set approval routing (manager, department lead) and deadlines.
- Run pre-payroll checks for missing or suspicious entries.
- Sync approved time into payroll and verify payout matches expectations.
2) Mental model / Flow
Time tracking is a pipeline: capture → validate → approve → export to payroll. If you fail early (capture/validation), the pain shows up at payroll cutoff.
- Define time policies (who tracks time, rules, rounding/breaks expectations).
- Collect time entries (clock-in/out or timesheet submission).
- Validate entries (missing shifts, overlaps, outliers).
- Route approvals (manager approvals by deadline).
- Lock the period and mark it payroll-ready.
- Send approved hours to payroll and verify payouts.
3) Objects & Terms
These terms help you explain the process to managers and employees.
4) State machine / Lifecycle
Time flows in repeating cycles aligned to payroll periods.
- Open: employees submit time for the current period.
- Pending approval: period ends; managers review and approve.
- Locked: approvals complete; edits restricted except via exception handling.
- Exported: approved hours sent to payroll; period archived for audit.
5) Core jobs-to-be-done
Keep jobs centered on avoiding payroll cutoff emergencies.
- Set time policies and communicate them clearly to employees/managers.
- Collect time consistently and reduce manual corrections.
- Route approvals with clear deadlines and reminders.
- Catch exceptions early (missing time, outliers, overlaps).
- Produce payroll-ready data and reconcile with expected hours.
- Maintain an audit trail for changes and approvals.
6) Happy path workflow #1
Workflow: weekly time collection and approval (simple, repeatable).
- Publish the week’s time policy reminder (deadline + expectations).
- Employees submit time by a set day/time (e.g., end of last shift or weekly cutoff).
- System flags missing timesheets and notifies employees early.
- Managers approve or request corrections by the approval cutoff.
- Run a final exception report (missing approvals, outliers) before lock.
- Lock the week and mark it payroll-ready.
7) Happy path workflow #2
Workflow: handle a time correction after lock (exception path).
- Employee requests a correction with date/time and reason.
- Manager reviews and approves/denies the correction request.
- Admin unlocks only what’s necessary (or applies an adjustment entry).
- Correction is applied with a note/audit trail.
- Manager re-approves the updated entry if required by policy.
- Payroll reconciliation is updated and documented.
8) Decision points
Pick the approach that best fits your operational reality.
| Decision | If A… | If B… |
|---|---|---|
| Time capture method | Use clock-in/out for hourly/shift workers. | Use manual timesheets for knowledge work (with validation rules). |
| Approval routing | Single manager approval per employee for speed. | Multi-level approvals for high-control environments (slower, but stricter). |
| Lock policy | Lock periods after approval to protect payroll integrity. | Leave periods editable (fewer admin steps, higher risk of silent changes). |
| Exception handling | Use a formal request process for corrections. | Allow ad hoc edits (fast, but poor auditability). |
9) Guardrails: Do / Don’t & Common mistakes
Time data becomes money—protect it with simple controls.
Do / Don’t
- Do: set explicit cutoffs for submission and approval and remind people early.
- Do: run exception checks before the payroll cutoff (missing time, outliers).
- Do: lock approved periods to prevent silent changes.
- Don’t: approve time without spot-checking obvious anomalies.
- Don’t: change policies mid-period without clear comms and a transition plan.
- Don’t: rely on manual spreadsheets for exception tracking once you scale.
Common mistakes + how to avoid
- Managers approve late → fix: reminders + escalation after cutoff.
- Employees submit incomplete time → fix: validation checks + early nudges.
- No clear correction path → fix: formal correction request flow.
- Outliers missed (huge hours) → fix: exception thresholds and reports.
- Time not reconciled to payroll → fix: post-export reconciliation routine.
10) What good looks like + Checklists
You’ll know it’s working when payroll isn’t a fire drill.
What good looks like (mini rubric)
- Submission and approval deadlines are met most periods.
- Exceptions are caught before payroll cutoff, not after payout.
- Locked periods stay stable (changes happen only via controlled corrections).
- Managers understand what they are approving and why it matters.
- Payroll payout matches approved time with minimal adjustments.
Pre-check (before you run)
- Define who must track time and which policies apply to each group.
- Set the pay period schedule, submission deadline, and approval deadline.
- Train managers on how to review time and what to flag.
- Define exception thresholds (missing time, >X hours/day, overlaps).
- Decide lock/correction rules and communicate them.
- Align time categories with payroll earning codes where needed.
Post-check (after you run)
- Review completion rates (submitted vs missing) and follow up on gaps.
- Review late approvals and adjust escalation logic.
- Spot-check a sample of approved timesheets for anomalies.
- Confirm export to payroll completed and totals reconcile.
- Document corrections made after lock and why.
- Update training docs based on recurring issues.
11) Practice lab (5–15 min) + Official docs links
Practice: create an exception checklist and run it on one pay period (real or test).
- Choose one recent pay period (or a small test group).
- List 5 exception rules (missing submission, missing approval, >12h/day, overlaps, weekend work).
- Check which employees trigger each exception and why.
- Decide the action for each exception type (fix, approve with note, deny).
- Run the same checklist again after fixes to confirm exceptions drop.
- Save the checklist and schedule it as a standard pre-payroll step.
- You can identify and resolve common exceptions before payroll cutoff.
- Managers understand which anomalies to escalate vs approve.
- A locked period stays stable unless a documented correction occurs.
- Approved totals reconcile with what payroll expects to pay.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Time & Attendance (product overview)
- Payroll (payout destination)
- Rippling+ → Help Center entry point
IT (Identity & Access, Device Management, Inventory)
1) Quick scan + Orientation
Who is this for + When to use
- IT admins handling identity, app access, devices, and offboarding security.
- HR admins coordinating onboarding/offboarding with IT tasks.
- Security-minded teams that need access hygiene and device posture visibility.
Where in navigation + Related tabs
- Where: Products → IT → Identity & Access / Device Management / Inventory Management.
- Related: Platform (Workflows, Policies, Permissions, Integrations), HRIS (join/leave events), Security & Data Protection.
3–5 things you’ll do most
- Define access groups by role/department and map apps to groups.
- Set onboarding automation: accounts + device requests + baseline security steps.
- Centralize device inventory and lifecycle steps (assign, ship, recover).
- Create an offboarding checklist that removes access and captures devices on time.
- Run a weekly access hygiene review (stale accounts, privileged access).
2) Mental model / Flow
IT in Rippling is a lifecycle engine: it uses HRIS attributes (who the person is) to grant app access and manage devices. The goal is fast onboarding with strong guardrails—and clean offboarding with minimal risk.
- Define identity and access model (roles/groups → apps/permissions).
- Connect key apps and identity providers through integrations.
- Set device standards (models, policies) and inventory tracking.
- Automate onboarding: create accounts, assign groups, request/assign devices.
- Automate offboarding: disable accounts, revoke access, collect devices.
- Monitor posture: access hygiene, device compliance, and exceptions.
3) Objects & Terms
These terms help align HR, IT, and security on the same language.
4) State machine / Lifecycle
Most IT operations map to join/change/leave events.
- Join: create accounts, assign access groups, issue a device.
- Change: adjust access when role/department/location changes.
- Leave: revoke access, disable accounts, recover devices.
- Inventory: track device assignment, posture, and retirement.
5) Core jobs-to-be-done
Start with the jobs that reduce security risk and manual tickets.
- Create access groups for common roles and map required apps to each group.
- Connect key business apps so provisioning can be automated.
- Standardize device inventory and assignment process.
- Automate onboarding: access provisioning + device request + task routing.
- Automate offboarding: immediate access removal + device recovery steps.
- Run access hygiene and device posture checks on a cadence.
6) Happy path workflow #1
Workflow: automated onboarding (accounts + access + device).
- Ensure HRIS has required onboarding fields (start date, role, department, manager).
- Map the role/department to an access group (apps + permissions bundle).
- Trigger provisioning at a consistent point (e.g., ‘ready-to-onboard’).
- Create tasks: device request/assignment and any required setup steps.
- Notify the manager with day-1 checklist (what the employee needs).
- Verify access works for the new hire using a test checklist (critical apps).
7) Happy path workflow #2
Workflow: secure offboarding (revoke access first, then recover assets).
- Record the end date and identify systems with privileged access.
- Revoke access groups and disable accounts on the end date/time.
- Invalidate sessions and remove app access (where applicable via integrations).
- Create device recovery tasks with shipping/return instructions and owner.
- Notify stakeholders (manager, HR, security) of completion status.
- Run a post-offboarding audit: confirm no active access remains.
8) Decision points
Make these choices explicit so onboarding/offboarding stays predictable.
| Decision | If A… | If B… |
|---|---|---|
| Group strategy | Role-based groups (simple, scalable). | App-by-app grants (flexible, but high admin overhead). |
| Provisioning timing | Provision when ‘ready-to-onboard’ is true (data complete). | Provision immediately when a record is created (faster, higher risk of wrong access). |
| Device approach | Standardize device models/policies by role. | Let teams choose devices freely (more variety, harder management). |
| Offboarding priority | Revoke access first, then handle asset recovery. | Recover devices first (risk: lingering access/security exposure). |
9) Guardrails: Do / Don’t & Common mistakes
IT guardrails are mostly about least privilege and clear ownership.
Do / Don’t
- Do: map access to roles/groups so changes cascade automatically.
- Do: treat privileged access as a special case with extra review.
- Do: keep device inventory accurate and assign clear owners for recovery.
- Don’t: grant permanent access for temporary needs (use time-bound processes).
- Don’t: let offboarding rely on manual memory—use a checklist/workflow.
- Don’t: ignore sync/integration errors; they cause silent access drift.
Common mistakes + how to avoid
- Access granted ad hoc without a group model → fix: define role-based groups first.
- Provisioning before HR data is final → fix: gate on ‘ready-to-onboard’ completeness.
- Offboarding delayed → fix: automate revocation on end date/time.
- Devices not recovered → fix: track inventory + recovery tasks + escalation path.
- No access hygiene review → fix: weekly review of stale/privileged accounts.
10) What good looks like + Checklists
IT is ‘good’ when onboarding is fast and offboarding is provably complete.
What good looks like (mini rubric)
- Most onboarding is automated and repeatable (few manual tickets).
- Access is least-privilege by default and easy to review by role.
- Offboarding revokes access quickly and consistently across systems.
- Device inventory is accurate and shows assignment/ownership clearly.
- You can run an access hygiene report and act on it routinely.
Pre-check (before you run)
- Define roles/groups and the minimum apps each needs.
- Identify privileged apps and add extra approval/controls.
- Connect key apps/IdP so provisioning can be automated.
- Standardize device models and assignment rules by role.
- Define offboarding checklist and device recovery process.
- Set cadence for access hygiene reviews (weekly or biweekly).
Post-check (after you run)
- Test onboarding for one new hire path end-to-end (apps + device task).
- Audit one offboarding event to confirm access revocation across systems.
- Review integration sync logs for access drift or failures.
- Reconcile device inventory vs reality (spot-check a sample).
- Document group definitions and owners for each key app.
- Schedule a recurring privileged-access review.
11) Practice lab (5–15 min) + Official docs links
Practice: build an access group for one role and validate onboarding/offboarding behavior.
- Pick one common role (e.g., Sales Rep) and list 5 required apps.
- Create an access group definition and note who approves membership changes.
- Connect (or simulate) the apps needed for provisioning actions.
- Assign a test user to the group and verify access in those apps.
- Remove the test user from the group and verify access is revoked.
- Write a 1-page runbook: how to add/remove someone and how to troubleshoot.
- Group membership reliably controls access (add grants, remove revokes).
- You can explain who approves access and where it’s logged.
- Provisioning/deprovisioning changes are consistent and repeatable.
- Troubleshooting steps exist for integration/sync failures.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Identity & Access Management (product overview)
- Device Management (official product page)
- Rippling IT overview
- Rippling navigation showing IT sub-products
- Rippling+ → Help Center entry point
Payroll (US payroll + contractors context)
1) Quick scan + Orientation
Who is this for + When to use
- Payroll admins running regular pay cycles.
- HR admins who supply upstream data (new hires, changes, terminations).
- Finance teams reconciling payroll totals and cash planning.
Where in navigation + Related tabs
- Where: Products → Payroll → Payroll (and related: Contractors, Global Payroll, EOR, etc.).
- Related: HRIS, Time & Attendance, Benefits (deductions), Spend (reimbursements), Global (international).
3–5 things you’ll do most
- Align pay groups/schedules and upstream HR data responsibilities.
- Do a pre-payroll audit (new hires, changes, terminations, missing fields).
- Run payroll with a clear checklist and approvals.
- Handle off-cycle runs only with a defined reason + documentation.
- Reconcile totals after payroll and track recurring issues.
2) Mental model / Flow
Payroll is an execution pipeline that depends on clean inputs. The newbie trick is making a repeatable pre-check → run → post-check routine, so payroll is a process—not an emergency.
- Confirm pay schedule and who is in each pay group.
- Audit upstream changes (new hires, compensation changes, terminations).
- Validate time/benefits inputs that affect net pay.
- Preview payroll totals and investigate outliers.
- Submit/pay payroll (and handle approvals if your org requires them).
- Reconcile results and document issues for next cycle.
3) Objects & Terms
Payroll vocabulary you’ll use in every pay cycle.
4) State machine / Lifecycle
Payroll runs repeat; consistency is your friend.
- Inputs open: time and HR changes occur during the period.
- Pre-check: audit all changes before preview.
- Preview: review totals/outliers and fix issues.
- Submit: finalize the run; record approvals and exceptions.
- Post-check: reconcile and document issues for the next cycle.
5) Core jobs-to-be-done
Keep payroll boring: fewer surprises, more repeatable checks.
- Set pay schedules and keep pay groups clearly defined.
- Ensure new hires and terminations are recorded with correct effective dates.
- Validate time and deductions inputs before previewing payroll.
- Run payroll preview and investigate anomalies (net pay shifts, missing earnings).
- Execute payroll and maintain a clean audit trail of changes.
- Reconcile and report totals after completion.
6) Happy path workflow #1
Workflow: run a standard payroll cycle with a checklist and anomaly review.
- Lock the pay period cutoff for time submission and approvals.
- Audit HR changes: hires, comp changes, transfers, terminations (effective dates).
- Validate benefits/deductions updates that impact this period.
- Run a payroll preview and scan for outliers (large deltas, missing entries).
- Resolve anomalies and re-preview until totals look right.
- Submit payroll and record approvals/notes for any exceptions.
7) Happy path workflow #2
Workflow: handle an off-cycle payroll run (carefully and auditable).
- Define the reason (correction, bonus, termination payout, etc.) and scope.
- Identify impacted employees and the specific adjustment amounts.
- Confirm approvals (finance/HR) before running the off-cycle.
- Run the off-cycle preview and validate the adjustments only affect the scoped group.
- Submit the off-cycle and document the event for audit/reconciliation.
- Update your process to prevent repeat causes (root-cause fix).
8) Decision points
These decisions determine how much payroll depends on heroics.
| Decision | If A… | If B… |
|---|---|---|
| Cutoff strictness | Hard cutoff for time/changes; late items go to next cycle. | Soft cutoff; accept late changes (more surprises, more errors). |
| Approvals | Require a finance/HR approval for payroll submission. | Single payroll admin submits (faster, higher risk). |
| Off-cycle policy | Off-cycle only for defined cases with documentation. | Off-cycle for convenience (creates chaos and audit risk). |
| Upstream ownership | HR owns people data; managers own time approvals; payroll owns execution. | Shared ownership without clarity (leads to last-minute blame and fixes). |
9) Guardrails: Do / Don’t & Common mistakes
Payroll errors damage trust fast—use guardrails that prevent avoidable mistakes.
Do / Don’t
- Do: keep pay group definitions and schedules clear and documented.
- Do: review outliers every cycle (it’s the fastest way to catch errors).
- Do: require documentation for off-cycle adjustments.
- Don’t: change effective dates mid-cycle without understanding impact.
- Don’t: run payroll without reconciling time and deductions inputs.
- Don’t: fix payroll issues manually without also fixing the root cause upstream.
Common mistakes + how to avoid
- New hire missing pay data → fix: onboarding completeness gate in HRIS.
- Termination not reflected → fix: effective date and checklist for offboarding updates.
- Time approvals late → fix: reminders + escalation in Time & Attendance.
- Benefits deductions mismatched → fix: pre-payroll sample checks after enrollment changes.
- Too many off-cycle runs → fix: stricter cutoff and root-cause fixes.
10) What good looks like + Checklists
Payroll is ‘good’ when runs are predictable and easy to explain.
What good looks like (mini rubric)
- Every payroll has a documented pre-check and post-check routine.
- Outliers are reviewed and explained before submission.
- Off-cycle runs are rare and always documented.
- Upstream teams know their responsibilities and deadlines.
- Reconciliation totals match expectations and are reported consistently.
Pre-check (before you run)
- Confirm the pay period dates and deadlines (time submission, approvals, changes).
- Audit HR changes with effective dates (hires, comp, transfers, terminations).
- Confirm benefits/deductions updates are applied correctly for the period.
- Ensure time data is approved and marked payroll-ready where applicable.
- Prepare an outlier checklist (who/what to investigate).
- Confirm who must approve payroll submission.
Post-check (after you run)
- Reconcile payroll totals to expectations and prior period variances.
- Log exceptions and why they occurred (category + owner).
- Verify reimbursements or special payments were included/excluded correctly.
- Confirm any retroactive adjustments are documented and reviewed.
- Share a short closeout note (what changed, what to watch next cycle).
- Update upstream checklists based on recurring issues.
11) Practice lab (5–15 min) + Official docs links
Practice: run a ‘payroll readiness’ audit using only 10 employees (safe, fast).
- Pick 10 employees across different pay scenarios (hourly/salaried, new hire, etc.).
- Check HRIS: title, manager, location, employment type, effective dates.
- Check Time & Attendance: submissions and approvals (if used).
- Check benefits/deductions: any recent changes that affect this pay period.
- List anomalies and assign owners (HR vs manager vs payroll).
- Re-check after fixes and record what prevented each issue.
- You can name the top 3 upstream causes of payroll anomalies for your org.
- A small readiness checklist catches issues before payroll preview.
- Owners are clear for each anomaly type (not ‘payroll fixes everything’).
- You can explain variances from the prior period with evidence.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Payroll (product overview)
- Rippling article: How to process payroll (process framing)
- Rippling navigation showing Payroll family (contractors/global/EOR)
- Rippling+ → Help Center entry point
Spend / Finance (Expense Management, Corporate Cards, Bill Pay, Travel)
1) Quick scan + Orientation
Who is this for + When to use
- Finance admins managing expenses, corporate cards, bill pay, or travel controls.
- Managers approving spend and enforcing policy.
- Employees submitting expenses and reimbursements.
Where in navigation + Related tabs
- Where: Products → Finance/Spend → Expense Management (and related: Corporate Cards, Bill Pay, Travel).
- Related: Platform (policies/approvals/workflows), HRIS (employee attributes), Payroll (reimbursements if applicable), Integrations (accounting).
3–5 things you’ll do most
- Define spend policy: what’s allowed, limits, and required documentation.
- Set approval routing (manager, budget owner, finance) and SLAs.
- Standardize categories/codes for reporting and accounting handoff.
- Run weekly exception reviews (missing receipts, late approvals, policy violations).
- Close the month with a repeatable reconciliation checklist.
2) Mental model / Flow
Spend management is a control loop: policy sets rules, capture collects proof, approvals enforce rules, and reporting reconciles outcomes. The win is consistency and low friction.
- Define policy (limits, categories, required receipt rules).
- Capture spend (expense submissions and card transactions).
- Route approvals based on employee attributes and thresholds.
- Enforce policy (flag violations and request fixes).
- Reimburse or settle spend and post to accounting.
- Reconcile and report (monthly close routine).
3) Objects & Terms
Spend terms you’ll use when communicating policy.
4) State machine / Lifecycle
Spend flows from capture to close; keep the loop predictable.
- Draft: employee captures details and attaches proof.
- Submitted: enters approval flow.
- Approved/Rejected: finance controls applied.
- Settled: reimbursement or posting completed.
- Reconciled: included in reporting/close with audit trail intact.
5) Core jobs-to-be-done
Do these jobs well and you’ll avoid the ‘end-of-month scramble’.
- Define clear spend policies with limits, categories, and receipt rules.
- Set approval routing that matches your org structure and thresholds.
- Ensure submissions are complete (proof, category, business purpose).
- Process reimbursements/settlements quickly with predictable SLAs.
- Integrate with accounting where needed and keep mappings documented.
- Run a monthly close checklist and track exceptions.
6) Happy path workflow #1
Workflow: employee submits an expense and it gets approved quickly (happy path).
- Employee captures expense details and attaches required proof.
- System validates required fields (category, amount, date, business purpose).
- Approval routes to manager (and finance if above threshold).
- Approvers review policy alignment and approve/return for fixes.
- Finance performs a final check (if needed) and marks as settled.
- Expense is ready for reporting/accounting with consistent coding.
7) Happy path workflow #2
Workflow: handle a policy exception (missing receipt / out-of-policy spend).
- Submission is flagged as an exception (missing proof or policy violation).
- Employee is notified with the exact missing item or rule violated.
- Employee submits the missing proof or requests an exception approval.
- Approver decides (approve exception with note, or reject).
- Finance records the resolution (reason + approver) for audit.
- Exception trends are reviewed and policy/training updated.
8) Decision points
Decide your control vs speed tradeoffs upfront.
| Decision | If A… | If B… |
|---|---|---|
| Approval depth | Single manager approval for low amounts; finance for higher amounts. | Always require finance approval (higher control, slower throughput). |
| Receipt rules | Require receipts above a threshold and for specific categories. | Require receipts for everything (strong control, higher employee friction). |
| Category strategy | Use a small, stable category list for consistent reporting. | Use many granular categories (better detail, harder compliance). |
| Accounting integration | Integrate once mappings are stable. | Delay integration until process is mature (manual work, fewer sync risks). |
9) Guardrails: Do / Don’t & Common mistakes
Spend systems fail when rules are unclear or enforcement is inconsistent.
Do / Don’t
- Do: keep policy rules simple and communicate them in plain language.
- Do: define SLAs for approvals and escalate when they’re missed.
- Do: track exception rates by team to target training.
- Don’t: approve exceptions without notes (you lose auditability).
- Don’t: let categories drift (it breaks reporting and accounting mappings).
- Don’t: run month-end close without a reconciliation checklist.
Common mistakes + how to avoid
- Vague policy language → fix: examples + thresholds + what proof is needed.
- Managers rubber-stamp approvals → fix: training + periodic audit sampling.
- Receipt chasing via email → fix: system-based exception notifications and gates.
- Category explosion → fix: governance owner + controlled list updates.
- Late month-end surprises → fix: weekly exception reviews and aging reports.
10) What good looks like + Checklists
Spend is ‘good’ when it’s fast for employees and predictable for finance.
What good looks like (mini rubric)
- Most expenses are approved within your SLA (e.g., 2–5 business days).
- Exceptions are resolved with documented notes and clear ownership.
- Categories/codes are consistent and support reporting and accounting.
- Reconciliations are repeatable and auditable each month.
- Policy violations decrease over time (training + enforcement works).
Pre-check (before you run)
- Write the policy: allowed categories, thresholds, receipt rules, examples.
- Define approval routing and thresholds (who approves what).
- Create the category/coding list and name an owner for changes.
- Decide how reimbursements are handled and who owns the timetable.
- Plan how to handle exceptions and document approvals.
- If integrating with accounting, define mappings and owners.
Post-check (after you run)
- Review approval aging and address bottleneck approvers.
- Review exception rates and identify top 2 causes to fix.
- Audit a small sample of approved expenses for compliance.
- Reconcile totals and confirm coding accuracy for reporting.
- Update policy guidance based on recurring questions.
- Document any changes to thresholds/categories for next month.
11) Practice lab (5–15 min) + Official docs links
Practice: create a simple spend policy and run an exception review on a small set of expenses.
- Draft a 1-page spend policy with 3 thresholds and 5 categories.
- Pick 10 recent expense submissions (or mock ones) and classify them.
- Flag which ones need receipts and which are out-of-policy.
- Write the exact message you’d send to request missing info (template).
- Summarize the exception rate and the top 1–2 causes.
- Update your policy doc or training note to reduce those causes.
- You can clearly decide whether an expense is in-policy or not.
- Exceptions are handled through a consistent process with documentation.
- Categories/codes stay consistent across submissions.
- A weekly exception review would catch issues before month-end.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Expense Management (product overview)
- Rippling navigation showing Spend sub-products (Corporate Cards, Bill Pay, Travel)
- Rippling+ → Help Center entry point
Global (Employer of Record, Global Payroll, Global Contractors)
1) Quick scan + Orientation
Who is this for + When to use
- HR/People Ops teams hiring outside your home country.
- Finance/payroll teams coordinating international pay cycles.
- Founders/ops leads deciding between entity, EOR, or contractor models.
Where in navigation + Related tabs
- Where: Products → Global (and Payroll family: Employer of Record, Global Payroll, Global Contractors, Contractor of Record).
- Related: HRIS (global data), Payroll (domestic), Recruiting (international hiring), Security (data handling), Platform (integrations/workflows).
3–5 things you’ll do most
- Decide the right engagement model per country (employee vs contractor; EOR vs entity).
- Collect country-specific required info early (avoid last-minute compliance blocks).
- Set a consistent onboarding checklist for global hires.
- Align pay schedules and currency/bank details with payroll timelines.
- Maintain documentation for audits (contracts, classification decisions).
2) Mental model / Flow
Global work is mostly about choosing the correct legal/employment model, then running a predictable data + pay process. The easiest way to fail is to treat global like domestic and ‘figure it out later’.
- Decide the global hiring model per country (EOR, entity payroll, contractor).
- Collect required worker info and documentation for that model.
- Create the worker record in your core system with complete attributes.
- Kick off onboarding tasks and access provisioning through workflows.
- Run pay cycles with a tight checklist and country-specific validations.
- Review compliance and classification decisions periodically.
3) Objects & Terms
Use these terms consistently when discussing global hiring.
4) State machine / Lifecycle
Global employment adds more states because compliance steps differ by country.
- Model decision: employee (EOR/entity) vs contractor path chosen.
- Documentation: required contracts and worker details collected.
- Onboarding: identity/access + local requirements completed.
- Pay cycles: recurring payroll/contractor payments executed with checks.
- Offboarding: end dates + final payments + access removal handled.
5) Core jobs-to-be-done
High-leverage jobs for global operations are mostly ‘decision + checklist’ work.
- Choose the right hiring model per country with clear decision criteria.
- Standardize global onboarding inputs (bank info, address, tax details as required).
- Align global pay calendars and cutoffs (avoid ‘urgent’ last-minute runs).
- Track contractor vs employee classification decisions and reviews.
- Automate global onboarding/offboarding tasks with a consistent workflow.
- Maintain compliance documentation and an audit-ready trail.
6) Happy path workflow #1
Workflow: hire a global employee using the EOR path (happy path).
- Confirm the country and whether you have an entity there.
- Choose EOR when you need to hire without setting up an entity.
- Collect required worker information and employment terms early.
- Create the worker record with complete HRIS attributes for downstream automation.
- Kick off onboarding tasks (access, equipment, manager checklist).
- Validate pay schedule expectations and confirm the first pay date.
7) Happy path workflow #2
Workflow: pay a global contractor reliably (without classification surprises).
- Confirm contractor classification and required documentation for the jurisdiction.
- Collect payout details (banking, invoice method, currency expectations).
- Create a repeatable payment cadence and cutoff schedule.
- Collect/approve invoices or work confirmations before payment.
- Execute payment and record documentation for audit/finance.
- Review contractor relationships periodically for classification risk.
8) Decision points
Global success depends on making the model decision correctly.
| Decision | If A… | If B… |
|---|---|---|
| Country presence | No entity: consider EOR for employees. | Entity exists: run payroll directly via your entity setup. |
| Worker type | Employee: choose EOR/entity payroll based on presence. | Contractor: set a clear process and periodic misclassification review. |
| Speed vs control | EOR can be faster to start in a new country. | Entity payroll offers more direct control but needs entity setup and processes. |
| Compliance ownership | Assign a global owner (HR/ops) for each country path. | Leave ownership diffuse (risk: missed requirements and delays). |
9) Guardrails: Do / Don’t & Common mistakes
Global guardrails = clear decisions + repeatable checklists + documentation.
Do / Don’t
- Do: decide the hiring model per country before making an offer.
- Do: collect required documentation early (don’t wait for day 1).
- Do: keep a documented classification decision for contractors.
- Don’t: assume domestic payroll rules apply internationally.
- Don’t: change worker type (contractor ↔ employee) without a clear process and review.
- Don’t: run payments without cutoffs and approvals (audit pain later).
Common mistakes + how to avoid
- Offer made before model decision → fix: require model decision in recruiting workflow.
- Missing local info blocks onboarding/pay → fix: country-specific onboarding checklist.
- Contractor misclassification risk ignored → fix: periodic review + documented rationale.
- No clear pay calendar → fix: publish global pay cutoffs and owners.
- Global offboarding not coordinated → fix: same-day access removal + final pay checklist.
10) What good looks like + Checklists
Global is ‘good’ when hiring is predictable and compliance surprises are rare.
What good looks like (mini rubric)
- For each country, the engagement model is documented and repeatable.
- Global onboarding checklists cover required local inputs before start date.
- Pay cycles run on a published calendar with clear cutoffs and approvals.
- Contractor classification decisions are reviewed periodically.
- You can produce an audit-ready record of key documents and decisions.
Pre-check (before you run)
- Decide hiring model per country (EOR/entity/contractor) and document why.
- Create a country-specific onboarding checklist and assign owners.
- Align global pay calendars and cutoffs with finance operations.
- Define documentation storage and naming conventions.
- Set up offboarding steps (access removal + final payments).
- Establish a review cadence for contractor classification risk.
Post-check (after you run)
- Review first pay cycle outcomes and any exceptions.
- Audit missing onboarding fields for global workers and fix the intake process.
- Check that access provisioning/deprovisioning matched the planned dates.
- Update country checklists based on what surprised the team.
- Review contractor relationships for scope creep or role similarity to employees.
- Document lessons learned and standardize the improved workflow.
11) Practice lab (5–15 min) + Official docs links
Practice: create a ‘global hiring decision sheet’ for one country and run a mock hire through it.
- Pick one target country you might hire in.
- Write the decision criteria: entity vs EOR vs contractor (simple A/B rules).
- List the minimum onboarding fields and documents you must collect.
- Draft a pay calendar and cutoffs for the first two pay cycles.
- Run a mock scenario end-to-end and note where you lack information.
- Convert notes into an updated checklist and assign owners.
- You can justify the model choice in a short, auditable write-up.
- Onboarding inputs are known before start date (no last-minute scrambling).
- Pay cutoffs and owners are clear for the first cycles.
- A recurring review exists for contractor classification risk.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Employer of Record (product overview)
- Global Payroll (product overview)
- Rippling navigation showing Global products
- Rippling+ → Help Center entry point
Security & Data Protection (Trust, controls, and operational hygiene)
1) Quick scan + Orientation
Who is this for + When to use
- Admins responsible for security posture and access governance.
- IT/security teams implementing identity and access hygiene.
- Leaders preparing for audits or vendor security reviews.
Where in navigation + Related tabs
- Where: Resources → Security & Data Protection (plus security controls live across Platform + IT modules).
- Related: Platform (Permissions/Policies), IT (Identity & Access), HRIS (who is in the system), Integrations (third-party risk).
3–5 things you’ll do most
- Define least-privilege roles and review privileged access routinely.
- Standardize join/change/leave access workflows (especially offboarding).
- Protect sensitive data fields with stricter access and audit trails.
- Monitor exceptions: failed workflows, sync errors, unusual access changes.
- Prepare an ‘audit packet’ (what to show, where to find it, who owns it).
2) Mental model / Flow
Security is not one setting—it’s a set of operational routines powered by permissions, policies, identity controls, and monitoring. Good security is repeatable and reviewable, not hero-driven.
- Define roles and least-privilege access boundaries.
- Secure identity and access management (join/change/leave routines).
- Protect sensitive data with scoped access and change controls.
- Establish monitoring for exceptions and suspicious patterns.
- Run recurring reviews (privileged access, stale accounts, integrations).
- Document controls and evidence sources for audits.
3) Objects & Terms
Security conversations go faster when everyone uses the same words.
4) State machine / Lifecycle
Security work repeats on a cadence (weekly/monthly/quarterly).
- Baseline: define roles, policies, and identity setup.
- Operate: onboard/offboard and handle changes via workflows.
- Monitor: review exceptions and suspicious patterns.
- Review: periodic access reviews and integration audits.
- Improve: tighten controls based on incidents and findings.
5) Core jobs-to-be-done
These jobs create most of your security value.
- Define admin roles and remove ‘everyone is admin’ patterns.
- Secure onboarding/offboarding so access changes are automatic and timely.
- Protect sensitive data fields with restricted access and logging.
- Review privileged access regularly and remove stale access quickly.
- Audit integrations and ensure they follow system-of-record rules.
- Maintain evidence artifacts for audits and security questionnaires.
6) Happy path workflow #1
Workflow: quarterly access review (simple, high impact).
- List your privileged roles (admins, finance control roles, IT superusers).
- Export a current roster of who holds each privileged role.
- Have role owners confirm each person still needs access (approve/remove).
- Remove access for leavers, role-changers, and inactive users promptly.
- Record decisions and reasons (audit-friendly notes).
- Schedule the next review and track completion.
7) Happy path workflow #2
Workflow: security incident hygiene for access changes (contain fast).
- Identify the scope: which user(s), which roles, which integrations/apps are involved.
- Immediately revoke or suspend access for impacted accounts (containment).
- Check recent access-change activity and integration sync events.
- Reset credentials/keys and re-auth integrations if needed.
- Restore access using least-privilege and confirm normal operations.
- Run a post-incident review and update controls to prevent recurrence.
8) Decision points
Security is full of tradeoffs; make them explicit.
| Decision | If A… | If B… |
|---|---|---|
| Admin model | Few admins + clear escalation paths. | Many admins for speed (higher risk; needs stronger monitoring). |
| Access changes | All changes through requests/approvals/workflows. | Ad hoc changes (fast, poor auditability). |
| Integration governance | Per-integration owner + monitoring + reviews. | No clear owner (risk: silent drift and stale credentials). |
| Audit readiness | Maintain an evidence checklist continuously. | Scramble during audit season (higher stress and more gaps). |
9) Guardrails: Do / Don’t & Common mistakes
Most security failures are process failures—guardrail the process.
Do / Don’t
- Do: review privileged access on a calendar (quarterly at minimum).
- Do: automate offboarding so access revocation is timely.
- Do: protect sensitive data fields with stricter role scopes.
- Don’t: share admin accounts or skip documentation for changes.
- Don’t: leave stale integrations connected without monitoring and ownership.
- Don’t: treat audits as a one-time event—build evidence as you operate.
Common mistakes + how to avoid
- Too many admins → fix: reduce admin set; use approvals for elevated actions.
- Offboarding not immediate → fix: automate revoke access at end date/time.
- No integration ownership → fix: assign an owner and review cadence per integration.
- Sensitive data overly exposed → fix: restrict field access and document why.
- No evidence trail → fix: maintain a living audit checklist and store artifacts.
10) What good looks like + Checklists
Security is ‘good’ when controls are repeatable and evidence is easy to produce.
What good looks like (mini rubric)
- Admin and privileged roles are small, reviewed, and clearly owned.
- Access changes are tracked and approved for sensitive actions.
- Offboarding revokes access reliably and quickly.
- Integration connections are monitored and revalidated periodically.
- Audit evidence (rosters, logs, reviews) is available without scrambling.
Pre-check (before you run)
- Define privileged roles and who can grant them.
- Set a quarterly access review schedule and assign owners.
- Document offboarding access revocation steps and timing.
- Identify sensitive data fields and restrict access scopes.
- Assign an owner for each critical integration and its credential lifecycle.
- Create an audit evidence checklist (where to find each artifact).
Post-check (after you run)
- Confirm the access review completed and removals were applied.
- Review exceptions: failed workflows, access change anomalies, sync errors.
- Rotate credentials/keys where policies require it.
- Update documentation with any new roles, integrations, or controls.
- Run a spot audit: can you produce the evidence you promised?
- Schedule the next review and track completion.
11) Practice lab (5–15 min) + Official docs links
Practice: build a tiny ‘audit packet’ for access governance (10 minutes).
- List your top 5 privileged roles/groups and their owners.
- Capture a roster of who currently has each role.
- Write the review question: “Does this person still need this access?”
- Record one example decision (keep/remove) with a reason.
- Create a simple cadence note (quarterly) and where evidence will be stored.
- Share the packet with a stakeholder and get sign-off on the process.
- You can show who has privileged access and why.
- A review cadence and owner exist (not ‘we’ll do it later’).
- Evidence storage is defined and reusable.
- Offboarding access revocation is part of your standard workflow.
Permissions & Roles
Data & Integrations
Official docs links (titles)
- Security & Data Protection (official page)
- Rippling Platform (permissions/policies context)
- Identity & Access Management (IT)